{"record":{"id":"4e60ce9a4a0d41a5","repo":"t8y2/dbx","slug":"load-hive-keystore-w","errorCode":null,"errorMessage":"load Hive keystore: %w","messagePattern":"load Hive keystore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1104,"sourceCode":"\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}\n\t}\n\treturn config, nil\n}\n\nfunc parameter(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn strings.TrimSpace(value)","sourceCodeStart":1086,"sourceCodeEnd":1122,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1086-L1122","documentation":"When the sslKeyStore parameter is set, the driver calls loadClientKeyStore to extract a client certificate and wraps any failure with this message. The %w preserves the underlying cause — bad path, wrong keystorepassword, unsupported keystoretype. It is thrown because the driver cannot add the client certificate to the TLS config without successfully loading the store.","triggerScenarios":"Opening a Hive connection with sslKeyStore configured and loadClientKeyStore fails: unreadable store file, wrong keystorepassword, unexpected keystoretype, or corrupt store.","commonSituations":"Keystore password changed by security rotation; PKCS12 vs JKS type mismatch; keystore path typo; store generated with a key algorithm the Go loader can't parse (e.g. legacy formats).","solutions":["Check the wrapped cause; verify the keystore path exists and is readable","Confirm keystorepassword is current and keystoretype matches the file format","Regenerate the keystore in a supported format (PKCS12 recommended)","Alternatively provide clientCertPath/clientKeyPath PEM pair instead of a keystore"],"exampleFix":"// before\nvalues[\"keystoretype\"] = \"JKS\"\n// after\nvalues[\"keystoretype\"] = \"PKCS12\" // matches the actual store format","handlingStrategy":"validation","validationCode":"if loc := values[\"sslkeystore\"]; loc != \"\" {\n    if _, err := os.Stat(loc); err != nil {\n        return fmt.Errorf(\"keystore missing: %w\", err)\n    }\n    if values[\"keystorepassword\"] == \"\" && credentialProvider == \"\" {\n        return errors.New(\"keystorepassword or credential provider required\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := db.PingContext(ctx); err != nil {\n    if strings.HasPrefix(err.Error(), \"load Hive keystore:\") {\n        // refresh password / fix type, then retry\n    }\n    return err\n}","preventionTips":["Keep keystore passwords in a credential provider or secret manager","Use PKCS12 keystores with matching keystoretype setting","Load-test the keystore with the client library before deploy","Prefer clientCertPath/clientKeyPath PEM pairs when possible"],"tags":["tls","hive","keystore","config"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}