What causes "load Hive keystore: %w" in t8y2/dbx?

Check the wrapped cause; verify the keystore path exists and is readable

load Hive keystore: %w

Error message

load Hive keystore: %w

What it means

When the sslKeyStore parameter is set, the driver calls loadClientKeyStore to extract a client certificate and wraps any failure with this message. The %w preserves the underlying cause — bad path, wrong keystorepassword, unsupported keystoretype. It is thrown because the driver cannot add the client certificate to the TLS config without successfully loading the store.

Source

Thrown at agents/drivers/argo-go/config.go:1104

		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}
	}
	return config, nil
}

func parameter(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return strings.TrimSpace(value)

View on GitHub (pinned to c0390bff16)

Solutions

Check the wrapped cause; verify the keystore path exists and is readable
Confirm keystorepassword is current and keystoretype matches the file format
Regenerate the keystore in a supported format (PKCS12 recommended)
Alternatively provide clientCertPath/clientKeyPath PEM pair instead of a keystore

Example fix

// before
values["keystoretype"] = "JKS"
// after
values["keystoretype"] = "PKCS12" // matches the actual store format

Defensive patterns

Strategy: validation

Validate before calling

if loc := values["sslkeystore"]; loc != "" {
    if _, err := os.Stat(loc); err != nil {
        return fmt.Errorf("keystore missing: %w", err)
    }
    if values["keystorepassword"] == "" && credentialProvider == "" {
        return errors.New("keystorepassword or credential provider required")
    }
}

Try / catch

if err := db.PingContext(ctx); err != nil {
    if strings.HasPrefix(err.Error(), "load Hive keystore:") {
        // refresh password / fix type, then retry
    }
    return err
}

Prevention

Keep keystore passwords in a credential provider or secret manager
Use PKCS12 keystores with matching keystoretype setting
Load-test the keystore with the client library before deploy
Prefer clientCertPath/clientKeyPath PEM pairs when possible

When it happens

Trigger: Opening a Hive connection with sslKeyStore configured and loadClientKeyStore fails: unreadable store file, wrong keystorepassword, unexpected keystoretype, or corrupt store.

Common situations: Keystore password changed by security rotation; PKCS12 vs JKS type mismatch; keystore path typo; store generated with a key algorithm the Go loader can't parse (e.g. legacy formats).

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/4e60ce9a4a0d41a5. Report an issue: GitHub.