t8y2/dbx · error

list ZooKeeper namespace %s: %w

Error message

list ZooKeeper namespace %s: %w

What it means

Endpoints() fails to list the children of a ZooKeeper path used for HiveServer2 service discovery. The Children() call on the zooKeeperClient returned a non-nil error that is not zk.ErrNoNode, so discovery aborts and wraps the underlying zk error with the offending path. This signals a problem with the ZooKeeper session, ACLs, or the ensemble rather than simply a missing namespace.

Source

Thrown at agents/drivers/argo-go/discovery.go:129

	}
	if discovery.authScheme != "" || discovery.auth != "" {
		if discovery.authScheme == "" || discovery.auth == "" {
			return nil, errors.New("ZooKeeper auth scheme and credentials must be configured together")
		}
		if err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {
			return nil, fmt.Errorf("authenticate to ZooKeeper: %w", err)
		}
	}
	resolved := make([]endpoint, 0)
	var listedPath string
	var nodeFailures []string
	for _, path := range discovery.paths() {
		children, _, childrenErr := connection.Children(path)
		if errors.Is(childrenErr, zk.ErrNoNode) {
			continue
		}
		if childrenErr != nil {
			return nil, fmt.Errorf("list ZooKeeper namespace %s: %w", path, childrenErr)
		}
		listedPath = path
		for _, child := range children {
			data, _, dataErr := connection.Get(path + "/" + child)
			if dataErr != nil {
				if errors.Is(dataErr, zk.ErrNoNode) {
					continue
				}
				nodeFailures = append(nodeFailures, fmt.Sprintf("%s/%s: %v", path, child, dataErr))
				continue
			}
			value, parseErr := parseHiveServerRegistration(child, data)
			if parseErr == nil {
				resolved = append(resolved, value)
			} else {
				nodeFailures = append(nodeFailures, fmt.Sprintf("%s/%s: %v", path, child, parseErr))
			}
		}

View on GitHub (pinned to c0390bff16)

Solutions

  1. Check the wrapped error: if it is permission/NoAuth, grant the connecting identity read access to the namespace znode (or configure zooKeeperAuthScheme/zooKeeperAuth).
  2. If it is a connection-loss/expired-session error, verify ZooKeeper server addresses and network stability, then retry Endpoints().
  3. Verify the namespace path spelling in the connection config; wrong ACL'd or deleted znodes surface here.
  4. Enable TLS/Kerberos configuration correctly (zooKeeperTLSConfig, ZooKeeperKerberos) — auth mismatches often surface as ZK errors on Children.

Example fix

// before
children, _, err := conn.Children("/hiveserver2")
// after — retry transient zk errors before giving up
children, _, err := conn.Children("/hiveserver2")
if err != nil && errors.Is(err, zk.ErrConnectionClosed) {
    // reconnect and retry once before failing
}
Defensive patterns

Strategy: retry

Validate before calling

// preflight: verify the ZK namespace znode is readable
conn, _, err := zk.Connect([]string{zkHost}, 5*time.Second)
if err != nil { return err }
_, _, err = conn.Children("/"+namespace)
conn.Close()
return err

Try / catch

var eps []endpoint
err := retry(3, time.Second, func() error {
    var e error
    eps, e = discovery.Endpoints(ctx, nil)
    if e != nil && !strings.Contains(e.Error(), "list ZooKeeper namespace") {
        return nil // non-transient
    }
    return e
})
if err != nil { return fmt.Errorf("discovery failed: %w", err) }

Prevention

When it happens

Trigger: connection.Children(path) returns a non-ErrNoNode error during Endpoints(): permission denied on the znode, connection lost mid-call, session expired, or an invalid path.

Common situations: ZooKeeper ACLs deny read access to the HiveServer2 namespace; the ZK ensemble was restarted and the session dropped; a network partition between client and ensemble; a Kerberos/SASL-authenticated ZK where the client lacks read rights on the node.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/a31f12d1a0a68be3. Report an issue: GitHub.