Add support for alternative JDK installation options in prereq_jdk role

roles/prereq_jdk/README.md

@@ -13,6 +13,8 @@ The role will:
 - For JDKs installed from Cloudera's repository, the role will ensure that any missing symbolic links are created to support a consistent JDK installation path.
 - Compare JDK against the support matrix at [supportmatrix.cloudera.com/](https://supportmatrix.cloudera.com) for the specified versions of Cloudera Manager and Cloudera Runtime.
 
+- The primary JDK (as defined by `jdk_provider` and `jdk_version`) will always be set as the system default and linked to `/usr/bin/java`.
+- Any additional JDKs installed via `additional_jdk_packages` will not be set as the system default. To use these alternative JDKs, you must reference their explicit paths in scripts or applications (e.g., `/usr/lib/jvm/zulu21-jdk/bin/java`).
 # Requirements
 
 - Root or `sudo` privileges are required to install packages and modify system-wide configuration files.
@@ -35,6 +37,9 @@ None.
 | `jdk_security_paths_override` | `bool` | `False` | `False` | Flag to control behavior when multiple `java.security` files are found in the specified paths. If `true`, the role will continue with JCE changes even if multiple files are found. If `false`, the role will fail, requiring a more specific path list. |
 | `cloudera_manager_version` | `str` | `True` | | The version of Cloudera Manager to validate against. |
 | `cloudera_runtime_version` | `str` | `True` | | The version of Cloudera Runtime to validate against. |
+| `additional_jdk_packages` | `list` of `str` | `False` |  | List of alternative JDK packages to install (e.g., `openjdk-21-jdk`, `zulu21-jdk`). |
+| `additional_jdk_repository` | `str` | `False` |  | Repository URL for the alternative JDK. |
+| `additional_jdk_key` | `str` | `False` |  | GPG key URL for the alternative JDK repository. |
 
 # Example Playbook
 
@@ -70,6 +75,18 @@ None.
         jdk_security_paths_override: false
         cloudera_manager_version: "7.11.3"
         cloudera_runtime_version: "7.1.9"
+
+    - name: Set up OpenJDK 17 as default and Azul Zulu 21 as alternative
+      ansible.builtin.import_role:
+        name: cloudera.exe.prereq_jdk
+      vars:
+        cloudera_manager_version: "7.11.3"
+        cloudera_runtime_version: "7.1.9"
+        jdk_version: 17
+        additional_jdk_packages:
+          - zulu21-jdk
+        additional_jdk_repository: "https://cdn.azul.com/zulu/bin/zulu-repo-1.0.0-1.noarch.rpm"
+        additional_jdk_key: "https://repos.azul.com/azul-repo.key"
 ```
 
 # License

roles/prereq_jdk/defaults/main.yml

@@ -22,3 +22,6 @@ jdk_security_paths_override: false
 
 cloudera_manager_version: "{{ undef(hint='Please specify the Cloudera Manager version') }}"
 cloudera_runtime_version: "{{ undef(hint='Please specify the Cloudera Runtime version') }}"
+# additional_jdk_packages:
+# additional_jdk_repository:
+# additional_jdk_key:

roles/prereq_jdk/meta/argument_specs.yml

@@ -20,6 +20,8 @@ argument_specs:
       - Set up the Java Development Kit (JDK), optionally installing the JDK itself.
       - For JDK 9 and below, optionally enable the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy.
       - If the JDK is installed from the Cloudera repo, add any missing symlinks.
+      - The primary JDK (as defined by jdk_provider and jdk_version) will always be set as the system default and linked to /usr/bin/java.
+      - Any additional JDKs installed via additional_jdk_packages will not be set as the system default; to use them, explicit paths must be referenced in scripts or applications.
     author: Cloudera Labs
     version_added: "3.0.0"
     options:
@@ -68,3 +70,19 @@ argument_specs:
         description: Version of Cloudera Runtime for validation testing
         type: str
         required: true
+      additional_jdk_packages:
+        description:
+          - List of alternative JDK packages to install (e.g., openjdk-21-jdk, zulu21-jdk).
+        type: list
+        elements: str
+        required: false
+      additional_jdk_repository:
+        description:
+          - Repository URL for the alternative JDK.
+        type: str
+        required: false
+      additional_jdk_key:
+        description:
+          - GPG key URL for the alternative JDK repository.
+        type: str
+        required: false

roles/prereq_jdk/tasks/RedHat.yml

@@ -0,0 +1,32 @@
+# Copyright 2025 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+- name: Import alternative JDK GPG key for RPM
+  ansible.builtin.rpm_key:
+    state: present
+    key: "{{ additional_jdk_key }}"
+  when: additional_jdk_repository is defined and additional_jdk_key is defined
+
+- name: Install alternative JDK repository
+  ansible.builtin.dnf:
+    name: "{{ additional_jdk_repository }}"
+    state: present
+  when: additional_jdk_repository is defined
+
+- name: Install alternative JDK packages
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ additional_jdk_packages }}"

roles/prereq_jdk/tasks/Rocky.yml

@@ -0,0 +1,32 @@
+# Copyright 2025 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+- name: Import alternative JDK GPG key for RPM
+  ansible.builtin.rpm_key:
+    state: present
+    key: "{{ additional_jdk_key }}"
+  when: additional_jdk_repository is defined and additional_jdk_key is defined
+
+- name: Install alternative JDK repository
+  ansible.builtin.dnf:
+    name: "{{ additional_jdk_repository }}"
+    state: present
+  when: additional_jdk_repository is defined
+
+- name: Install alternative JDK packages
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ additional_jdk_packages }}"

roles/prereq_jdk/tasks/main.yml

@@ -130,4 +130,26 @@
       )
     )
 
+- name: Install alternative JDKs if additional_jdk_packages is set
+  when: additional_jdk_packages is defined and additional_jdk_packages | length > 0
+  block:
+    - name: Install alternative JDKs (OS-specific)
+      ansible.builtin.include_tasks: "{{ ansible_facts['os_family'] }}.yml"
+
+    - name: Find an existing JDK installation
+      ansible.builtin.stat:
+        path: /usr/bin/java
+      register: jdk_dir
+
+    - block:
+        - name: Set java alternative back to JDK
+          community.general.alternatives:
+            name: java
+            path: "{{ jdk_dir.stat.lnk_source | default('/usr/bin/java') }}"
+
+        - name: Set javac alternative back to JDK
+          community.general.alternatives:
+            name: javac
+            path: "{{ (jdk_dir.stat.lnk_source | regex_replace('java$', 'javac')) if jdk_dir.stat.islnk else '/usr/bin/javac' }}"
+      when: jdk_dir.stat.exists
 # https://docs.cloudera.com/cdp-private-cloud-base/7.1.9/installation/topics/cdpdc-manually-installing-openjdk.html