Why am I getting problems to connect to SSH agents after upgrading to JDK 17

2 minute readKnowledge base

Issue

After upgrading to JDK 17, we are observing a connection error while connecting through SSH.

XXX [SSH] Starting agent process: cd "/tmp/jk" && java  -jar remoting.jar -workDir /tmp/jk -jar-cache /tmp/jk/remoting/jarCache
XXX org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using /tmp/jk/remoting as a remoting work directory
XXX org.jenkinsci.remoting.engine.WorkDirManager setupLogging
INFO: Both error and output logs will be printed to /tmp/jk/remoting
<===[JENKINS REMOTING CAPACITY]===>channel started
Remoting version: 3248.3250.v3277a_8e88c9b_
Launcher: SSHLauncher
Communication Protocol: Standard in/out
This is a Unix agent
ERROR: Unexpected error in launching an agent. This is probably a bug in Jenkins
Also:   hudson.remoting.Channel$CallSiteStackTrace: Remote call to xxxxxxx
		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1826)
		at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:356)
		at hudson.remoting.Channel.call(Channel.java:1042)
		at hudson.FilePath.act(FilePath.java:1320)
		at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.EnvInjectComputerListener.onOnline(EnvInjectComputerListener.java:144)
		at hudson.slaves.SlaveComputer.setChannel(SlaveComputer.java:751)
		at hudson.slaves.SlaveComputer.setChannel(SlaveComputer.java:441)
		at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.startAgent(SSHLauncher.java:645)
		at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:465)
		at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
		at java.base/java.lang.Thread.run(Thread.java:840)
java.lang.reflect.InaccessibleObjectException: Unable to make private native java.lang.reflect.Field[] java.lang.Class.getDeclaredFields0(boolean) accessible: module java.base does not "opens java.lang" to unnamed module @3ba282d0
	at java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:354)
	at java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:297)
	at java.base/java.lang.reflect.Method.checkCanSetAccessible(Method.java:199)
	at java.base/java.lang.reflect.Method.setAccessible(Method.java:193)
	at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.service.EnvInjectMasterEnvVarsSetter.getModifiers(EnvInjectMasterEnvVarsSetter.java:29)
	at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.service.EnvInjectMasterEnvVarsSetter.call(EnvInjectMasterEnvVarsSetter.java:67)
	at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.service.EnvInjectMasterEnvVarsSetter.call(EnvInjectMasterEnvVarsSetter.java:19)
	at hudson.remoting.UserRequest.perform(UserRequest.java:211)
	at hudson.remoting.UserRequest.perform(UserRequest.java:54)
	at hudson.remoting.Request$2.run(Request.java:377)
	at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:78)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:842)

Environment

Resolution

There is a problem with the Environment Injector plugin that prevents the connection from happening, there are two potential approaches that you can take:

  • Disable Environment Injector plugin, restart the instance and confirm that the error has disappeared.

  • Add the following arguments to the outbound agent (SSH): --add-opens java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED

Tested product/plugin versions

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.