What causes "load ZooKeeper keystore: %w" in t8y2/dbx?

Check the file at zookeeperkeystorelocation exists and is readable by the process

load ZooKeeper keystore: %w

Error message

load ZooKeeper keystore: %w

What it means

This error wraps a failure from loadClientKeyStore while building the ZooKeeper TLS configuration in buildZooKeeperTLSConfig. When the connection config requests client TLS (zookeeperkeystore* parameters), the driver loads the client keystore; any read/parse error is wrapped with the 'load ZooKeeper keystore:' prefix so the underlying cause (bad path, wrong password, unsupported type) is preserved.

Source

Thrown at agents/drivers/hive-go/zookeeper_tls.go:50

		)
		if err != nil {
			return nil, fmt.Errorf("load ZooKeeper truststore: %w", err)
		}
		pool := x509.NewCertPool()
		for _, certificate := range certificates {
			pool.AddCert(certificate)
		}
		config.RootCAs = pool
	}
	keyStoreLocation := parameter(values, "zookeeperkeystorelocation")
	if keyStoreLocation != "" {
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "zookeeperkeystorepassword"),
			parameter(values, "zookeeperkeystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load ZooKeeper keystore: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	if parameterBool(values, "zookeepersslinsecureskipverify") {
		config.InsecureSkipVerify = true
	}
	return config, nil
}

func loadTrustStore(path, password, storeType string) ([]*x509.Certificate, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return nil, err
	}
	switch normalizedStoreType(storeType, path) {
	case "PEM":
		return parsePEMCertificates(contents)
	case "PKCS12":

View on GitHub (pinned to c0390bff16)

Solutions

Check the file at zookeeperkeystorelocation exists and is readable by the process
Verify zookeeperkeystorepassword matches the keystore's actual password
Confirm zookeeperkeystoretype matches the actual keystore format (JKS, PKCS12, PEM)
Run TestBuildZooKeeperTLSConfigFromJKS/FromPKCS12 to validate loading with a known-good keystore

Example fix

// before
config values: zookeeperkeystorelocation=/etc/certs/keystore.js, type=PKCS12
// after
config values: zookeeperkeystorelocation=/etc/certs/keystore.p12, zookeeperkeystoretype=PKCS12, password=<correct>

Defensive patterns

Strategy: validation

Validate before calling

func validateZkKeystore(loc, pass, typ string) error {
  if loc == "" { return errors.New("zookeeperkeystorelocation required for client TLS") }
  if _, err := os.Stat(loc); err != nil { return fmt.Errorf("keystore unreadable: %w", err) }
  switch strings.ToUpper(strings.TrimSpace(typ)) {
  case "", "JKS", "PKCS12", "PEM":
  default: return fmt.Errorf("unsupported keystore type %q", typ)
  }
  return nil
}

Prevention

Stat the keystore path at startup before dialing
Keep keystore type, extension, and actual format consistent
Test keystore loading in CI with the same image paths

When it happens

Trigger: Calling buildZooKeeperTLSConfig (via parseConnectionConfig or tests) when the 'zookeeperkeystorelocation' file cannot be read, the 'zookeeperkeystorepassword' is wrong, or the 'zookeeperkeystoretype' is unsupported by loadClientKeyStore.

Common situations: Typo'd keystore path in the connection string; JKS vs PKCS12 type mismatch; keystore password changed or not URL-encoded; missing file after a container image change.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/7d4c4308464a92f7. Report an issue: GitHub.