Hive storePasswordPath uses the Java Hadoop credential-provi

Error message

Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent

What it means

Analogous to the truststore case but for the client keystore: when sslkeystore is set, keystorepassword is empty, and credentialProviderPath is set, the native agent cannot resolve the key-store password from the Java Hadoop credential provider and rejects the config, asking for an explicit keyStorePassword. The Go agent cannot decrypt PKCS12/JKS keystores without the password.

Source

Thrown at agents/drivers/argo-go/config.go:1096

		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}

View on GitHub (pinned to c0390bff16)

Solutions

Set keystorepassword explicitly to the client keystore password.
Extract the password from the credential provider (hadoop credential get <alias>) and inject it via environment/config, then remove reliance on credentialProviderPath for this agent.
Verify the parameter key is exactly keystorepassword (lowercase) so the lookup does not return empty.
Convert the client key/cert to PEM files and use clientCertPath/clientKeyPath instead of a password-protected keystore.

Example fix

// before
values["sslkeystore"] = "/etc/hive/conf/client.keystore.p12"
// password expected from credentialProviderPath (JCEKS)
// after
values["sslkeystore"] = "/etc/hive/conf/client.keystore.p12"
values["keystorepassword"] = os.Getenv("HIVE_KEYSTORE_PASSWORD")

Defensive patterns

Strategy: validation

Validate before calling

if values["sslkeystore"] != "" && values["keystorepassword"] == "" && credentialProviderPath != "" {
	return errors.New("keyStorePassword must be set explicitly for the native agent")
}

Type guard

func keystoreReady(values map[string]string, credPath string) bool {
	return values["sslkeystore"] == "" || values["keystorepassword"] != ""
}

Try / catch

cfg, err := buildConfig(values, credentialProviderPath)
if err != nil {
	if strings.Contains(err.Error(), "configure keyStorePassword explicitly") {
		return fmt.Errorf("resolve keystore password from JCEKS and set keystorepassword: %w", err)
	}
	return err
}

Prevention

Resolve Hadoop credential-provider passwords at deploy time into env vars.
Keep parameter keys lowercase and exact: keystorepassword, keystoretype.
Consider converting the client keystore to PEM cert+key files to eliminate passwords entirely.
Add a config lint step that pairs sslkeystore/keystorepassword presence in CI.

When it happens

Trigger: Configuring the Hive driver with sslkeystore non-empty, keystorepassword empty, while relying on credentialProviderPath (JCEKS credential provider) to supply the keystore password.

Common situations: Migration from the Java Hive JDBC driver where the keystore password lived in a Hadoop credential provider; CI/CD templating wrote sslkeystore but omitted keystorepassword; typo in the keystorepassword parameter key leaving it empty at lookup time.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/8edb6974ce22fd1a. Report an issue: GitHub.