Flannel x509: certificate has expired or is not yet valid

Hello

After some troubles with containerd I reinstalled microk8s 1.16.8 with sudo snap install microk8s --classic --channel=1.16/stable. First everything looked fine, but after I enabled some plugins, e.g DNS, storage etc. I realized, flannel has a problem with a certificate. Here the journalctl output:

Apr 30 13:41:17 XPS-8930 systemd[1]: Started Service for snap application microk8s.daemon-flanneld.
Apr 30 13:41:22 XPS-8930 microk8s.daemon-flanneld[31687]: Error:  x509: certificate has expired or is not yet valid
Apr 30 13:41:22 XPS-8930 microk8s.daemon-flanneld[31687]: /coreos.com/network/config is not in etcd. Probably a first time run.
Apr 30 13:41:22 XPS-8930 microk8s.daemon-flanneld[31687]: Error:  client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate has expired or is not yet valid
Apr 30 13:41:22 XPS-8930 microk8s.daemon-flanneld[31687]: error #0: x509: certificate has expired or is not yet valid
Apr 30 13:41:22 XPS-8930 systemd[1]: snap.microk8s.daemon-flanneld.service: Main process exited, code=exited, status=4/NOPERMISSION
Apr 30 13:41:22 XPS-8930 systemd[1]: snap.microk8s.daemon-flanneld.service: Failed with result 'exit-code'.
Apr 30 13:41:22 XPS-8930 systemd[1]: snap.microk8s.daemon-flanneld.service: Service hold-off time over, scheduling restart.

I uninstalled microk8s again and looked for directories which probably left over under /var/snap, but microk8s has been erased completely. Why is flannel complaining about the wrong certificate, and where is it located, so that I could change it?

$ microk8s.inspect                                                                                                                                                                                                                                                                                       [] 13:40:58
[sudo] password for tobias: 
Inspecting services
  Service snap.microk8s.daemon-cluster-agent is running
  Service snap.microk8s.daemon-flanneld is running
  Service snap.microk8s.daemon-containerd is running
  Service snap.microk8s.daemon-apiserver is running
  Service snap.microk8s.daemon-apiserver-kicker is running
  Service snap.microk8s.daemon-proxy is running
  Service snap.microk8s.daemon-kubelet is running
  Service snap.microk8s.daemon-scheduler is running
  Service snap.microk8s.daemon-controller-manager is running
  Service snap.microk8s.daemon-etcd is running
  Copy service arguments to the final report tarball
Inspecting AppArmor configuration
Gathering system information
  Copy processes list to the final report tarball
  Copy snap list to the final report tarball
  Copy VM name (or none) to the final report tarball
  Copy disk usage information to the final report tarball
  Copy memory usage information to the final report tarball
  Copy server uptime to the final report tarball
  Copy current linux distribution to the final report tarball
  Copy openSSL information to the final report tarball
  Copy network configuration to the final report tarball
Inspecting kubernetes cluster
  Inspect kubernetes cluster

Building the report tarball
  Report tarball is at /var/snap/microk8s/1302/inspection-report-20200430_134112.tar.gz

inspection-report-20200430_134112.tar.gz

Thanks for your help!

[jazarja]

I found similar issue, upon observation to daemon-apiserver journal.log, I found this entry

Mei 08 09:45:49 LAB microk8s.daemon-apiserver[2099]: W0508 09:45:49.064646 2099 clientconn.go:1208] grpc: addrConn.createTransport failed to connect to {https://127.0.0.1:12379 <nil> 0 <nil>}. Err :connection error: desc = “transport: authentication handshake failed: x509: certificate has expired or is not yet valid: current time 2020-05-08T09:45:49+07:00 is before 2020-05-08T08:39:47Z”. Reconnecting…

Seems the certificate is generated using UTC while my server using GMT+7

Workaround: Modify /var/snap/microk8s/current/certs/csr.conf.template to

[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
**default_startdate = 20200101120000Z**

Edit: Today, I’ve encountered the ‘certificate has expired or is not yet valid’ again, seems the ca.crt is already expired. This https://github.com/ubuntu/microk8s/issues/1150 solve my problem.

[tfluehmann]

Thanks for the response, #1150 worked for me too. I am closing this issue, since it is tracked in the other thread.