Oozie Java-based actions with Java 17

In relation to Java 17, certain applications might require reflective access to internal Java classes, packages, or modules. This section describes how to gain reflective access to these with Oozie.

To enable reflective access, use the --add-opens Java parameter. If your applications executed with Oozie need reflective access, you can use the following properties to specify the required --add-opens arguments:

oozie.launcher.yarn.app.mapreduce.am.command-opts
oozie.launcher.mapreduce.map.java.opts
oozie.launcher.mapred.child.java.opts

For example, in your workflow's configuration, you can set the property as follows:

<property>
    <name>oozie.launcher.yarn.app.mapreduce.am.command-opts</name>
    <value>--add-opens=java.base/java.lang=ALL-UNNAMED</value>
</property>

The Spark and Spark 3 applications inherently require reflective access. Consequently, Oozie automatically adds the following --add-opens properties by default for Spark and Spark 3 actions:

--add-opens=java.base/java.io=ALL-UNNAMED
--add-opens=java.base/java.lang.invoke=ALL-UNNAMED
--add-opens=java.base/java.lang=ALL-UNNAMED
--add-opens=java.base/java.net=ALL-UNNAMED
--add-opens=java.base/java.nio=ALL-UNNAMED
--add-opens=java.base/java.util.concurrent=ALL-UNNAMED
--add-opens=java.base/java.util=ALL-UNNAMED
--add-opens=java.base/sun.nio.ch=ALL-UNNAMED
--add-opens=java.base/sun.nio.cs=ALL-UNNAMED
--add-opens=java.base/sun.security.action=ALL-UNNAMED

It is important to note that this behavior can be overridden for Spark actions by using the oozie.action.spark.launcher.jdk17.opens property, and for Spark3 actions by using the oozie.action.spark3.launcher.jdk17.opens property. By specifying Java modules, packages, or classes in a comma-separated list with these properties, Oozie can configure the appropriate access permissions when launching a Spark or Spark 3 application. Each item in the list should be in a format compatible with the Java --add-opens parameter, such as java.base/java.lang=ALL-UNNAMED.

The following comma-separated list shows the default values of these properties. These are derived from the default values in Spark and Spark 3:

java.base/java.io=ALL-UNNAMED,java.base/java.lang.invoke=ALL-UNNAMED,java.base/java.lang=ALL-UNNAMED,java.base/java.net=ALL-UNNAMED,java.base/java.nio=ALL-UNNAMED,java.base/java.util.concurrent=ALL-UNNAMED,java.base/java.util=ALL-UNNAMED,java.base/sun.nio.ch=ALL-UNNAMED,java.base/sun.nio.cs=ALL-UNNAMED,java.base/sun.security.action=ALL-UNNAMED

However, you have the flexibility to customize the values of these properties by adding a safety-valve setting for the corresponding property on the Oozie configuration page in Cloudera Manager by using the oozie_config_safety_valve setting.

For other Oozie Java-based actions (simple Java action, Distcp, Git, Map-Reduce, Hive2, Shell, Sqoop), Oozie does not add any --add-opens values by default. Nevertheless, you have the option to specify custom --add-opens overrides for each action using the corresponding properties:

oozie.action.distcp.launcher.jdk17.opens
oozie.action.git.launcher.jdk17.opens
oozie.action.hive2.launcher.jdk17.opens
oozie.action.java.launcher.jdk17.opens
oozie.action.map-reduce.launcher.jdk17.opens
oozie.action.shell.launcher.jdk17.opens
oozie.action.sqoop.launcher.jdk17.opens

These properties can be specified globally through a safety-valve configuration, in the job.properties file, in the workflow's global configuration, or inside the workflow as a specific action's configuration. The order of precedence for these configurations is as follows:

If you have configured the property at the action level, it takes precedence over all other settings, and the remaining configurations are disregarded.
If you have configured the property in the global configuration of the workflow, the value from there is used.
If the setting is not available in either of the previous locations, the value configured in your job.properties file is used instead.
Lastly, the global setting in Cloudera Manager comes into effect.