{"record":{"id":"1a01930b9286a595","repo":"t8y2/dbx","slug":"load-zookeeper-truststore-w-1a0193","errorCode":null,"errorMessage":"load ZooKeeper truststore: %w","messagePattern":"load ZooKeeper truststore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":34,"sourceCode":")\n\nfunc buildZooKeeperTLSConfig(values map[string]string) (*tls.Config, error) {\n\tif !parameterBool(values, \"zookeepersslenable\") {\n\t\treturn nil, nil\n\t}\n\tconfig := &tls.Config{\n\t\tMinVersion: tls.VersionTLS12,\n\t\tServerName: parameter(values, \"zookeeperservername\"),\n\t}\n\ttrustStoreLocation := parameter(values, \"zookeepertruststorelocation\")\n\tif trustStoreLocation != \"\" {\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"zookeepertruststorepassword\"),\n\t\t\tparameter(values, \"zookeepertruststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper truststore: %w\", err)\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tfor _, certificate := range certificates {\n\t\t\tpool.AddCert(certificate)\n\t\t}\n\t\tconfig.RootCAs = pool\n\t}\n\tkeyStoreLocation := parameter(values, \"zookeeperkeystorelocation\")\n\tif keyStoreLocation != \"\" {\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"zookeeperkeystorepassword\"),\n\t\t\tparameter(values, \"zookeeperkeystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L16-L52","documentation":"buildZooKeeperTLSConfig loads a client trust store (JKS/PKCS12/etc.) via loadTrustStore using the connection-string parameters zookeepertruststorepassword and zookeepertruststoretype. If the store can't be read or decrypted (missing file, wrong password, unsupported type, bad format), the underlying error is wrapped as 'load ZooKeeper truststore: ...'. The client refuses to build a TLS config without a valid trust store.","triggerScenarios":"parseConnectionConfig with a TLS-enabled ZooKeeper connection string when trustStoreLocation is set but loadTrustStore fails: file path doesn't exist, wrong zookeepertruststorepassword, wrong/missing zookeepertruststoretype, or the file isn't a valid JKS/PKCS12 store.","commonSituations":"Truststore path wrong relative to the process working directory (works locally, fails in a container), password rotated in the secrets manager but not in the connection string, store exported as PKCS12 but type left as JKS, or the file never got mounted into the pod.","solutions":["Verify the truststore file exists at trustStoreLocation from the perspective of the running process (absolute path or correct working dir).","Confirm zookeepertruststorepassword matches the store's actual password (keytool -list or a PKCS12 check).","Set zookeepertruststoretype correctly (JKS vs PKCS12) to match the file's real format.","Re-export the trust store from the cluster's CA certificates if the file is corrupt or stale.","Run the reference path TestBuildZooKeeperTLSConfigFromJKS/PKCS12 to confirm the loading code works with your store before deploying."],"exampleFix":"// before\nconn := \"zk+tls://zk1:2181?truststore=/etc/certs/zk.ts&truststoretype=JKS\" // file is actually PKCS12\n// after\nconn := \"zk+tls://zk1:2181?truststore=/etc/certs/zk.p12&truststoretype=PKCS12&truststorepassword=s3cret\"","handlingStrategy":"validation","validationCode":"// validate the trust store before building the connection string\nfunc validateTrustStore(path, password, storeType string) error {\n\tif _, err := os.Stat(path); err != nil {\n\t\treturn fmt.Errorf(\"truststore not readable at %s: %w\", path, err)\n\t}\n\tf, err := os.Open(path)\n\tif err != nil { return err }\n\tdefer f.Close()\n\tswitch strings.ToUpper(storeType) {\n\tcase \"PKCS12\":\n\t\tif _, err := pkcs12.ToTrustPool(f, password); err != nil {\n\t\t\treturn fmt.Errorf(\"pkcs12 open failed (password/format?): %w\", err)\n\t\t}\n\tcase \"JKS\":\n\t\tif _, err := jks.Decode(f, []byte(password)); err != nil {\n\t\t\treturn fmt.Errorf(\"jks open failed (password/type?): %w\", err)\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported truststore type %q\", storeType)\n\t}\n\treturn nil\n}","typeGuard":"func isTrustStoreLoadError(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"load ZooKeeper truststore\")\n}","tryCatchPattern":"cfg, err := hive.ParseConnectionConfig(connStr)\nif err != nil {\n\tif isTrustStoreLoadError(err) {\n\t\t// fail fast at startup with a precise message including the wrapped cause\n\t\tlog.Fatalf(\"ZooKeeper TLS misconfigured: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Use absolute paths for the truststore so container/working-dir changes can't break resolution.","Inject the store password from a secret manager and keep it in sync with store rotations.","Pin zookeepertruststoretype to the real format (JKS vs PKCS12) and verify after every re-export.","Add a startup self-check that opens the store before the app accepts traffic.","Run the library's TestBuildZooKeeperTLSConfigFromJKS/PKCS12-style checks against your actual store in CI."],"tags":["zookeeper","tls","truststore","configuration"],"backgroundTag":"tls-truststore-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}