t8y2/dbx · error

parse ZooKeeper TLS address %q: %w

Error message

parse ZooKeeper TLS address %q: %w

What it means

Returned by newProtocolZooKeeperClient in hive-go when parsing a TLS-secures-the-ZooKeeper-address form fails: the %q address and wrapped error identify which endpoint string could not be interpreted as a TLS address. It surfaces during Kerberos ZooKeeper connection setup when the address list contains a malformed entry.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:59

var newZooKeeperSASLClient = func(host string, config connectionConfig) (zooKeeperSASLClient, error) {
	service, options := zooKeeperGSSAPIOptions(config)
	mechanism, err := gosasl.NewGSSAPIMechanismWithOptions(service, options)
	if err != nil {
		return nil, err
	}
	return gosasl.NewSaslClient(host, mechanism), nil
}

var dialZooKeeperConnection = func(address string, timeout time.Duration, tlsConfig *tls.Config) (net.Conn, error) {
	dialer := &net.Dialer{Timeout: timeout}
	if tlsConfig == nil {
		return dialer.Dial("tcp", address)
	}
	config := tlsConfig.Clone()
	if config.ServerName == "" {
		host, _, err := net.SplitHostPort(address)
		if err != nil {
			return nil, fmt.Errorf("parse ZooKeeper TLS address %q: %w", address, err)
		}
		config.ServerName = host
	}
	return tls.DialWithDialer(dialer, "tcp", address, config)
}

var shuffleZooKeeperServers = func(servers []string) {
	rand.Shuffle(len(servers), func(first, second int) {
		servers[first], servers[second] = servers[second], servers[first]
	})
}

func zooKeeperGSSAPIOptions(config connectionConfig) (string, gosasl.GSSAPIOptions) {
	service := firstNonEmpty(config.ZooKeeperKerberos.Service, "zookeeper")
	options := gssapiOptionsFromKerberos(config.Kerberos)
	options.QOP = "auth"
	options.AuthorizationID = ""
	options.ServiceHost = ""

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the wrapped parse error for the offending address format
2. Use plain host:port ZooKeeper addresses and configure TLS via the dedicated TLS options instead of address-embedded schemes
3. Remove any stray scheme/prefix from the zookeeper address entries

When it happens

Trigger: Thrown at agents/drivers/hive-go/zookeeper_protocol.go:59 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/692c2bd84479f2aa. Report an issue: GitHub.