{"record":{"id":"e605824649ecf690","repo":"t8y2/dbx","slug":"zookeeper-auth-scheme-and-credentials-must-be-conf","errorCode":null,"errorMessage":"ZooKeeper auth scheme and credentials must be configured together","messagePattern":"ZooKeeper auth scheme and credentials must be configured together","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/discovery.go","lineNumber":114,"sourceCode":"\taddresses := make([]string, 0, len(discovery.servers))\n\tfor _, server := range discovery.servers {\n\t\taddresses = append(addresses, server.address())\n\t}\n\ttimeout := discovery.timeout\n\tif timeout <= 0 {\n\t\ttimeout = defaultConnectTimeout\n\t}\n\tconnection, events, err := discovery.dialer(addresses, timeout)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"connect to ZooKeeper: %w\", err)\n\t}\n\tdefer connection.Close()\n\tif err := waitForZooKeeperSession(ctx, events, timeout); err != nil {\n\t\treturn nil, err\n\t}\n\tif discovery.authScheme != \"\" || discovery.auth != \"\" {\n\t\tif discovery.authScheme == \"\" || discovery.auth == \"\" {\n\t\t\treturn nil, errors.New(\"ZooKeeper auth scheme and credentials must be configured together\")\n\t\t}\n\t\tif err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"authenticate to ZooKeeper: %w\", err)\n\t\t}\n\t}\n\tresolved := make([]endpoint, 0)\n\tvar listedPath string\n\tvar nodeFailures []string\n\tfor _, path := range discovery.paths() {\n\t\tchildren, _, childrenErr := connection.Children(path)\n\t\tif errors.Is(childrenErr, zk.ErrNoNode) {\n\t\t\tcontinue\n\t\t}\n\t\tif childrenErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"list ZooKeeper namespace %s: %w\", path, childrenErr)\n\t\t}\n\t\tlistedPath = path\n\t\tfor _, child := range children {","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/discovery.go#L96-L132","documentation":"Endpoints() enforces that ZooKeeper authentication is fully specified: if either authScheme or auth is set, both must be present. Supplying only one is treated as a configuration error because a partial auth spec would authenticate inconsistently or fail on the server. The error is raised before AddAuth is called.","triggerScenarios":"Calling Endpoints with a discovery config where exactly one of authScheme (e.g. 'digest') and auth (credentials string) is non-empty.","commonSituations":"Users set zk auth scheme but forget the credential parameter, or set credentials without the scheme name (digest vs. sasl); config templating drops one of the pair; migrating from an unauthenticated to an authenticated ZooKeeper quorum.","solutions":["Set both the ZooKeeper auth scheme (e.g. 'digest') and the auth credential string in the discovery config","If ZooKeeper does not require auth, remove both parameters instead of just one","Verify the credentials are passed intact through any templating/env layer"],"exampleFix":"// before\nauthScheme: \"digest\" // auth missing\n// after\nauthScheme: \"digest\",\nauth: \"user:password\"","handlingStrategy":"validation","validationCode":"if (cfg.ZKAuthScheme == \"\") != (cfg.ZKAuth == \"\") {\n\treturn errors.New(\"zookeeper authScheme and auth must be set together\")\n}","typeGuard":"func zkAuthComplete(d discoveryConfig) bool {\n\treturn (d.AuthScheme == \"\") == (d.Auth == \"\")\n}","tryCatchPattern":null,"preventionTips":["Always set auth scheme and credentials as a pair in config templates","Validate ZooKeeper config completeness at application startup","Document which schemes (digest, sasl) your deployment supports"],"tags":["zookeeper","authentication","configuration"],"backgroundTag":"incomplete-auth-configuration","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}