{"record":{"id":"af36f226dfd71829","repo":"t8y2/dbx","slug":"zookeeper-kerberos-sasl-requires-hive-kerberos-cre","errorCode":null,"errorMessage":"ZooKeeper Kerberos SASL requires Hive Kerberos credentials","messagePattern":"ZooKeeper Kerberos SASL requires Hive Kerberos credentials","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_protocol.go","lineNumber":96,"sourceCode":"\toptions.CanonicalizeHost = config.ZooKeeperKerberos.CanonicalHostname\n\toptions.ServerName = config.ZooKeeperKerberos.ServerPrincipal\n\tif options.ServerName == \"\" && config.ZooKeeperKerberos.Realm != \"\" {\n\t\toptions.ServerName = service + \"/_HOST@\" + config.ZooKeeperKerberos.Realm\n\t}\n\treturn service, options\n}\n\nfunc connectKerberosZooKeeper(\n\tservers []string,\n\ttimeout time.Duration,\n\ttlsConfig *tls.Config,\n\tconfig connectionConfig,\n) (zooKeeperClient, <-chan zk.Event, error) {\n\tif len(servers) == 0 {\n\t\treturn nil, nil, errors.New(\"ZooKeeper server list is empty\")\n\t}\n\tif !config.Kerberos.Enabled {\n\t\treturn nil, nil, errors.New(\"ZooKeeper Kerberos SASL requires Hive Kerberos credentials\")\n\t}\n\tordered := append([]string(nil), servers...)\n\tshuffleZooKeeperServers(ordered)\n\tvar failures []string\n\tfor _, address := range ordered {\n\t\thost, _, err := net.SplitHostPort(address)\n\t\tif err != nil {\n\t\t\tfailures = append(failures, fmt.Sprintf(\"%s: %v\", address, err))\n\t\t\tcontinue\n\t\t}\n\t\tconnection, err := dialZooKeeperConnection(address, timeout, tlsConfig)\n\t\tif err != nil {\n\t\t\tfailures = append(failures, fmt.Sprintf(\"%s: %v\", address, err))\n\t\t\tcontinue\n\t\t}\n\t\tclient, err := newProtocolZooKeeperClient(connection, timeout)\n\t\tif err == nil {\n\t\t\tvar saslClient zooKeeperSASLClient","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_protocol.go#L78-L114","documentation":"connectKerberosZooKeeper performs SASL-secured ZooKeeper connections only; when config.Kerberos.Enabled is false it returns this error because Hive Kerberos credentials are mandatory for the GSSAPI handshake. The library refuses to attempt an unauthenticated SASL connect rather than failing later at the server.","triggerScenarios":"Calling the Kerberos ZooKeeper connect path with a connectionConfig whose Kerberos.Enabled is false; wiring SASL ZooKeeper discovery into a connection configured without Hive Kerberos (no principal/keytab).","commonSituations":"Enabling ZooKeeper service discovery for a Kerberized Hive cluster while leaving the Kerberos block disabled in the driver config; copying a non-Kerberos config into a secured environment.","solutions":["Set Kerberos.Enabled = true and provide principal, keytab, and realm matching the Hive cluster","If the ensemble does not require SASL, use the non-Kerberos ZooKeeper connect path instead","Validate the Kerberos config before connecting and fail with a clear app-level message","Confirm the keytab is readable by the process and kinit/credential refresh works"],"exampleFix":"// before\nconn, _, err := connectKerberosZooKeeper(servers, timeout, tlsConfig, connectionConfig{})\n// after\ncfg := connectionConfig{}\ncfg.Kerberos.Enabled = true\ncfg.Kerberos.Principal = \"hive/_HOST@EXAMPLE.COM\"\ncfg.Kerberos.Keytab = \"/etc/security/keytabs/hive.service.keytab\"\nconn, _, err := connectKerberosZooKeeper(servers, timeout, tlsConfig, cfg)","handlingStrategy":"validation","validationCode":"if !cfg.Kerberos.Enabled || cfg.Kerberos.Principal == \"\" || cfg.Kerberos.Keytab == \"\" {\n    return errors.New(\"ZooKeeper SASL discovery requires Kerberos principal and keytab\")\n}","typeGuard":null,"tryCatchPattern":"conn, events, err := connectKerberosZooKeeper(servers, timeout, tls, cfg)\nif err != nil && strings.Contains(err.Error(), \"requires Hive Kerberos credentials\") {\n    // point the operator at the Kerberos config section\n}","preventionTips":["Enable the Kerberos block whenever the Hive cluster is secured","Verify principal/keytab paths are readable by the process at startup","Use the non-Kerberos connect path only for unsecured ensembles"],"tags":["zookeeper","kerberos","sasl","configuration","go"],"backgroundTag":"sasl-authentication-required","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}