{"record":{"id":"e39c142d7cb56aab","repo":"t8y2/dbx","slug":"load-zookeeper-truststore-w","errorCode":null,"errorMessage":"load ZooKeeper truststore: %w","messagePattern":"load ZooKeeper truststore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_tls.go","lineNumber":34,"sourceCode":")\n\nfunc buildZooKeeperTLSConfig(values map[string]string) (*tls.Config, error) {\n\tif !parameterBool(values, \"zookeepersslenable\") {\n\t\treturn nil, nil\n\t}\n\tconfig := &tls.Config{\n\t\tMinVersion: tls.VersionTLS12,\n\t\tServerName: parameter(values, \"zookeeperservername\"),\n\t}\n\ttrustStoreLocation := parameter(values, \"zookeepertruststorelocation\")\n\tif trustStoreLocation != \"\" {\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"zookeepertruststorepassword\"),\n\t\t\tparameter(values, \"zookeepertruststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper truststore: %w\", err)\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tfor _, certificate := range certificates {\n\t\t\tpool.AddCert(certificate)\n\t\t}\n\t\tconfig.RootCAs = pool\n\t}\n\tkeyStoreLocation := parameter(values, \"zookeeperkeystorelocation\")\n\tif keyStoreLocation != \"\" {\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"zookeeperkeystorepassword\"),\n\t\t\tparameter(values, \"zookeeperkeystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load ZooKeeper keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_tls.go#L16-L52","documentation":"buildZooKeeperTLSConfig wraps any failure from loadTrustStore with \"load ZooKeeper truststore: %w\". loadTrustStore reads the zookeepertruststorelocation file (PEM/JKS/PKCS12), decrypts it with zookeepertruststorepassword, and parses certificates; any read, decrypt, parse, or empty-store failure is surfaced here. It means the CA bundle used to verify the ZooKeeper server could not be loaded, so TLS configuration cannot proceed.","triggerScenarios":"parseConnectionConfig builds TLS config with zookeeperssl=true and a zookeepertruststorelocation set: the file does not exist or is unreadable, the password is wrong (encrypted JKS/PKCS12), the zookeepertruststoretype is unsupported, or the store contains zero parseable certificates.","commonSituations":"Typo in the truststore path or a path relative to the wrong working directory; password changed when rotating certificates; store type left as default JKS when the file is actually PEM; container image missing the mounted secret; store exported without any CA entries.","solutions":["Verify zookeepertruststorelocation points to an existing, readable file (check mount/working directory).","Confirm zookeepertruststorepassword matches the store's actual password.","Set zookeepertruststoretype explicitly (PEM, JKS, or PKCS12) to match the file format.","Re-export the truststore ensuring it contains at least one CA certificate.","Inspect the wrapped error (%w) for the underlying cause (os.ReadFile vs parse error)."],"exampleFix":"// before\nparams.Set(\"zookeepertruststorelocation\", \"truststore.jks\") // relative path, wrong cwd\n// after\nparams.Set(\"zookeepertruststorelocation\", \"/etc/certs/zk/truststore.p12\")\nparams.Set(\"zookeepertruststoretype\", \"PKCS12\")\nparams.Set(\"zookeepertruststorepassword\", os.Getenv(\"ZK_TRUSTSTORE_PASSWORD\"))","handlingStrategy":"validation","validationCode":"path := params.Get(\"zookeepertruststorelocation\")\nif path == \"\" {\n    return fmt.Errorf(\"zookeepertruststorelocation is required for TLS\")\n}\nif fi, err := os.Stat(path); err != nil || fi.IsDir() {\n    return fmt.Errorf(\"truststore not readable: %s\", path)\n}\nif pw := params.Get(\"zookeepertruststorepassword\"); pw == \"\" && storeIsEncrypted(params.Get(\"zookeepertruststoretype\")) {\n    return fmt.Errorf(\"zookeepertruststorepassword is required\")\n}","typeGuard":null,"tryCatchPattern":"cfg, err := buildZooKeeperTLSConfig(values)\nif err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) {\n        return fmt.Errorf(\"check zookeepertruststorelocation %q: %w\", perr.Path, err)\n    }\n    return fmt.Errorf(\"truststore config invalid: %w\", err)\n}","preventionTips":["Mount truststores at absolute paths and assert file existence at startup.","Keep store password and path together in the same secret/config source.","Always set zookeepertruststoretype explicitly rather than relying on inference.","Add a smoke test that loads the truststore before connecting."],"tags":["tls","configuration","zookeeper","certificate-loading"],"backgroundTag":"truststore-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}