What causes "load ZooKeeper truststore: %w" in t8y2/dbx?

Verify zookeepertruststorelocation points to an existing, readable file (check mount/working directory).

load ZooKeeper truststore

Error message

load ZooKeeper truststore: %w

What it means

buildZooKeeperTLSConfig wraps any failure from loadTrustStore with "load ZooKeeper truststore: %w". loadTrustStore reads the zookeepertruststorelocation file (PEM/JKS/PKCS12), decrypts it with zookeepertruststorepassword, and parses certificates; any read, decrypt, parse, or empty-store failure is surfaced here. It means the CA bundle used to verify the ZooKeeper server could not be loaded, so TLS configuration cannot proceed.

Solutions

Verify zookeepertruststorelocation points to an existing, readable file (check mount/working directory).
Confirm zookeepertruststorepassword matches the store's actual password.
Set zookeepertruststoretype explicitly (PEM, JKS, or PKCS12) to match the file format.
Re-export the truststore ensuring it contains at least one CA certificate.
Inspect the wrapped error (%w) for the underlying cause (os.ReadFile vs parse error).

Example fix

// before
params.Set("zookeepertruststorelocation", "truststore.jks") // relative path, wrong cwd
// after
params.Set("zookeepertruststorelocation", "/etc/certs/zk/truststore.p12")
params.Set("zookeepertruststoretype", "PKCS12")
params.Set("zookeepertruststorepassword", os.Getenv("ZK_TRUSTSTORE_PASSWORD"))

Defensive patterns

Strategy: validation

Validate before calling

path := params.Get("zookeepertruststorelocation")
if path == "" {
    return fmt.Errorf("zookeepertruststorelocation is required for TLS")
}
if fi, err := os.Stat(path); err != nil || fi.IsDir() {
    return fmt.Errorf("truststore not readable: %s", path)
}
if pw := params.Get("zookeepertruststorepassword"); pw == "" && storeIsEncrypted(params.Get("zookeepertruststoretype")) {
    return fmt.Errorf("zookeepertruststorepassword is required")
}

Try / catch

cfg, err := buildZooKeeperTLSConfig(values)
if err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) {
        return fmt.Errorf("check zookeepertruststorelocation %q: %w", perr.Path, err)
    }
    return fmt.Errorf("truststore config invalid: %w", err)
}

Prevention

Mount truststores at absolute paths and assert file existence at startup.
Keep store password and path together in the same secret/config source.
Always set zookeepertruststoretype explicitly rather than relying on inference.
Add a smoke test that loads the truststore before connecting.

When it happens

Trigger: parseConnectionConfig builds TLS config with zookeeperssl=true and a zookeepertruststorelocation set: the file does not exist or is unreadable, the password is wrong (encrypted JKS/PKCS12), the zookeepertruststoretype is unsupported, or the store contains zero parseable certificates.

Common situations: Typo in the truststore path or a path relative to the wrong working directory; password changed when rotating certificates; store type left as default JKS when the file is actually PEM; container image missing the mounted secret; store exported without any CA entries.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e39c142d7cb56aab. Report an issue: GitHub.

Appendix: source

Thrown at agents/drivers/argo-go/zookeeper_tls.go:34

)

func buildZooKeeperTLSConfig(values map[string]string) (*tls.Config, error) {
	if !parameterBool(values, "zookeepersslenable") {
		return nil, nil
	}
	config := &tls.Config{
		MinVersion: tls.VersionTLS12,
		ServerName: parameter(values, "zookeeperservername"),
	}
	trustStoreLocation := parameter(values, "zookeepertruststorelocation")
	if trustStoreLocation != "" {
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "zookeepertruststorepassword"),
			parameter(values, "zookeepertruststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load ZooKeeper truststore: %w", err)
		}
		pool := x509.NewCertPool()
		for _, certificate := range certificates {
			pool.AddCert(certificate)
		}
		config.RootCAs = pool
	}
	keyStoreLocation := parameter(values, "zookeeperkeystorelocation")
	if keyStoreLocation != "" {
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "zookeeperkeystorepassword"),
			parameter(values, "zookeeperkeystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load ZooKeeper keystore: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}

View on GitHub (pinned to c0390bff16)