t8y2/dbx · error

ZooKeeper Kerberos SASL requires Hive Kerberos credentials

Error message

ZooKeeper Kerberos SASL requires Hive Kerberos credentials

What it means

connectKerberosZooKeeper performs SASL-secured ZooKeeper connections only; when config.Kerberos.Enabled is false it returns this error because Hive Kerberos credentials are mandatory for the GSSAPI handshake. The library refuses to attempt an unauthenticated SASL connect rather than failing later at the server.

Source

Thrown at agents/drivers/argo-go/zookeeper_protocol.go:96

	options.CanonicalizeHost = config.ZooKeeperKerberos.CanonicalHostname
	options.ServerName = config.ZooKeeperKerberos.ServerPrincipal
	if options.ServerName == "" && config.ZooKeeperKerberos.Realm != "" {
		options.ServerName = service + "/_HOST@" + config.ZooKeeperKerberos.Realm
	}
	return service, options
}

func connectKerberosZooKeeper(
	servers []string,
	timeout time.Duration,
	tlsConfig *tls.Config,
	config connectionConfig,
) (zooKeeperClient, <-chan zk.Event, error) {
	if len(servers) == 0 {
		return nil, nil, errors.New("ZooKeeper server list is empty")
	}
	if !config.Kerberos.Enabled {
		return nil, nil, errors.New("ZooKeeper Kerberos SASL requires Hive Kerberos credentials")
	}
	ordered := append([]string(nil), servers...)
	shuffleZooKeeperServers(ordered)
	var failures []string
	for _, address := range ordered {
		host, _, err := net.SplitHostPort(address)
		if err != nil {
			failures = append(failures, fmt.Sprintf("%s: %v", address, err))
			continue
		}
		connection, err := dialZooKeeperConnection(address, timeout, tlsConfig)
		if err != nil {
			failures = append(failures, fmt.Sprintf("%s: %v", address, err))
			continue
		}
		client, err := newProtocolZooKeeperClient(connection, timeout)
		if err == nil {
			var saslClient zooKeeperSASLClient

View on GitHub (pinned to c0390bff16)

Solutions

1. Set Kerberos.Enabled = true and provide principal, keytab, and realm matching the Hive cluster
2. If the ensemble does not require SASL, use the non-Kerberos ZooKeeper connect path instead
3. Validate the Kerberos config before connecting and fail with a clear app-level message
4. Confirm the keytab is readable by the process and kinit/credential refresh works

Example fix

// before
conn, _, err := connectKerberosZooKeeper(servers, timeout, tlsConfig, connectionConfig{})
// after
cfg := connectionConfig{}
cfg.Kerberos.Enabled = true
cfg.Kerberos.Principal = "hive/_HOST@EXAMPLE.COM"
cfg.Kerberos.Keytab = "/etc/security/keytabs/hive.service.keytab"
conn, _, err := connectKerberosZooKeeper(servers, timeout, tlsConfig, cfg)

if !cfg.Kerberos.Enabled || cfg.Kerberos.Principal == "" || cfg.Kerberos.Keytab == "" {
    return errors.New("ZooKeeper SASL discovery requires Kerberos principal and keytab")
}

conn, events, err := connectKerberosZooKeeper(servers, timeout, tls, cfg)
if err != nil && strings.Contains(err.Error(), "requires Hive Kerberos credentials") {
    // point the operator at the Kerberos config section
}

When it happens

Trigger: Calling the Kerberos ZooKeeper connect path with a connectionConfig whose Kerberos.Enabled is false; wiring SASL ZooKeeper discovery into a connection configured without Hive Kerberos (no principal/keytab).

Common situations: Enabling ZooKeeper service discovery for a Kerberized Hive cluster while leaving the Kerberos block disabled in the driver config; copying a non-Kerberos config into a secured environment.

Related errors

• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper SASL client is nil
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials
• ZooKeeper SASL client is nil
• ZooKeeper SASL round %d: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/af36f226dfd71829. Report an issue: GitHub.