Upgrade netty to 4.1.84.Final

[cwperks]

Signed-off-by: Craig Perkins cwperx@amazon.com

Description

Upgrades netty from 4.1.79.Final -> 4.1.84.Final

Netty has released bugfixes for the issues preventing core from upgrading to 4.1.80.Final. See previous revert commit for details: #4428

Check List

• [] New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Commits are signed per the DCO using --signoff
• Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[reta]

Thanks @cwperks !

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/5429/
• CommitID: 5e68bbc
  Please examine the workflow log, locate, and copy-paste the failure below.
  Flakey test?
  Iterate to green.

[reta]

Gradle Check (Jenkins) Run Completed with:

* **RESULT:** FAILURE x

* **URL:** https://build.ci.opensearch.org/job/gradle-check/5429/

* **CommitID:** [5e68bbc](https://github.com/opensearch-project/OpenSearch/commit/5e68bbc5d3b446dd0f85b6df61f1adfe57093834)
  Please examine the workflow log, locate, and copy-paste the failure below.
  [Flakey test?](https://github.com/opensearch-project/OpenSearch/blob/main/DEVELOPER_GUIDE.md#flakey-tests)
  Iterate to green.

[Pipeline] // node
[Pipeline] End of Pipeline
groovy.lang.MissingPropertyException: No such property: pr_to_clone_url for class: groovy.lang.Binding
	at groovy.lang.Binding.getVariable(Binding.java:63)
	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetProperty(SandboxInterceptor.java:271)
	at org.kohsuke.groovy.sandbox.impl.Checker$7.call(Checker.java:353)
	at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetProperty(Checker.java:357)
	at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetProperty(Checker.java:333)

@peterzhuamazon seems like Jenkins is broken?

[cwperks]

@reta The contribution I made to netty that introduced a build failure for security that required reverting has been patched. This was the initial contribution to read keys using bouncycastle if it was present on the classpath: netty/netty#12670

Fixes in key loading were fixed in 4.1.81.Final - see the first 2 lines here: https://netty.io/news/2022/09/08/4-1-81-Final.html

Another bug associated with the change for reading certificate files with multiple certs inside was included in this past release: https://netty.io/news/2022/10/11/4-1-84-Final.html (last line of release notes)

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: UNSTABLE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/5426/
• CommitID: 9e05ab1
  Please examine the workflow log, locate, and copy-paste the failure below.
  Flakey test?
  Iterate to green.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: SUCCESS ✅
• URL: https://build.ci.opensearch.org/job/gradle-check/5432/
• CommitID: 5e68bbc

[codecov-commenter]

Codecov Report

Merging #4893 (5e68bbc) into main (67a29df) will decrease coverage by 0.01%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #4893      +/-   ##
============================================
- Coverage     70.74%   70.72%   -0.02%     
+ Complexity    57859    57841      -18     
============================================
  Files          4689     4689              
  Lines        276913   276913              
  Branches      40301    40301              
============================================
- Hits         195912   195858      -54     
- Misses        64780    64848      +68     
+ Partials      16221    16207      -14     

Impacted Files	Coverage Δ
...ava/org/opensearch/action/NoSuchNodeException.java	0.00% <0.00%> (-50.00%)	⬇️
.../admin/cluster/reroute/ClusterRerouteResponse.java	60.00% <0.00%> (-40.00%)	⬇️
...luster/routing/allocation/RoutingExplanations.java	62.06% <0.00%> (-37.94%)	⬇️
.../opensearch/client/indices/CloseIndexResponse.java	56.25% <0.00%> (-35.00%)	⬇️
...cluster/routing/allocation/RerouteExplanation.java	70.00% <0.00%> (-30.00%)	⬇️
...pensearch/client/core/MultiTermVectorsRequest.java	41.17% <0.00%> (-29.42%)	⬇️
...opensearch/snapshots/SnapshotRestoreException.java	25.00% <0.00%> (-25.00%)	⬇️
...search/aggregations/pipeline/HoltWintersModel.java	21.47% <0.00%> (-22.82%)	⬇️
...a/org/opensearch/transport/netty4/Netty4Utils.java	42.42% <0.00%> (-21.22%)	⬇️
.../aggregations/support/values/ScriptLongValues.java	41.86% <0.00%> (-20.94%)	⬇️
... and 423 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: UNSTABLE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/5467/
• CommitID: a6cfa26
  Please examine the workflow log, locate, and copy-paste the failure below.
  Flakey test?
  Iterate to green.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: SUCCESS ✅
• URL: https://build.ci.opensearch.org/job/gradle-check/5477/
• CommitID: a6cfa26

[opensearch-trigger-bot]

The backport to 1.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.x 1.x
# Navigate to the new working tree
cd .worktrees/backport-1.x
# Create a new branch
git switch --create backport/backport-4893-to-1.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-1.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.x

Then, create a pull request where the base branch is 1.x and the compare/head branch is backport/backport-4893-to-1.x.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-4893-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-4893-to-2.x.

[opensearch-trigger-bot]

The backport to 2.0 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.0 2.0
# Navigate to the new working tree
cd .worktrees/backport-2.0
# Create a new branch
git switch --create backport/backport-4893-to-2.0
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-2.0
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.0

Then, create a pull request where the base branch is 2.0 and the compare/head branch is backport/backport-4893-to-2.0.

[opensearch-trigger-bot]

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.3 1.3
# Navigate to the new working tree
cd .worktrees/backport-1.3
# Create a new branch
git switch --create backport/backport-4893-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-1.3
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-4893-to-1.3.

[opensearch-trigger-bot]

The backport to 2.1 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.1 2.1
# Navigate to the new working tree
cd .worktrees/backport-2.1
# Create a new branch
git switch --create backport/backport-4893-to-2.1
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-2.1
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.1

Then, create a pull request where the base branch is 2.1 and the compare/head branch is backport/backport-4893-to-2.1.

[opensearch-trigger-bot]

The backport to 2.2 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.2 2.2
# Navigate to the new working tree
cd .worktrees/backport-2.2
# Create a new branch
git switch --create backport/backport-4893-to-2.2
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-2.2
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.2

Then, create a pull request where the base branch is 2.2 and the compare/head branch is backport/backport-4893-to-2.2.

[opensearch-trigger-bot]

The backport to 2.3 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.3 2.3
# Navigate to the new working tree
cd .worktrees/backport-2.3
# Create a new branch
git switch --create backport/backport-4893-to-2.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 8fda187bb459757164cc80c91ca305d274ca2b53
# Push it to GitHub
git push --set-upstream origin backport/backport-4893-to-2.3
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.3

Then, create a pull request where the base branch is 2.3 and the compare/head branch is backport/backport-4893-to-2.3.

[peterzhuamazon]

Gradle Check (Jenkins) Run Completed with:

* **RESULT:** FAILURE x

* **URL:** https://build.ci.opensearch.org/job/gradle-check/5429/

* **CommitID:** [5e68bbc](https://github.com/opensearch-project/OpenSearch/commit/5e68bbc5d3b446dd0f85b6df61f1adfe57093834)
  Please examine the workflow log, locate, and copy-paste the failure below.
  [Flakey test?](https://github.com/opensearch-project/OpenSearch/blob/main/DEVELOPER_GUIDE.md#flakey-tests)
  Iterate to green.

[Pipeline] // node
[Pipeline] End of Pipeline
groovy.lang.MissingPropertyException: No such property: pr_to_clone_url for class: groovy.lang.Binding
	at groovy.lang.Binding.getVariable(Binding.java:63)
	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetProperty(SandboxInterceptor.java:271)
	at org.kohsuke.groovy.sandbox.impl.Checker$7.call(Checker.java:353)
	at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetProperty(Checker.java:357)
	at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetProperty(Checker.java:333)

@peterzhuamazon seems like Jenkins is broken?

We were on another deployment tho. Sorry.
Stable now.

[cwperks]

I will take care of the manual backports

[peterzhuamazon]

Hi @cwperks seems like this part of the documentation also need some updates as well:
https://opensearch.org/docs/latest/security-plugin/configuration/generate-certificates/#generate-an-admin-certificate

See part with pkcs8 let me know if it is accurate.

Thanks.

[cwperks]

@peterzhuamazon It is accurate at the moment, but will change if security adds a new runtime dependency on bcpkix-jdk15on. I'm planning to submit a PR today to add the jar to the security runtime classpath so that it triggers the new netty logic to use bouncycastle to read pem files instead of the built in PEMReader. If the change is accepted I will file an issue and PR against documentation repo to update the docs for generating certificates - thank you for pointing that out!

[cwperks]

Done creating manual backports