t8y2/dbx · error

load Kerberos keytab %s: %w

Error message

load Kerberos keytab %s: %w

What it means

When credential mode is keytab, newKerberosClient loads the keytab file with keytab.Load. Failure to read or parse the keytab (missing file, bad permissions, corrupt/incompatible format) is wrapped with the keytab path.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:301

}

func newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {
	settings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}
	switch config.credentialMode {
	case kerberosCredentialCCache:
		cache, err := credentials.LoadCCache(config.ccachePath)
		if err != nil {
			return nil, fmt.Errorf("load Kerberos credential cache %s: %w", config.ccachePath, err)
		}
		client, err := krb5client.NewFromCCache(cache, krbConfig, settings...)
		if err != nil {
			return nil, fmt.Errorf("create Kerberos client from credential cache: %w", err)
		}
		return client, nil
	case kerberosCredentialKeytab:
		loadedKeytab, err := keytab.Load(config.keytabPath)
		if err != nil {
			return nil, fmt.Errorf("load Kerberos keytab %s: %w", config.keytabPath, err)
		}
		return krb5client.NewWithKeytab(
			config.credentialUser,
			config.credentialRealm,
			loadedKeytab,
			krbConfig,
			settings...,
		), nil
	case kerberosCredentialPassword:
		return krb5client.NewWithPassword(
			config.credentialUser,
			config.credentialRealm,
			config.password,
			krbConfig,
			settings...,
		), nil
	default:
		return nil, fmt.Errorf("Kerberos credentials are not configured")

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the file exists at the reported path and is readable by the service user (`ls -l`, `klist -kt <path>`).
2. Re-transfer/re-extract the keytab on the KDC (`ktadd -k`) if it is corrupt; use binary-safe transfer.
3. Fix ownership/permissions (chown service user, chmod 600) or mount the secret correctly in Kubernetes/Docker.
4. If finalize derived the path from KRB5_CLIENT_KTNAME, set that env var to the correct absolute path.

Example fix

// before: keytab not in image
// after: Dockerfile
// COPY --chown=app:app cassandra.keytab /etc/security/cassandra.keytab
keytabPath: "/etc/security/cassandra.keytab"

func ensureKeytab(path string) error {
	info, err := os.Stat(path)
	if err != nil { return fmt.Errorf("keytab missing at %s: %w", path, err) }
	f, err := os.Open(path)
	if err != nil { return fmt.Errorf("keytab unreadable by uid %d: %w", os.Getuid(), err) }
	f.Close()
	if info.Size() == 0 { return errors.New("keytab is empty/corrupt") }
	return nil
}

When it happens

Trigger: kerberosCredentialKeytab selected and keytab.Load(config.keytabPath) fails: the file at the finalized keytabPath does not exist, is unreadable by the process user, or is not a valid keytab.

Common situations: Keytab not mounted into the container/pod; wrong path after finalize normalization; keytab owned by root with 0600; truncated or binary-mangled keytab from a bad transfer (e.g. FTP in ASCII mode).

Related errors

• Kerberos keytab authentication requires a keytab path
• Kerberos requires SSPI, credential cache, keytab, or princip
• Kerberos authentication requires a credential cache, keytab,
• Kerberos authentication is not enabled
• load Kerberos credential cache %s: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/038eae620a64be08. Report an issue: GitHub.