t8y2/dbx · error

ZooKeeper auth scheme and credentials must be configured tog

Error message

ZooKeeper auth scheme and credentials must be configured together

What it means

Endpoints() enforces that ZooKeeper authentication is fully specified: if either authScheme or auth is set, both must be present. Supplying only one is treated as a configuration error because a partial auth spec would authenticate inconsistently or fail on the server. The error is raised before AddAuth is called.

Source

Thrown at agents/drivers/argo-go/discovery.go:114

	addresses := make([]string, 0, len(discovery.servers))
	for _, server := range discovery.servers {
		addresses = append(addresses, server.address())
	}
	timeout := discovery.timeout
	if timeout <= 0 {
		timeout = defaultConnectTimeout
	}
	connection, events, err := discovery.dialer(addresses, timeout)
	if err != nil {
		return nil, fmt.Errorf("connect to ZooKeeper: %w", err)
	}
	defer connection.Close()
	if err := waitForZooKeeperSession(ctx, events, timeout); err != nil {
		return nil, err
	}
	if discovery.authScheme != "" || discovery.auth != "" {
		if discovery.authScheme == "" || discovery.auth == "" {
			return nil, errors.New("ZooKeeper auth scheme and credentials must be configured together")
		}
		if err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {
			return nil, fmt.Errorf("authenticate to ZooKeeper: %w", err)
		}
	}
	resolved := make([]endpoint, 0)
	var listedPath string
	var nodeFailures []string
	for _, path := range discovery.paths() {
		children, _, childrenErr := connection.Children(path)
		if errors.Is(childrenErr, zk.ErrNoNode) {
			continue
		}
		if childrenErr != nil {
			return nil, fmt.Errorf("list ZooKeeper namespace %s: %w", path, childrenErr)
		}
		listedPath = path
		for _, child := range children {

View on GitHub (pinned to c0390bff16)

Solutions

1. Set both the ZooKeeper auth scheme (e.g. 'digest') and the auth credential string in the discovery config
2. If ZooKeeper does not require auth, remove both parameters instead of just one
3. Verify the credentials are passed intact through any templating/env layer

Example fix

// before
authScheme: "digest" // auth missing
// after
authScheme: "digest",
auth: "user:password"

if (cfg.ZKAuthScheme == "") != (cfg.ZKAuth == "") {
	return errors.New("zookeeper authScheme and auth must be set together")
}

func zkAuthComplete(d discoveryConfig) bool {
	return (d.AuthScheme == "") == (d.Auth == "")
}

When it happens

Trigger: Calling Endpoints with a discovery config where exactly one of authScheme (e.g. 'digest') and auth (credentials string) is non-empty.

Common situations: Users set zk auth scheme but forget the credential parameter, or set credentials without the scheme name (digest vs. sasl); config templating drops one of the pair; migrating from an unauthenticated to an authenticated ZooKeeper quorum.

Related errors

• Unsupported auth_scheme %q; expected %q or %q
• username is required when auth_scheme = "sasl_digest"
• password is required when auth_scheme = "sasl_digest"
• Hive JWT authentication requires jwt or the JWT environment
• Hive delegation token authentication requires delegationToke

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e605824649ecf690. Report an issue: GitHub.