Hive storePasswordPath uses the Java Hadoop credential-provi

Error message

Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent

What it means

When ssltruststore is set but no explicit trustStorePassword is provided and the configuration came from a Java credential-provider file (credentialProviderPath), this error is thrown. Java Hadoop credential providers store passwords in a binary JCEKS file that the native Go agent cannot transparently resolve for truststore decryption, so the library demands the password be configured explicitly rather than guessing.

Source

Thrown at agents/drivers/argo-go/config.go:1064

	config := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}
	if parameterBool(values, "sslinsecureskipverify") || parameterBool(values, "allowselfsigned") {
		config.InsecureSkipVerify = true
	}
	var customRoots *x509.CertPool
	credentialProviderPath := parameter(values, "storepasswordpath")
	if path := strings.TrimSpace(params.CACertPath); path != "" {
		contents, err := os.ReadFile(path)
		if err != nil {
			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots

View on GitHub (pinned to c0390bff16)

Solutions

Set the truststorepassword parameter explicitly to the truststore's password.
Extract the password from the Hadoop credential provider first (hadoop credential list / hadoop credential get <alias>) and put the value into truststorepassword.
If the truststore has no password (identity truststores are often unencrypted), pass an empty-string password explicitly or confirm the parameter key spelling (truststorepassword, not password).
If the store is actually a PEM CA bundle, remove ssltruststore and use the CA-certificate parameter instead so loadTrustStore is not invoked.

Example fix

// before
values["ssltruststore"] = "/etc/hive/conf/truststore.jks"
// (truststorepassword unset; credentialProviderPath set)
// after
values["ssltruststore"] = "/etc/hive/conf/truststore.jks"
values["truststorepassword"] = "<resolved-password-from-jceks>"

Defensive patterns

Strategy: validation

Validate before calling

if values["ssltruststore"] != "" && values["truststorepassword"] == "" && credentialProviderPath != "" {
	return errors.New("provide truststorepassword explicitly; credential-provider format is not supported by the native agent")
}

Type guard

func hasExplicitTruststorePassword(values map[string]string) bool {
	v, ok := values["truststorepassword"]
	return values["ssltruststore"] == "" || (ok && v != "")
}

Try / catch

tlsCfg, err := buildTLSConfig(values)
if err != nil {
	if strings.Contains(err.Error(), "configure trustStorePassword explicitly") {
		return fmt.Errorf("migrate Hadoop credential-provider password into truststorepassword: %w", err)
	}
	return err
}

Prevention

When migrating from JDBC/Hadoop configs, translate credential-provider aliases into explicit password parameters.
Resolve JCEKS-stored passwords at deploy time (hadoop credential get) and inject via env/secret manager.
Keep parameter names exactly lowercase: truststorepassword, truststoretype.
If the truststore is unencrypted, still configure the password parameter consistently rather than relying on the provider.

When it happens

Trigger: Configuring the Hive driver with ssltruststore pointing at a Java truststore, with truststorepassword empty, while credentialProviderPath is set (i.e. the password is only available via the Hadoop credential-provider format).

Common situations: Migrating a JDBC connection string that used Hadoop credential providers (e.g. hadoop.security.credential.provider.path=jceks://...) to the native agent; tooling copied the Java config verbatim; the truststore password was expected to be picked up from the credential provider but the native agent requires it explicitly.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2b8c4ac3fb2a728b. Report an issue: GitHub.