{"record":{"id":"0bf7d0fec2726d24","repo":"t8y2/dbx","slug":"zookeeper-tls-is-not-supported","errorCode":null,"errorMessage":"ZooKeeper TLS is not supported","messagePattern":"ZooKeeper TLS is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/connection.go","lineNumber":151,"sourceCode":"\t\tresult[\"databaseInfo\"] = info\n\t}\n\treturn result, nil\n}\n\nfunc (service *server) connectionInfo() (map[string]any, error) {\n\tif _, err := service.requireClient(); err != nil {\n\t\treturn nil, err\n\t}\n\tresult := map[string]any{}\n\tif info := databaseInfo(service.activeConfig); info != nil {\n\t\tresult[\"databaseInfo\"] = info\n\t}\n\treturn result, nil\n}\n\nfunc openClient(config connectionConfig) (*clientSession, error) {\n\tif hasTLSOptions(config) {\n\t\treturn nil, errors.New(\"ZooKeeper TLS is not supported\")\n\t}\n\tauthScheme := resolveAuthScheme(config)\n\tif authScheme != defaultAuthScheme && authScheme != saslDigestAuthScheme {\n\t\treturn nil, fmt.Errorf(\"Unsupported auth_scheme %q; expected %q or %q\", authScheme, defaultAuthScheme, saslDigestAuthScheme)\n\t}\n\tif authScheme == saslDigestAuthScheme {\n\t\tif strings.TrimSpace(config.Username) == \"\" {\n\t\t\treturn nil, errors.New(`username is required when auth_scheme = \"sasl_digest\"`)\n\t\t}\n\t\tif config.Password == \"\" {\n\t\t\treturn nil, errors.New(`password is required when auth_scheme = \"sasl_digest\"`)\n\t\t}\n\t}\n\tif config.BaseSleepTimeMS != nil && *config.BaseSleepTimeMS < 0 {\n\t\treturn nil, errors.New(\"base_sleep_time_ms must be non-negative\")\n\t}\n\tif config.MaxRetries != nil && *config.MaxRetries < 0 {\n\t\treturn nil, errors.New(\"max_retries must be non-negative\")","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/connection.go#L133-L169","documentation":"openClient rejects any connection config that includes TLS options because the ZooKeeper driver does not implement TLS transport. This fail-fast check prevents silently establishing an unencrypted connection when the user expected encryption.","triggerScenarios":"Connecting (via connect or testConnection) with any TLS-related field set in connectionConfig — e.g. cert/key/CA or ssl flags — so hasTLSOptions(config) returns true.","commonSituations":"Copy-pasting TLS config from another database driver's connection block; compliance requirements demanding encrypted traffic to ZooKeeper; enabling TLS after a security audit.","solutions":["Remove all TLS options from the ZooKeeper connection config","Secure the channel at the network layer instead (VPN, SSH tunnel, private link)","Check driver releases for TLS support and upgrade if/when it becomes available","Use ZooKeeper server-side ACLs/SASL (auth_scheme) for authentication without TLS"],"exampleFix":"// before\ncfg := connectionConfig{Hosts: hosts, TLSCA: \"/etc/ca.pem\"} // TLS unsupported\n// after\ncfg := connectionConfig{Hosts: hosts} // encrypted via VPN/tunnel instead","handlingStrategy":"validation","validationCode":"// Reject TLS options before connecting since ZooKeeper TLS is unsupported\nif cfg.TLSCA != \"\" || cfg.TLSCert != \"\" || cfg.TLSKey != \"\" {\n    return errors.New(\"this ZooKeeper driver does not support TLS; remove TLS options\")\n}","typeGuard":null,"tryCatchPattern":"session, err := openClient(cfg)\nif err != nil && strings.Contains(err.Error(), \"TLS is not supported\") {\n    return nil, fmt.Errorf(\"connect without TLS or secure via network tunnel: %w\", err)\n}","preventionTips":["Do not copy TLS fields from other drivers' configs into ZooKeeper configs","Use a VPN, SSH tunnel, or private network for encrypted ZooKeeper traffic","Rely on SASL auth (auth_scheme) plus ACLs for security without TLS","Check driver release notes before assuming TLS support exists"],"tags":["zookeeper","tls","security","configuration"],"backgroundTag":"tls-not-supported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}