HCD-63: Upgrade Netty to 4.1.117 and BoringSSL to 2.0.69

[szymon-miezal]

The primary motivation for this change is a bug that manifests in loading
the cipher list for inter-node connections, which is slightly wider than the
configured list. This bug appears to be a consequence of how OpenSSL handles
cipher loading. Changing it doesn't seem feasible.

Netty introduced changes to mitigate this misbehavior:

• OpenSSL implementation ignores cipher specification for TLSv1.3 netty/netty#13810
• PR #13381 is incompatible with RHEL8 openjdk with FIPS enabled netty/netty#13840

To take advantage of these fixes, we need to upgrade Netty to at least
version 4.1.108. Upgrading Netty also necessitates bumping BoringSSL.

I have found some old CC tests in fallout that I decided to reuse to ensure the performance stays unchanged:

• http://fallout.aws.dsinternal.org/tests/ui/szymon.miezal@datastax.com/cc-write-throughput
• http://fallout.aws.dsinternal.org/tests/ui/szymon.miezal@datastax.com/cc-stargazer-dse-db-lwt-fixed-1000-partitions
• http://fallout.aws.dsinternal.org/tests/ui/szymon.miezal@datastax.com/cc-stargazer-dse-db-write-throughput-batch-100
• http://fallout.aws.dsinternal.org/tests/ui/szymon.miezal@datastax.com/cc-sai-single-node-wide-row
• http://fallout.aws.dsinternal.org/tests/ui/szymon.miezal@datastax.com/cc-stargazer-dsedb-density-1TB

I have used the fallout perf tool to compare the results with main and they seem pretty comparable to me. Example chart:

I am unsure whether there are other tests that exercise CC which could be reused.

[github-actions]

Checklist before you submit for review

• Make sure there is a PR in the CNDB project updating the Converged Cassandra version
• Use NoSpamLogger for log lines that may appear frequently in the logs
• Verify test results on Butler
• Test coverage for new/modified code is > 80%
• Proper code formatting
• Proper title for each commit staring with the project-issue number, like CNDB-1234
• Each commit has a meaningful description
• Each commit is not very long and contains related changes
• Renames, moves and reformatting are in distinct commits

[szymon-miezal]

https://github.com/riptano/cndb/pull/12894

[eolivelli]

Lgtm

[bereng]

Approved. Perf tests reports show nothing out of the ordinary. The test failures Butler complains about are from previous SHA runs. The last remaining one fails in the same manner as al older run.

I would be good to complete the checklist imo.

[szymon-miezal]

After giving it a bit more thought I think it doesn't make much sense to upgrade to non-latest. I am going to bump it to 4.1.117 and retest. It will also allow us to tackle https://github.com/riptano/cndb/pull/12902 at the same time.

[szymon-miezal]

Update: I am rerunning fallout tests after bumping to 4.1.117.

[szymon-miezal]

The results seem comparable with the previous run on 4.1.108.

• http://fallout.aws.dsinternal.org/performance/szymon.miezal@datastax.com/report/76fe992b-9865-4241-8277-8a7fc2e30181
• http://fallout.aws.dsinternal.org/performance/szymon.miezal@datastax.com/report/85607466-eb0e-4974-9584-2c0e53bd4c94
• http://fallout.aws.dsinternal.org/performance/szymon.miezal@datastax.com/report/3d7b1c7a-7049-4a10-a3ba-a1b2ec498fdb
• http://fallout.aws.dsinternal.org/performance/szymon.miezal@datastax.com/report/f1f383d8-f6e5-4df8-aa6a-d2961663720c

Example chart:

https://github.com/riptano/cndb/pull/12894 doesn't seem to expose any netty-specific test failures either.

If there are no votes against it, I will merge it.

[bereng]

Still LGTM +1

[szymon-miezal]

I force-pushed the branch to update the commit-description, and then I realized I didn't have to do it as in CC squash and merge is allowed and the message could be modified via GH.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cassci-bot]

❌ Build ds-cassandra-pr-gate/PR-1544 rejected by Butler

---

1 new test failure(s) in 7 builds
See build details here

---

Found 1 new test failures

Test	Explanation	Branch history	Upstream history
...d.t.s.VectorDistributedTest.rangeRestrictedTest	regression	🔴🔵🔵🔵🔵🔵🔵	🔵🔵🔵🔵🔵🔵🔵

---

Found 16 known test failures

[ekaterinadimitrova2]

I don't see anything mentioned about checking the release notes, the bump is not really small and we should be very careful with updates of dependencies like netty in non-major update.
We were actually looking to update netty on main-5.0 - https://github.com/riptano/cndb/issues/11074
You may also want to look at https://issues.apache.org/jira/browse/CASSANDRA-17992 where we were upgrading in OSS.
I do appreciate the fallout tests!