Bump Tomcat to 11.0.x and base Docker image to JDK 21

.github/workflows/kb_beta_release.yml

@@ -0,0 +1,70 @@
+name: kb_beta_release
+
+# Publishes a single, explicitly-pinned killbill/killbill:<version> docker image for beta / release-candidate versions
+# (e.g. 0.25.1), without touching KAUI and `latest` tag (hence named "beta" release: it only ever publishes an
+# explicit, pinned version tag and never promotes/updates `latest`).
+#
+# Unlike release.yml, this workflow does not reuse the already-published killbill/base:latest or
+# killbill/killbill:latest images as parents, and it does not publish any intermediate killbill/base:beta-* image to
+# Docker Hub either. Instead, it uses a single dedicated, self-contained multi-stage Dockerfile
+# (docker/templates/killbill/beta/Dockerfile.template, stages: base -> shell -> final) so that:
+#  - branch-local changes (e.g. a Tomcat/JDK bump on a branch such as java2x) are actually baked into the resulting
+#    image, instead of silently falling back to whatever is currently published under :latest on Docker Hub, and
+#  - no intermediate image is ever published publicly - only the final killbill/killbill:<version> tag is pushed.
+#
+# Ansible/ansible-galaxy note: the base stage still installs Tomcat/Java/KPM via this repo's own ansible roles
+# (same as release.yml), to keep user/group/permissions/ACL setup identical to a normal release image rather than
+# hand-rolling it differently here.
+#
+# IMPORTANT - killbill-cloud git ref used for the ansible roles: the base stage fetches the ansible roles fresh from
+# GitHub via `ansible-galaxy install git+...,<ref>` - it does NOT use this workflow run's own checkout for that. Rather
+# than a separate input, this workflow uses ${{ github.ref_name }}, i.e. whatever branch you pick in the
+# "Use workflow from" selector above.
+#
+# Concretely: if you pick "java2x" there, make sure your ansible/Dockerfile changes on java2x are already committed
+# AND pushed to origin/java2x before running this. Uncommitted or unpushed local changes will NOT be picked up, since
+# the clone happens fresh from GitHub.
+on:
+  workflow_dispatch:
+    inputs:
+      killbill_version:
+        description: 'Kill Bill version to release (must already be published to Maven Central, e.g. 0.25.1)'
+        required: true
+      nexus_repository:
+        description: 'Nexus repository for KPM'
+        required: true
+        default: 'maven2'
+
+jobs:
+  docker:
+    name: Publish killbill/killbill beta/RC image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Bake the pinned Kill Bill version into the Dockerfile (same __VERSION__ substitution dockerTemplate.sh does for
+      # docker/templates/killbill/tagged/Dockerfile.template), then build+push the final stage only.
+      # The `base` and `shell` (See "stage" in the template) intermediate stages are never pushed. They exist purely
+      # inside this one buildx invocation's build graph.
+      - name: Build and push killbill beta/RC image
+        run: |
+          cd docker/templates/killbill
+          sed -e "s/__VERSION__/${{ github.event.inputs.killbill_version }}/" beta/Dockerfile.template > beta/Dockerfile
+          sed -e "s/__VERSION__/${{ github.event.inputs.killbill_version }}/" tagged/kpm.yml.template > tagged/kpm.yml
+          docker buildx build --push --platform=linux/arm64,linux/amd64 --no-cache \
+            --target final \
+            -t killbill/killbill:${{ github.event.inputs.killbill_version }} \
+            -f beta/Dockerfile \
+            --build-arg KILLBILL_CLOUD_REF=${{ github.ref_name }} \
+            --build-arg NEXUS_REPOSITORY=${{ github.event.inputs.nexus_repository }} \
+            .

.github/workflows/kpm_release.yml

@@ -52,7 +52,7 @@ jobs:
         uses: actions/setup-java@v3.3.0
         if: github.event.inputs.snapshot_only == 'false'
         with:
-          java-version: 11
+          java-version: 21
           distribution: temurin
           server-id: central
           server-username: MAVEN_USERNAME
@@ -63,7 +63,7 @@ jobs:
         uses: actions/setup-java@v3.3.0
         if: github.event.inputs.snapshot_only == 'true'
         with:
-          java-version: 11
+          java-version: 21
           distribution: temurin
           server-id: sonatype-nexus-snapshots
           server-username: MAVEN_USERNAME

ansible/README.md

@@ -31,7 +31,7 @@ The roles can now be referenced in your playbooks via `killbill-cloud/ansible/ro
 
 Requirements:
 
-* Java must be pre-installed on the target hosts (e.g. install the openjdk-11-jdk-headless package on Ubuntu). In the rest of this documentation, we will assume `$TARGET_JAVA_HOME` points to the Java home installation on the *target* hosts (e.g. `/usr/lib/jvm/java-11-openjdk-amd64`).
+* Java must be pre-installed on the target hosts (e.g. install the openjdk-21-jdk-headless package on Ubuntu). In the rest of this documentation, we will assume `$TARGET_JAVA_HOME` points to the Java home installation on the *target* hosts (e.g. `/usr/lib/jvm/java-21-openjdk-amd64`).
 * Before installing Kill Bill and/or Kaui, KPM must be installed via the kpm.yml playbook.
 
 

ansible/java.yml

@@ -2,8 +2,8 @@
 - name: Install Java
   hosts: all
   vars:
-    java_package: openjdk-11-jdk
-    default_java_home: /usr/lib/jvm/java-11-openjdk-amd64
+    java_package: openjdk-21-jdk
+    default_java_home: /usr/lib/jvm/java-21-openjdk-amd64
     java_home: /usr/lib/jvm/default-java
   tasks:
     - name: Install Java

ansible/roles/tomcat/tasks/install.yml

@@ -38,14 +38,14 @@
 # We don't use the xml module to avoid a dependency on lxml
 - name: Set tomcat_version
   ansible.builtin.set_fact:
-    tomcat_version: "{{ tomcat_metadata.content | regex_findall('<version>(9.0.*)</version>', '\\1') | last }}"
+    tomcat_version: "{{ tomcat_metadata.content | regex_findall('<version>(11.0.*)</version>', '\\1') | last }}"
   when: tomcat_version is undefined
   tags: install
 
 - name: Install Tomcat
   become: true
   ansible.builtin.unarchive:
-    src: "http://archive.apache.org/dist/tomcat/tomcat-9/v{{ tomcat_version }}/bin/apache-tomcat-{{ tomcat_version }}.tar.gz"
+    src: "http://archive.apache.org/dist/tomcat/tomcat-11/v{{ tomcat_version }}/bin/apache-tomcat-{{ tomcat_version }}.tar.gz"
     remote_src: true
     dest: "{{ tomcat_install_dir }}"
     owner: "{{ tomcat_owner }}"

ansible/roles/tomcat/tasks/main.yml

@@ -27,8 +27,9 @@
     mode: "{{ item.mode }}"
     owner: "{{ tomcat_owner }}"
     group: "{{ tomcat_group }}"
-    # If the files already exist, don't clobber them
-    force: false
+    # Preserve existing user-managed files, except setenv.sh: its JVM
+    # hostname must be refreshed when the inventory/configuration changes.
+    force: "{{ item.force | default(false) }}"
   with_items:
     - src: tomcat/conf
       name: context.xml
@@ -42,6 +43,7 @@
       name: setenv.sh
       mode: u=rwx,g=rx,o=rx
       dest: "{{ catalina_base }}/bin"
+      force: true
     - src: tomcat/conf
       name: web.xml
       mode: u=rw,g=r,o=r

ansible/roles/tomcat/tasks/native.yml

@@ -93,7 +93,6 @@
           - --prefix={{ catalina_home }}
           - --with-apr={{ tomcat_apr_config_path }}
           - --with-java-home={{ java_home }}
-          - --with-ssl=yes
         chdir: "{{ tomcat_workspace.path }}/native"
       changed_when: false
       tags: native

ansible/templates/tomcat/conf/web.xml.j2

@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
-<web-app xmlns="http://java.sun.com/xml/ns/javaee"
+<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
-                      http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-  version="3.0">
+  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee
+                      https://jakarta.ee/xml/ns/jakartaee/web-app_6_1.xsd"
+  version="6.1">
   <!-- ================== Built In Servlet Definitions ==================== -->
   <servlet>
       <servlet-name>default</servlet-name>

docker/README.adoc

@@ -10,7 +10,7 @@ toc::[]
 [[available-images]]
 ## Available images
 
-* `killbill/base:latest`: Shared base image with Tomcat and KPM inside Ubuntu 20.04 LTS. It also contains Ansible and our playbooks from https://github.com/killbill/killbill-cloud. It starts Tomcat on startup.
+* `killbill/base:latest`: Shared base image with Tomcat and KPM inside Ubuntu 24.04 LTS. It also contains Ansible and our playbooks from https://github.com/killbill/killbill-cloud. It starts Tomcat on startup.
 * `killbill/killbill:latest`: Empty base Kill Bill image. Includes the `killbill-flyway` utility. It runs `kpm install` on startup. If no custom `kpm.yml` file is specified, the latest version of Kill Bill is downloaded.
 * `killbill/killbill:0.X.Y`: Image with a specific version of Kill Bill installed.
 * `killbill/kaui:latest`: Empty base Kaui image. It runs `kpm install` on startup. If no custom `kpm.yml` file is specified, the latest version of Kaui is downloaded.

docker/templates/base/latest/Dockerfile

@@ -11,6 +11,7 @@ ENV PYTHONIOENCODING=utf8
 # https://github.com/moby/moby/issues/4032
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
+    apt-get upgrade -y && \
     apt-get install --no-install-recommends -y \
       ansible \
       # https://github.com/tianon/docker-brew-ubuntu-core/issues/59
@@ -23,7 +24,7 @@ RUN apt-get update && \
       libapr1 \
       mysql-client \
       net-tools \
-      openjdk-11-jdk-headless \
+      openjdk-21-jdk-headless \
       python3-lxml \
       sudo \
       unzip \
@@ -32,7 +33,7 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Configure default JAVA_HOME path
-RUN ln -s java-11-openjdk-$(dpkg --print-architecture) /usr/lib/jvm/default-java
+RUN ln -s java-21-openjdk-$(dpkg --print-architecture) /usr/lib/jvm/default-java
 ENV JAVA_HOME=/usr/lib/jvm/default-java
 ENV JSSE_HOME=$JAVA_HOME/jre/
 

docker/templates/build/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:24.04
 LABEL maintainer="killbilling-users@googlegroups.com"
 
 USER root
@@ -29,7 +29,7 @@ RUN apt-get update && \
       maven \
       mysql-client \
       net-tools \
-      openjdk-11-jdk-headless \
+      openjdk-21-jdk-headless \
       postgresql-client \
       python3-lxml \
       software-properties-common \
@@ -41,8 +41,8 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Configure default JAVA_HOME path
-RUN update-java-alternatives -s java-1.11.0-openjdk-$(dpkg --print-architecture)
-RUN rm -f /usr/lib/jvm/default-java && ln -s java-11-openjdk-$(dpkg --print-architecture) /usr/lib/jvm/default-java
+RUN update-java-alternatives -s java-1.21.0-openjdk-$(dpkg --print-architecture)
+RUN rm -f /usr/lib/jvm/default-java && ln -s java-21-openjdk-$(dpkg --print-architecture) /usr/lib/jvm/default-java
 ENV JAVA_HOME=/usr/lib/jvm/default-java
 ENV JSSE_HOME=$JAVA_HOME/jre/