private CuratorFramework getZookeeperClient(Configuration conf, String namespace, ACLProvider zooKeeperAclProvider) {
    String keyStorePassword = "";
    String trustStorePassword = "";
    if (HiveConf.getBoolVar(conf, ConfVars.HIVE_ZOOKEEPER_SSL_ENABLE)) {
      try {
        keyStorePassword =
            ShimLoader.getHadoopShims().getPassword(conf, ConfVars.HIVE_ZOOKEEPER_SSL_KEYSTORE_PASSWORD.varname);
        trustStorePassword =
            ShimLoader.getHadoopShims().getPassword(conf, ConfVars.HIVE_ZOOKEEPER_SSL_TRUSTSTORE_PASSWORD.varname);
      } catch (Exception e) {
        throw new RuntimeException("Failed to read zookeeper conf passwords", e);
      }
    }
    return ZooKeeperHiveHelper.builder()
        .quorum(conf.get(ConfVars.HIVE_ZOOKEEPER_QUORUM.varname))
        .clientPort(conf.get(ConfVars.HIVE_ZOOKEEPER_CLIENT_PORT.varname,
            ConfVars.HIVE_ZOOKEEPER_CLIENT_PORT.getDefaultValue()))
        .connectionTimeout(
            (int) HiveConf.getTimeVar(conf, ConfVars.HIVE_ZOOKEEPER_CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS))
        .sessionTimeout(
            (int) HiveConf.getTimeVar(conf, ConfVars.HIVE_ZOOKEEPER_SESSION_TIMEOUT, TimeUnit.MILLISECONDS))
        .baseSleepTime(
            (int) HiveConf.getTimeVar(conf, ConfVars.HIVE_ZOOKEEPER_CONNECTION_BASESLEEPTIME, TimeUnit.MILLISECONDS))
        .maxRetries(HiveConf.getIntVar(conf, ConfVars.HIVE_ZOOKEEPER_CONNECTION_MAX_RETRIES))
        .sslEnabled(HiveConf.getBoolVar(conf, ConfVars.HIVE_ZOOKEEPER_SSL_ENABLE))
        .keyStoreLocation(HiveConf.getVar(conf, ConfVars.HIVE_ZOOKEEPER_SSL_KEYSTORE_LOCATION))
        .keyStorePassword(keyStorePassword)
        .keyStoreType(HiveConf.getVar(conf, ConfVars.HIVE_ZOOKEEPER_SSL_KEYSTORE_TYPE))
        .trustStoreLocation(HiveConf.getVar(conf, ConfVars.HIVE_ZOOKEEPER_SSL_TRUSTSTORE_LOCATION))
        .trustStorePassword(trustStorePassword)
        .trustStoreType(HiveConf.getVar(conf, ConfVars.HIVE_ZOOKEEPER_SSL_TRUSTSTORE_TYPE))
        .build().getNewZookeeperClient(zooKeeperAclProvider, namespace);
  }
@param rootNs A single root namespace override. Not recommended.
@param nsPrefix The namespace prefix to use with default namespaces (appends 'sasl' for secure else 'unsecure'
                to namespace prefix to get effective root namespace).
@param userScopePathPrefix The prefix to use for the user-specific part of the path.
@param workerPrefix The prefix to use for each worker znode.
@param workerGroup group name to use for all workers
@param zkSaslLoginContextName SASL login context name for ZK security; null if not needed.
@param zkPrincipal ZK security principal.
@param zkKeytab ZK security keytab.
@param aclsConfig A config setting to use to determine if ACLs should be verified.
llap-client/src/java/org/apache/hadoop/hive/registry/impl/ZkRegistryBase.java