What causes "ZooKeeper TLS is not supported" in t8y2/dbx?

Remove all TLS options from the ZooKeeper connection config

ZooKeeper TLS is not supported

Error message

ZooKeeper TLS is not supported

What it means

openClient rejects any connection config that includes TLS options because the ZooKeeper driver does not implement TLS transport. This fail-fast check prevents silently establishing an unencrypted connection when the user expected encryption.

Source

Thrown at agents/drivers/zookeeper/connection.go:151

		result["databaseInfo"] = info
	}
	return result, nil
}

func (service *server) connectionInfo() (map[string]any, error) {
	if _, err := service.requireClient(); err != nil {
		return nil, err
	}
	result := map[string]any{}
	if info := databaseInfo(service.activeConfig); info != nil {
		result["databaseInfo"] = info
	}
	return result, nil
}

func openClient(config connectionConfig) (*clientSession, error) {
	if hasTLSOptions(config) {
		return nil, errors.New("ZooKeeper TLS is not supported")
	}
	authScheme := resolveAuthScheme(config)
	if authScheme != defaultAuthScheme && authScheme != saslDigestAuthScheme {
		return nil, fmt.Errorf("Unsupported auth_scheme %q; expected %q or %q", authScheme, defaultAuthScheme, saslDigestAuthScheme)
	}
	if authScheme == saslDigestAuthScheme {
		if strings.TrimSpace(config.Username) == "" {
			return nil, errors.New(`username is required when auth_scheme = "sasl_digest"`)
		}
		if config.Password == "" {
			return nil, errors.New(`password is required when auth_scheme = "sasl_digest"`)
		}
	}
	if config.BaseSleepTimeMS != nil && *config.BaseSleepTimeMS < 0 {
		return nil, errors.New("base_sleep_time_ms must be non-negative")
	}
	if config.MaxRetries != nil && *config.MaxRetries < 0 {
		return nil, errors.New("max_retries must be non-negative")

View on GitHub (pinned to c0390bff16)

Solutions

Remove all TLS options from the ZooKeeper connection config
Secure the channel at the network layer instead (VPN, SSH tunnel, private link)
Check driver releases for TLS support and upgrade if/when it becomes available
Use ZooKeeper server-side ACLs/SASL (auth_scheme) for authentication without TLS

Example fix

// before
cfg := connectionConfig{Hosts: hosts, TLSCA: "/etc/ca.pem"} // TLS unsupported
// after
cfg := connectionConfig{Hosts: hosts} // encrypted via VPN/tunnel instead

Defensive patterns

Strategy: validation

Validate before calling

// Reject TLS options before connecting since ZooKeeper TLS is unsupported
if cfg.TLSCA != "" || cfg.TLSCert != "" || cfg.TLSKey != "" {
    return errors.New("this ZooKeeper driver does not support TLS; remove TLS options")
}

Try / catch

session, err := openClient(cfg)
if err != nil && strings.Contains(err.Error(), "TLS is not supported") {
    return nil, fmt.Errorf("connect without TLS or secure via network tunnel: %w", err)
}

Prevention

Do not copy TLS fields from other drivers' configs into ZooKeeper configs
Use a VPN, SSH tunnel, or private network for encrypted ZooKeeper traffic
Rely on SASL auth (auth_scheme) plus ACLs for security without TLS
Check driver release notes before assuming TLS support exists

When it happens

Trigger: Connecting (via connect or testConnection) with any TLS-related field set in connectionConfig — e.g. cert/key/CA or ssl flags — so hasTLSOptions(config) returns true.

Common situations: Copy-pasting TLS config from another database driver's connection block; compliance requirements demanding encrypted traffic to ZooKeeper; enabling TLS after a security audit.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/0bf7d0fec2726d24. Report an issue: GitHub.