{"record":{"id":"fb8b4bcb1ded0890","repo":"t8y2/dbx","slug":"authenticate-to-zookeeper-w","errorCode":null,"errorMessage":"authenticate to ZooKeeper: %w","messagePattern":"authenticate to ZooKeeper: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/discovery.go","lineNumber":117,"sourceCode":"\t}\n\ttimeout := discovery.timeout\n\tif timeout <= 0 {\n\t\ttimeout = defaultConnectTimeout\n\t}\n\tconnection, events, err := discovery.dialer(addresses, timeout)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"connect to ZooKeeper: %w\", err)\n\t}\n\tdefer connection.Close()\n\tif err := waitForZooKeeperSession(ctx, events, timeout); err != nil {\n\t\treturn nil, err\n\t}\n\tif discovery.authScheme != \"\" || discovery.auth != \"\" {\n\t\tif discovery.authScheme == \"\" || discovery.auth == \"\" {\n\t\t\treturn nil, errors.New(\"ZooKeeper auth scheme and credentials must be configured together\")\n\t\t}\n\t\tif err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"authenticate to ZooKeeper: %w\", err)\n\t\t}\n\t}\n\tresolved := make([]endpoint, 0)\n\tvar listedPath string\n\tvar nodeFailures []string\n\tfor _, path := range discovery.paths() {\n\t\tchildren, _, childrenErr := connection.Children(path)\n\t\tif errors.Is(childrenErr, zk.ErrNoNode) {\n\t\t\tcontinue\n\t\t}\n\t\tif childrenErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"list ZooKeeper namespace %s: %w\", path, childrenErr)\n\t\t}\n\t\tlistedPath = path\n\t\tfor _, child := range children {\n\t\t\tdata, _, dataErr := connection.Get(path + \"/\" + child)\n\t\t\tif dataErr != nil {\n\t\t\t\tif errors.Is(dataErr, zk.ErrNoNode) {","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/discovery.go#L99-L135","documentation":"After establishing the ZooKeeper session, Endpoints calls connection.AddAuth with the configured scheme (e.g. digest) and credential, wrapping any failure with this message. AddAuth fails if the connection is closing/closed or the scheme/credential is rejected by the client library. This is thrown before reading the service-discovery znodes so auth state is guaranteed before listing.","triggerScenarios":"Calling Endpoints with authScheme/auth configured where connection.AddAuth returns an error — typically a session that has already expired or is closing, or an unsupported/invalid auth scheme.","commonSituations":"ZK session timing out between dial and AddAuth under load; typo'd scheme (e.g. 'digest' misspelled); empty/invalid credential bytes; reusing a discovery object whose session died.","solutions":["Check the wrapped cause; if the session expired, create a fresh discovery/Endpoints call rather than reusing the old connection","Verify authScheme and auth are both set and the scheme name is valid (e.g. 'digest')","Confirm ZK credentials are current (password rotated on the server?)","Increase timeouts / check ZK load if sessions are dropping mid-handshake"],"exampleFix":"// before\ndiscovery.authScheme = \"digest\" // auth left empty -> paired error, or stale session\n// after\ndiscovery.authScheme = \"digest\"\ndiscovery.auth = user + \":\" + os.Getenv(\"ZK_PASSWORD\")","handlingStrategy":"retry","validationCode":"if (discovery.authScheme == \"\") != (discovery.auth == \"\") {\n    return errors.New(\"ZooKeeper authScheme and auth must both be set\")\n}\nif discovery.authScheme != \"\" && discovery.authScheme != \"digest\" {\n    return fmt.Errorf(\"unsupported ZK auth scheme: %s\", discovery.authScheme)\n}","typeGuard":null,"tryCatchPattern":"eps, err := discovery.Endpoints(ctx)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"authenticate to ZooKeeper:\") {\n        // session likely expired mid-handshake; rebuild discovery and retry once\n        discovery = newDiscovery(cfg)\n        eps, err = discovery.Endpoints(ctx)\n    }\n    if err != nil { return err }\n}","preventionTips":["Always set both authScheme and auth together; validate at startup","Read ZK credentials from a secret manager so rotations propagate","Rebuild the discovery/session on auth errors instead of reusing it","Confirm the scheme is supported by go-zookeeper (digest is standard)"],"tags":["zookeeper","authentication","discovery"],"backgroundTag":"zookeeper-auth-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}