Precheck warning for JDK-8330017 issue during NSX upgrade from 4.2.x to 4.2.1.4/4.2.2.x

Products

VMware NSX

Issue/Introduction

During NSX upgrades from versions 4.2.x to NSX 4.2.1.4 or 4.2.2.x, the UI will explicitly display the following warning during the precheck phase:

Message: Check to validate JDK Issue: JDK-8330017 impacted NSX version: [Current NSX installation may get impacted due to JDK Issue: JDK-8330017. Please follow the workaround mentioned in KB: https://knowledge.broadcom.com/external/article?articleNumber=396719 before doing Host and Edge upgrade

The NSX Upgrade Coordinator (UC) logs will show the following warning, /var/log/upgrade-coordinator/upgrade-coordinator.log:

2025-05-31T06:25:45.030Z  INFO pool-51-thread-1 UpgradeServiceImpl 1752321 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="upgrade-coordinator"] [PUC] Finish Check to validate JDK Issue: JDK-8330017 impacted NSX version on component HOST. Result -- BasicInspectionTaskResult{status=WARNING, taskInfo=InspectionTaskInfo[acknowledgement=false,componentType=HOST,description=This check gives warning if upgrade is performed from JDK Issue: JDK-8330017 impacted NSX version,id=jdkForkJoinPoolIssueCheck-HOST,name=Check to validate JDK Issue: JDK-8330017 impacted NSX version,needsAcknowledgement=true,needsResolution=false,resolution=false,resolutionError=<null>], failureMessages=null, failures=[{"moduleName":"upgrade-coordinator","errorCode":36011,"errorMessage":"Current NSX installation may get impacted due to JDK Issue: JDK-8330017. Please follow the workaround mentioned in KB: https://knowledge.broadcom.com/external/article?articleNumber=396719 before doing Host and Edge upgrade."}]}

Behavior Based on Upgrade Trigger Source:

Trigger Source	Behavior	Required Action
Non-VCF NSX Manager	The warning is shown, but the upgrade can still continue if the error is bypassed. However, if the warning is ignored, the system may remain at risk of ForkJoinPool blocking after the Host upgrade is performed.	Perform a rolling reboot of all Manager nodes before upgrade to eliminate risk and do not bypass the above warning.
VCF SDDC Manager	The warning is treated as a blocking error. The upgrade will not continue until all 3 NSX Manager nodes are rebooted for a given domain.	Perform a rolling reboot of all Manager nodes in that domain and retry upgrade from SDDC Manager.

Environment

VMware NSX 4.2.0.x
VMware NSX 4.2.1.x

Cause

The precheck will trigger if any NSX Manager has not been rebooted in the previous 24 hours.
The warning will occur for upgrades from versions 4.2.x to 4.2.1.4 or 4.2.2.x.
In VCF SDDC Manager, the precheck warning appears only when upgrading versions 4.2.x to version 4.2.2.x, not 4.2.1.4. However, if the upgrade is triggered from NSX Manager, the warning will show for both 4.2.1.4 and 4.2.2.x. In VCF this applies to both Management Domain and Workload Domains.

Broadcom strongly recommends to action the pre-check to avoid the serious impact of the JDK-8330017 issue, see NSX is Impacted by JDK-8330017: ForkJoinPool Stops Executing Tasks Due to ctl Field Release Count (RC) Overflow.

Resolution

To resolve the issue perform a rolling reboot of the NSX Managers and re-run the prechecks, only then trigger the Edge and Host upgrade.

Details:

Perform a rolling reboot of all NSX Manager nodes:
- Reboot all 3 NSX Manager nodes, one at a time
  
  1) Reboot the first NSX Manager.
  2) SSH to a Manager as admin user and check cluster health: get cluster status
  3) When all services report up on all 3 NSX Manager nodes, reboot the next Manager.
  4) Repeat steps 2 and 3 for the third Manager.
- Rerun the upgrade prechecks

Note: The prechecks must be re-run within 24 hours of rebooting the Managers.
If prechecks are re-run after 24 hours, the warning will reappear, blocking upgrade (in VCF scenarios) or exposing risk (in direct NSX Manager-triggered upgrades).

- In VCF environments where NSX Manager nodes are different across domains, upgrade a domain only after rebooting its NSX Managers. Follow the same process for each domain, reboot its NSX Managers first and then proceed with that domain's upgrade.
  Note: This applies to both Management and Workload domains if NSX Managers are separate in VCF environments.
Start the upgrade within 24 hours of the first Manager node reboot:
- Once the upgrade begins within the 24-hour window, it may continue past that duration.

Additional Information

NSX is Impacted by JDK-8330017: ForkJoinPool Stops Executing Tasks Due to ctl Field Release Count (RC) Overflow