t8y2/dbx · error

connect and authenticate to ZooKeeper: %s

Error message

connect and authenticate to ZooKeeper: %s

What it means

Returned by connectKerberosZooKeeper after every address in the ZooKeeper ensemble list was tried and each failed to connect and complete SASL authentication; the message joins the per-address failures. It means the entire failover loop produced no usable authenticated ZooKeeper connection for HiveServer2 discovery.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:130

		client, err := newProtocolZooKeeperClient(connection, timeout)
		if err == nil {
			var saslClient zooKeeperSASLClient
			saslClient, err = newZooKeeperSASLClient(host, config)
			if err == nil {
				err = client.authenticateSASL(saslClient)
			}
		}
		if err != nil {
			connection.Close()
			failures = append(failures, fmt.Sprintf("%s: %v", address, err))
			continue
		}
		events := make(chan zk.Event, 1)
		events <- zk.Event{State: zk.StateHasSession, Server: address}
		close(events)
		return client, events, nil
	}
	return nil, nil, fmt.Errorf("connect and authenticate to ZooKeeper: %s", strings.Join(failures, "; "))
}

type protocolZooKeeperClient struct {
	connection net.Conn
	timeout    time.Duration
	xid        int32
	mutex      sync.Mutex
	closed     bool
}

func newProtocolZooKeeperClient(connection net.Conn, timeout time.Duration) (*protocolZooKeeperClient, error) {
	if connection == nil {
		return nil, errors.New("ZooKeeper connection is nil")
	}
	if timeout <= 0 {
		timeout = defaultConnectTimeout
	}
	client := &protocolZooKeeperClient{connection: connection, timeout: timeout}

View on GitHub (pinned to c0390bff16)

Solutions

1. Read the per-address failure list to distinguish connect timeouts from SASL auth errors
2. Verify ZooKeeper hosts/ports and network reachability from the agent
3. For SASL failures check Kerberos tickets, keytabs, JAAS config, and the ZooKeeper auth configuration on the ensemble
4. Confirm the ZooKeeper ensemble requires (and permits) the GSSAPI mechanism the agent is using

When it happens

Trigger: Thrown at agents/drivers/hive-go/zookeeper_protocol.go:130 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/9f047b47c6953e9c. Report an issue: GitHub.