You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When starting nebula with systemd unit, on systems that do not have a clock battery (eg: RPis), if the clock will automatically reset to a moment in time that is prior to the creation of the CA, nebula will fail directly.
This can be fixed by enabling systemd-time-wait-sync and wanting for time-sync.target.
Logs from affected hosts
Note: the logs have been collected on 2022-12-16, even though they have a time that is in July due to the fact that the NTP-based clock-sync daemon did not started yet.
Jul 14 00:00:22 rpi0.fale.io systemd[1]: Started nebula.service - nebula.
Jul 14 00:00:23 rpi0.fale.io nebula[809]: time="2022-07-14T00:00:23Z" level=warning msg="expired certificate present in CA pool" cert="NebulaCertificate {\n\tDetails {\n\t\tName: FalePrivateNet\n\t\tIps: []\n\t\tSubnets: []\n\t\tGroups: []\n\t\tNot before: 2022-09-03 07:54:33 +0000 UTC\n\t\tNot After: 2032-08-31 07:54:33 +0000 UTC\n\t\tIs CA: true\n\t\tIssuer: \n\t\tPublic key: 91c5a8c9aecb98a9152b0171f5f3a8d7dcf4f433a0605dd32aaabc27570a1704\n\t}\n\tFingerprint: 8bfad74452a0073bd716c1d6f5da8de281785857e1ed3a0f02f4de441bcd36b5\n\tSignature: 2c5acfcde6fd42f0dee74fc72a06da0d636c6c0fc40b4034036589f82840d16a2db3c0855f8fd4e664abd233cdc5608690a9a96939c74d1e36901ae431dac90f\n}"
Jul 14 00:00:23 rpi0.fale.io nebula[809]: time="2022-07-14T00:00:23Z" level=error msg="Failed to load ca from config" error="no valid CA certificates present"
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Main process exited, code=exited, status=1/FAILURE
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Failed with result 'exit-code'.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Scheduled restart job, restart counter is at 1.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: Stopped nebula.service - nebula.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: Started nebula.service - nebula.
Jul 14 00:00:23 rpi0.fale.io nebula[859]: time="2022-07-14T00:00:23Z" level=warning msg="expired certificate present in CA pool" cert="NebulaCertificate {\n\tDetails {\n\t\tName: FalePrivateNet\n\t\tIps: []\n\t\tSubnets: []\n\t\tGroups: []\n\t\tNot before: 2022-09-03 07:54:33 +0000 UTC\n\t\tNot After: 2032-08-31 07:54:33 +0000 UTC\n\t\tIs CA: true\n\t\tIssuer: \n\t\tPublic key: 91c5a8c9aecb98a9152b0171f5f3a8d7dcf4f433a0605dd32aaabc27570a1704\n\t}\n\tFingerprint: 8bfad74452a0073bd716c1d6f5da8de281785857e1ed3a0f02f4de441bcd36b5\n\tSignature: 2c5acfcde6fd42f0dee74fc72a06da0d636c6c0fc40b4034036589f82840d16a2db3c0855f8fd4e664abd233cdc5608690a9a96939c74d1e36901ae431dac90f\n}"
Jul 14 00:00:23 rpi0.fale.io nebula[859]: time="2022-07-14T00:00:23Z" level=error msg="Failed to load ca from config" error="no valid CA certificates present"
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Main process exited, code=exited, status=1/FAILURE
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Failed with result 'exit-code'.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Scheduled restart job, restart counter is at 2.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: Stopped nebula.service - nebula.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: Started nebula.service - nebula.
Jul 14 00:00:23 rpi0.fale.io nebula[886]: time="2022-07-14T00:00:23Z" level=warning msg="expired certificate present in CA pool" cert="NebulaCertificate {\n\tDetails {\n\t\tName: FalePrivateNet\n\t\tIps: []\n\t\tSubnets: []\n\t\tGroups: []\n\t\tNot before: 2022-09-03 07:54:33 +0000 UTC\n\t\tNot After: 2032-08-31 07:54:33 +0000 UTC\n\t\tIs CA: true\n\t\tIssuer: \n\t\tPublic key: 91c5a8c9aecb98a9152b0171f5f3a8d7dcf4f433a0605dd32aaabc27570a1704\n\t}\n\tFingerprint: 8bfad74452a0073bd716c1d6f5da8de281785857e1ed3a0f02f4de441bcd36b5\n\tSignature: 2c5acfcde6fd42f0dee74fc72a06da0d636c6c0fc40b4034036589f82840d16a2db3c0855f8fd4e664abd233cdc5608690a9a96939c74d1e36901ae431dac90f\n}"
Jul 14 00:00:23 rpi0.fale.io nebula[886]: time="2022-07-14T00:00:23Z" level=error msg="Failed to load ca from config" error="no valid CA certificates present"
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Main process exited, code=exited, status=1/FAILURE
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Failed with result 'exit-code'.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: nebula.service: Scheduled restart job, restart counter is at 3.
Jul 14 00:00:23 rpi0.fale.io systemd[1]: Stopped nebula.service - nebula.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: Started nebula.service - nebula.
Jul 14 00:00:24 rpi0.fale.io nebula[904]: time="2022-07-14T00:00:24Z" level=warning msg="expired certificate present in CA pool" cert="NebulaCertificate {\n\tDetails {\n\t\tName: FalePrivateNet\n\t\tIps: []\n\t\tSubnets: []\n\t\tGroups: []\n\t\tNot before: 2022-09-03 07:54:33 +0000 UTC\n\t\tNot After: 2032-08-31 07:54:33 +0000 UTC\n\t\tIs CA: true\n\t\tIssuer: \n\t\tPublic key: 91c5a8c9aecb98a9152b0171f5f3a8d7dcf4f433a0605dd32aaabc27570a1704\n\t}\n\tFingerprint: 8bfad74452a0073bd716c1d6f5da8de281785857e1ed3a0f02f4de441bcd36b5\n\tSignature: 2c5acfcde6fd42f0dee74fc72a06da0d636c6c0fc40b4034036589f82840d16a2db3c0855f8fd4e664abd233cdc5608690a9a96939c74d1e36901ae431dac90f\n}"
Jul 14 00:00:24 rpi0.fale.io nebula[904]: time="2022-07-14T00:00:24Z" level=error msg="Failed to load ca from config" error="no valid CA certificates present"
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Main process exited, code=exited, status=1/FAILURE
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Failed with result 'exit-code'.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Scheduled restart job, restart counter is at 4.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: Stopped nebula.service - nebula.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: Started nebula.service - nebula.
Jul 14 00:00:24 rpi0.fale.io nebula[911]: time="2022-07-14T00:00:24Z" level=warning msg="expired certificate present in CA pool" cert="NebulaCertificate {\n\tDetails {\n\t\tName: FalePrivateNet\n\t\tIps: []\n\t\tSubnets: []\n\t\tGroups: []\n\t\tNot before: 2022-09-03 07:54:33 +0000 UTC\n\t\tNot After: 2032-08-31 07:54:33 +0000 UTC\n\t\tIs CA: true\n\t\tIssuer: \n\t\tPublic key: 91c5a8c9aecb98a9152b0171f5f3a8d7dcf4f433a0605dd32aaabc27570a1704\n\t}\n\tFingerprint: 8bfad74452a0073bd716c1d6f5da8de281785857e1ed3a0f02f4de441bcd36b5\n\tSignature: 2c5acfcde6fd42f0dee74fc72a06da0d636c6c0fc40b4034036589f82840d16a2db3c0855f8fd4e664abd233cdc5608690a9a96939c74d1e36901ae431dac90f\n}"
Jul 14 00:00:24 rpi0.fale.io nebula[911]: time="2022-07-14T00:00:24Z" level=error msg="Failed to load ca from config" error="no valid CA certificates present"
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Main process exited, code=exited, status=1/FAILURE
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Failed with result 'exit-code'.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Scheduled restart job, restart counter is at 5.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: Stopped nebula.service - nebula.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Start request repeated too quickly.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: nebula.service: Failed with result 'exit-code'.
Jul 14 00:00:24 rpi0.fale.io systemd[1]: Failed to start nebula.service - nebula.
* Add nss-lookup to the systemd wants to ensure DNS is running before starting nebula
* Add Ansible & example service scripts
* Fix#797
* Align Ansible scripts and examples
Co-authored-by: John Maguire <contact@johnmaguire.me>
apeters1827
pushed a commit
to oneclick-ag/nebula
that referenced
this issue
Jul 4, 2023
* Add nss-lookup to the systemd wants to ensure DNS is running before starting nebula
* Add Ansible & example service scripts
* Fixslackhq#797
* Align Ansible scripts and examples
Co-authored-by: John Maguire <contact@johnmaguire.me>
What version of
nebula
are you using?1.6.1
What operating system are you using?
Linux
Describe the Bug
When starting
nebula
with systemd unit, on systems that do not have a clock battery (eg: RPis), if the clock will automatically reset to a moment in time that is prior to the creation of the CA, nebula will fail directly.This can be fixed by enabling
systemd-time-wait-sync
and wanting fortime-sync.target
.Logs from affected hosts
Note: the logs have been collected on 2022-12-16, even though they have a time that is in July due to the fact that the NTP-based clock-sync daemon did not started yet.
Config files from affected hosts
The text was updated successfully, but these errors were encountered: