{"record":{"id":"515506ad15aa3fa9","repo":"t8y2/dbx","slug":"load-zookeeper-keystore-w","errorCode":null,"errorMessage":"load ZooKeeper keystore: %w","messagePattern":"load ZooKeeper keystore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_tls.go","lineNumber":50,"sourceCode":"\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper truststore: %w\", err)\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tfor _, certificate := range certificates {\n\t\t\tpool.AddCert(certificate)\n\t\t}\n\t\tconfig.RootCAs = pool\n\t}\n\tkeyStoreLocation := parameter(values, \"zookeeperkeystorelocation\")\n\tif keyStoreLocation != \"\" {\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"zookeeperkeystorepassword\"),\n\t\t\tparameter(values, \"zookeeperkeystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tif parameterBool(values, \"zookeepersslinsecureskipverify\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\treturn config, nil\n}\n\nfunc loadTrustStore(path, password, storeType string) ([]*x509.Certificate, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tswitch normalizedStoreType(storeType, path) {\n\tcase \"PEM\":\n\t\treturn parsePEMCertificates(contents)\n\tcase \"PKCS12\":","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_tls.go#L32-L68","documentation":"buildZooKeeperTLSConfig wraps any failure from loadClientKeyStore with \"load ZooKeeper keystore: %w\". loadClientKeyStore reads the zookeeperkeystorelocation file and extracts the private key + certificate chain for client (mTLS) authentication. Any read, decrypt, parse failure, or a keystore without a private key entry is reported here, meaning client TLS identity cannot be established.","triggerScenarios":"parseConnectionConfig builds TLS config with zookeeperkeystorelocation set: the keystore file is missing/unreadable, zookeeperkeystorepassword is wrong, zookeeperkeystoretype is unsupported, the JKS has no PrivateKey entry, or the entry has no certificate chain.","commonSituations":"mTLS setup where the client cert was issued without its chain; keystore password rotated out of band; PKCS12 exported from openssl without the key; wrong file mounted in Kubernetes secret; store type mismatch (PEM content labeled JKS).","solutions":["Verify zookeeperkeystorelocation points to an existing, readable keystore file.","Confirm zookeeperkeystorepassword is the current keystore password.","Re-export the keystore ensuring it contains a private key entry WITH its certificate chain.","Set zookeeperkeystoretype to match the actual format (PEM, JKS, PKCS12).","Check the wrapped underlying error to distinguish file-read vs parse/key-entry failures."],"exampleFix":"// before\nparams.Set(\"zookeeperkeystorelocation\", \"client.jks\") // JKS with cert only, no key\n// after\n// openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12\nparams.Set(\"zookeeperkeystorelocation\", \"/etc/certs/zk/client.p12\")\nparams.Set(\"zookeeperkeystoretype\", \"PKCS12\")\nparams.Set(\"zookeeperkeystorepassword\", os.Getenv(\"ZK_KEYSTORE_PASSWORD\"))","handlingStrategy":"validation","validationCode":"path := params.Get(\"zookeeperkeystorelocation\")\nif path != \"\" {\n    if fi, err := os.Stat(path); err != nil || fi.IsDir() {\n        return fmt.Errorf(\"keystore not readable: %s\", path)\n    }\n    if params.Get(\"zookeeperkeystorepassword\") == \"\" {\n        return fmt.Errorf(\"zookeeperkeystorepassword required for keystore %s\", path)\n    }\n}","typeGuard":null,"tryCatchPattern":"cfg, err := buildZooKeeperTLSConfig(values)\nif err != nil && strings.Contains(err.Error(), \"load ZooKeeper keystore\") {\n    return fmt.Errorf(\"mTLS client keystore unusable; verify file, password, and that it contains a private key with chain: %w\", err)\n}","preventionTips":["Export keystores with the full certificate chain, not just the leaf cert.","Rotate keystore passwords via secrets management, not by hand-editing configs.","Verify the keystore contains a PrivateKey entry before deployment (keytool -list).","Use absolute paths and check readability of mounted secrets in container startup scripts."],"tags":["tls","mtls","zookeeper","keystore"],"backgroundTag":"keystore-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}