{"record":{"id":"7d4c4308464a92f7","repo":"t8y2/dbx","slug":"load-zookeeper-keystore-w-7d4c43","errorCode":null,"errorMessage":"load ZooKeeper keystore: %w","messagePattern":"load ZooKeeper keystore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":50,"sourceCode":"\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper truststore: %w\", err)\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tfor _, certificate := range certificates {\n\t\t\tpool.AddCert(certificate)\n\t\t}\n\t\tconfig.RootCAs = pool\n\t}\n\tkeyStoreLocation := parameter(values, \"zookeeperkeystorelocation\")\n\tif keyStoreLocation != \"\" {\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"zookeeperkeystorepassword\"),\n\t\t\tparameter(values, \"zookeeperkeystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tif parameterBool(values, \"zookeepersslinsecureskipverify\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\treturn config, nil\n}\n\nfunc loadTrustStore(path, password, storeType string) ([]*x509.Certificate, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tswitch normalizedStoreType(storeType, path) {\n\tcase \"PEM\":\n\t\treturn parsePEMCertificates(contents)\n\tcase \"PKCS12\":","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L32-L68","documentation":"This error wraps a failure from loadClientKeyStore while building the ZooKeeper TLS configuration in buildZooKeeperTLSConfig. When the connection config requests client TLS (zookeeperkeystore* parameters), the driver loads the client keystore; any read/parse error is wrapped with the 'load ZooKeeper keystore:' prefix so the underlying cause (bad path, wrong password, unsupported type) is preserved.","triggerScenarios":"Calling buildZooKeeperTLSConfig (via parseConnectionConfig or tests) when the 'zookeeperkeystorelocation' file cannot be read, the 'zookeeperkeystorepassword' is wrong, or the 'zookeeperkeystoretype' is unsupported by loadClientKeyStore.","commonSituations":"Typo'd keystore path in the connection string; JKS vs PKCS12 type mismatch; keystore password changed or not URL-encoded; missing file after a container image change.","solutions":["Check the file at zookeeperkeystorelocation exists and is readable by the process","Verify zookeeperkeystorepassword matches the keystore's actual password","Confirm zookeeperkeystoretype matches the actual keystore format (JKS, PKCS12, PEM)","Run TestBuildZooKeeperTLSConfigFromJKS/FromPKCS12 to validate loading with a known-good keystore"],"exampleFix":"// before\nconfig values: zookeeperkeystorelocation=/etc/certs/keystore.js, type=PKCS12\n// after\nconfig values: zookeeperkeystorelocation=/etc/certs/keystore.p12, zookeeperkeystoretype=PKCS12, password=<correct>","handlingStrategy":"validation","validationCode":"func validateZkKeystore(loc, pass, typ string) error {\n  if loc == \"\" { return errors.New(\"zookeeperkeystorelocation required for client TLS\") }\n  if _, err := os.Stat(loc); err != nil { return fmt.Errorf(\"keystore unreadable: %w\", err) }\n  switch strings.ToUpper(strings.TrimSpace(typ)) {\n  case \"\", \"JKS\", \"PKCS12\", \"PEM\":\n  default: return fmt.Errorf(\"unsupported keystore type %q\", typ)\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Stat the keystore path at startup before dialing","Keep keystore type, extension, and actual format consistent","Test keystore loading in CI with the same image paths"],"tags":["tls","zookeeper","config","keystore"],"backgroundTag":"keystore-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}