{"record":{"id":"038eae620a64be08","repo":"t8y2/dbx","slug":"load-kerberos-keytab-s-w","errorCode":null,"errorMessage":"load Kerberos keytab %s: %w","messagePattern":"load Kerberos keytab (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":301,"sourceCode":"}\n\nfunc newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {\n\tsettings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}\n\tswitch config.credentialMode {\n\tcase kerberosCredentialCCache:\n\t\tcache, err := credentials.LoadCCache(config.ccachePath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Kerberos credential cache %s: %w\", config.ccachePath, err)\n\t\t}\n\t\tclient, err := krb5client.NewFromCCache(cache, krbConfig, settings...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create Kerberos client from credential cache: %w\", err)\n\t\t}\n\t\treturn client, nil\n\tcase kerberosCredentialKeytab:\n\t\tloadedKeytab, err := keytab.Load(config.keytabPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Kerberos keytab %s: %w\", config.keytabPath, err)\n\t\t}\n\t\treturn krb5client.NewWithKeytab(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,\n\t\t\tloadedKeytab,\n\t\t\tkrbConfig,\n\t\t\tsettings...,\n\t\t), nil\n\tcase kerberosCredentialPassword:\n\t\treturn krb5client.NewWithPassword(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,\n\t\t\tconfig.password,\n\t\t\tkrbConfig,\n\t\t\tsettings...,\n\t\t), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"Kerberos credentials are not configured\")","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L283-L319","documentation":"When credential mode is keytab, newKerberosClient loads the keytab file with keytab.Load. Failure to read or parse the keytab (missing file, bad permissions, corrupt/incompatible format) is wrapped with the keytab path.","triggerScenarios":"kerberosCredentialKeytab selected and keytab.Load(config.keytabPath) fails: the file at the finalized keytabPath does not exist, is unreadable by the process user, or is not a valid keytab.","commonSituations":"Keytab not mounted into the container/pod; wrong path after finalize normalization; keytab owned by root with 0600; truncated or binary-mangled keytab from a bad transfer (e.g. FTP in ASCII mode).","solutions":["Verify the file exists at the reported path and is readable by the service user (`ls -l`, `klist -kt <path>`).","Re-transfer/re-extract the keytab on the KDC (`ktadd -k`) if it is corrupt; use binary-safe transfer.","Fix ownership/permissions (chown service user, chmod 600) or mount the secret correctly in Kubernetes/Docker.","If finalize derived the path from KRB5_CLIENT_KTNAME, set that env var to the correct absolute path."],"exampleFix":"// before: keytab not in image\n// after: Dockerfile\n// COPY --chown=app:app cassandra.keytab /etc/security/cassandra.keytab\nkeytabPath: \"/etc/security/cassandra.keytab\"","handlingStrategy":"validation","validationCode":"func ensureKeytab(path string) error {\n\tinfo, err := os.Stat(path)\n\tif err != nil { return fmt.Errorf(\"keytab missing at %s: %w\", path, err) }\n\tf, err := os.Open(path)\n\tif err != nil { return fmt.Errorf(\"keytab unreadable by uid %d: %w\", os.Getuid(), err) }\n\tf.Close()\n\tif info.Size() == 0 { return errors.New(\"keytab is empty/corrupt\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount keytabs as read-only secrets with correct ownership in containers/Kubernetes.","Transfer keytabs binary-safe (scp/kubectl cp, never text-mode FTP).","Run `klist -kt <path>` in CI/entrypoint to validate before connecting."],"tags":["kerberos","keytab","file-not-found","golang"],"backgroundTag":"kerberos-keytab-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}