Why am I getting problems to connect to SSH agents after upgrading to JDK 17

2 minute readKnowledge base

Issue

After upgrading to JDK 17, we are observing a connection error while connecting through SSH.

XXX [SSH] Starting agent process: cd "/tmp/jk" && java  -jar remoting.jar -workDir /tmp/jk -jar-cache /tmp/jk/remoting/jarCache
XXX org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using /tmp/jk/remoting as a remoting work directory
XXX org.jenkinsci.remoting.engine.WorkDirManager setupLogging
INFO: Both error and output logs will be printed to /tmp/jk/remoting
<===[JENKINS REMOTING CAPACITY]===>channel started
Remoting version: 3248.3250.v3277a_8e88c9b_
Launcher: SSHLauncher
Communication Protocol: Standard in/out
This is a Unix agent
ERROR: Unexpected error in launching an agent. This is probably a bug in Jenkins
Also:   hudson.remoting.Channel$CallSiteStackTrace: Remote call to xxxxxxx
		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1826)
		at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:356)
		at hudson.remoting.Channel.call(Channel.java:1042)
		at hudson.FilePath.act(FilePath.java:1320)
		at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.EnvInjectComputerListener.onOnline(EnvInjectComputerListener.java:144)
		at hudson.slaves.SlaveComputer.setChannel(SlaveComputer.java:751)
		at hudson.slaves.SlaveComputer.setChannel(SlaveComputer.java:441)
		at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.startAgent(SSHLauncher.java:645)
		at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:465)
		at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
		at java.base/java.lang.Thread.run(Thread.java:840)
java.lang.reflect.InaccessibleObjectException: Unable to make private native java.lang.reflect.Field[] java.lang.Class.getDeclaredFields0(boolean) accessible: module java.base does not "opens java.lang" to unnamed module @3ba282d0
	at java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:354)
	at java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:297)
	at java.base/java.lang.reflect.Method.checkCanSetAccessible(Method.java:199)
	at java.base/java.lang.reflect.Method.setAccessible(Method.java:193)
	at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.service.EnvInjectMasterEnvVarsSetter.getModifiers(EnvInjectMasterEnvVarsSetter.java:29)
	at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.service.EnvInjectMasterEnvVarsSetter.call(EnvInjectMasterEnvVarsSetter.java:67)
	at PluginClassLoader for envinject//org.jenkinsci.plugins.envinject.service.EnvInjectMasterEnvVarsSetter.call(EnvInjectMasterEnvVarsSetter.java:19)
	at hudson.remoting.UserRequest.perform(UserRequest.java:211)
	at hudson.remoting.UserRequest.perform(UserRequest.java:54)
	at hudson.remoting.Request$2.run(Request.java:377)
	at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:78)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:842)

Environment

Resolution

There is a problem with the Environment Injector plugin that prevents the connection from happening, there are two potential approaches that you can take:

  • Disable Environment Injector plugin, restart the instance and confirm that the error has disappeared.

  • Add the following arguments to the outbound agent (SSH): --add-opens java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED

Tested product/plugin versions