t8y2/dbx · error

authenticate to ZooKeeper: %w

Error message

authenticate to ZooKeeper: %w

What it means

After establishing the ZooKeeper session, Endpoints calls connection.AddAuth with the configured scheme (e.g. digest) and credential, wrapping any failure with this message. AddAuth fails if the connection is closing/closed or the scheme/credential is rejected by the client library. This is thrown before reading the service-discovery znodes so auth state is guaranteed before listing.

Source

Thrown at agents/drivers/argo-go/discovery.go:117

	}
	timeout := discovery.timeout
	if timeout <= 0 {
		timeout = defaultConnectTimeout
	}
	connection, events, err := discovery.dialer(addresses, timeout)
	if err != nil {
		return nil, fmt.Errorf("connect to ZooKeeper: %w", err)
	}
	defer connection.Close()
	if err := waitForZooKeeperSession(ctx, events, timeout); err != nil {
		return nil, err
	}
	if discovery.authScheme != "" || discovery.auth != "" {
		if discovery.authScheme == "" || discovery.auth == "" {
			return nil, errors.New("ZooKeeper auth scheme and credentials must be configured together")
		}
		if err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {
			return nil, fmt.Errorf("authenticate to ZooKeeper: %w", err)
		}
	}
	resolved := make([]endpoint, 0)
	var listedPath string
	var nodeFailures []string
	for _, path := range discovery.paths() {
		children, _, childrenErr := connection.Children(path)
		if errors.Is(childrenErr, zk.ErrNoNode) {
			continue
		}
		if childrenErr != nil {
			return nil, fmt.Errorf("list ZooKeeper namespace %s: %w", path, childrenErr)
		}
		listedPath = path
		for _, child := range children {
			data, _, dataErr := connection.Get(path + "/" + child)
			if dataErr != nil {
				if errors.Is(dataErr, zk.ErrNoNode) {

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the wrapped cause; if the session expired, create a fresh discovery/Endpoints call rather than reusing the old connection
2. Verify authScheme and auth are both set and the scheme name is valid (e.g. 'digest')
3. Confirm ZK credentials are current (password rotated on the server?)
4. Increase timeouts / check ZK load if sessions are dropping mid-handshake

Example fix

// before
discovery.authScheme = "digest" // auth left empty -> paired error, or stale session
// after
discovery.authScheme = "digest"
discovery.auth = user + ":" + os.Getenv("ZK_PASSWORD")

if (discovery.authScheme == "") != (discovery.auth == "") {
    return errors.New("ZooKeeper authScheme and auth must both be set")
}
if discovery.authScheme != "" && discovery.authScheme != "digest" {
    return fmt.Errorf("unsupported ZK auth scheme: %s", discovery.authScheme)
}

eps, err := discovery.Endpoints(ctx)
if err != nil {
    if strings.HasPrefix(err.Error(), "authenticate to ZooKeeper:") {
        // session likely expired mid-handshake; rebuild discovery and retry once
        discovery = newDiscovery(cfg)
        eps, err = discovery.Endpoints(ctx)
    }
    if err != nil { return err }
}

When it happens

Trigger: Calling Endpoints with authScheme/auth configured where connection.AddAuth returns an error — typically a session that has already expired or is closing, or an unsupported/invalid auth scheme.

Common situations: ZK session timing out between dial and AddAuth under load; typo'd scheme (e.g. 'digest' misspelled); empty/invalid credential bytes; reusing a discovery object whose session died.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ZooKeeper auth scheme and credentials must be configured tog
• ZooKeeper authentication failed
• ZooKeeper session closed because SASL authentication is requ
• Hive discovery returned no endpoints
• ZooKeeper auth scheme and credentials must be configured tog

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/fb8b4bcb1ded0890. Report an issue: GitHub.