What causes "load ZooKeeper truststore: %w" in t8y2/dbx?

Verify zookeepertruststorelocation points to an existing, readable file (check mount/working directory).

load ZooKeeper truststore: %w

Error message

load ZooKeeper truststore: %w

What it means

buildZooKeeperTLSConfig wraps any failure from loadTrustStore with "load ZooKeeper truststore: %w". loadTrustStore reads the zookeepertruststorelocation file (PEM/JKS/PKCS12), decrypts it with zookeepertruststorepassword, and parses certificates; any read, decrypt, parse, or empty-store failure is surfaced here. It means the CA bundle used to verify the ZooKeeper server could not be loaded, so TLS configuration cannot proceed.

Source

Thrown at agents/drivers/argo-go/zookeeper_tls.go:34

)

func buildZooKeeperTLSConfig(values map[string]string) (*tls.Config, error) {
	if !parameterBool(values, "zookeepersslenable") {
		return nil, nil
	}
	config := &tls.Config{
		MinVersion: tls.VersionTLS12,
		ServerName: parameter(values, "zookeeperservername"),
	}
	trustStoreLocation := parameter(values, "zookeepertruststorelocation")
	if trustStoreLocation != "" {
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "zookeepertruststorepassword"),
			parameter(values, "zookeepertruststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load ZooKeeper truststore: %w", err)
		}
		pool := x509.NewCertPool()
		for _, certificate := range certificates {
			pool.AddCert(certificate)
		}
		config.RootCAs = pool
	}
	keyStoreLocation := parameter(values, "zookeeperkeystorelocation")
	if keyStoreLocation != "" {
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "zookeeperkeystorepassword"),
			parameter(values, "zookeeperkeystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load ZooKeeper keystore: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}

View on GitHub (pinned to c0390bff16)

Solutions

Verify zookeepertruststorelocation points to an existing, readable file (check mount/working directory).
Confirm zookeepertruststorepassword matches the store's actual password.
Set zookeepertruststoretype explicitly (PEM, JKS, or PKCS12) to match the file format.
Re-export the truststore ensuring it contains at least one CA certificate.
Inspect the wrapped error (%w) for the underlying cause (os.ReadFile vs parse error).

Example fix

// before
params.Set("zookeepertruststorelocation", "truststore.jks") // relative path, wrong cwd
// after
params.Set("zookeepertruststorelocation", "/etc/certs/zk/truststore.p12")
params.Set("zookeepertruststoretype", "PKCS12")
params.Set("zookeepertruststorepassword", os.Getenv("ZK_TRUSTSTORE_PASSWORD"))

Defensive patterns

Strategy: validation

Validate before calling

path := params.Get("zookeepertruststorelocation")
if path == "" {
    return fmt.Errorf("zookeepertruststorelocation is required for TLS")
}
if fi, err := os.Stat(path); err != nil || fi.IsDir() {
    return fmt.Errorf("truststore not readable: %s", path)
}
if pw := params.Get("zookeepertruststorepassword"); pw == "" && storeIsEncrypted(params.Get("zookeepertruststoretype")) {
    return fmt.Errorf("zookeepertruststorepassword is required")
}

Try / catch

cfg, err := buildZooKeeperTLSConfig(values)
if err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) {
        return fmt.Errorf("check zookeepertruststorelocation %q: %w", perr.Path, err)
    }
    return fmt.Errorf("truststore config invalid: %w", err)
}

Prevention

Mount truststores at absolute paths and assert file existence at startup.
Keep store password and path together in the same secret/config source.
Always set zookeepertruststoretype explicitly rather than relying on inference.
Add a smoke test that loads the truststore before connecting.

When it happens

Trigger: parseConnectionConfig builds TLS config with zookeeperssl=true and a zookeepertruststorelocation set: the file does not exist or is unreadable, the password is wrong (encrypted JKS/PKCS12), the zookeepertruststoretype is unsupported, or the store contains zero parseable certificates.

Common situations: Typo in the truststore path or a path relative to the wrong working directory; password changed when rotating certificates; store type left as default JKS when the file is actually PEM; container image missing the mounted secret; store exported without any CA entries.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e39c142d7cb56aab. Report an issue: GitHub.