Olares won't finalize install, bails during authelia startup

[cringdahl]

The service logs complain about time drift, which is mystifying. The WSL has the same HH:MM:SS that cmd does.

From the installer cmd window:

2026-01-09T17:20:07.248-0600    Local retry: [terminus] WaitServicesReady
2026-01-09T17:20:22.266-0600    terminus container authelia in pod os-framework/authelia-backend-cc966fbd5-q7xt8 is not running
2026-01-09T17:20:22.266-0600    Local retry: [terminus] WaitServicesReady
2026-01-09T17:20:37.285-0600    terminus container authelia in pod os-framework/authelia-backend-cc966fbd5-q7xt8 is not running
2026-01-09T17:20:37.285-0600    Local retry: [terminus] WaitServicesReady
2026-01-09T17:20:52.293-0600    terminus container authelia in pod os-framework/authelia-backend-cc966fbd5-q7xt8 is not running
2026-01-09T17:20:52.293-0600    Local retry: [terminus] WaitServicesReady
2026-01-09T17:21:07.307-0600    terminus container authelia in pod os-framework/authelia-backend-cc966fbd5-q7xt8 is not running
2026-01-09T17:21:07.307-0600    [A] terminus: WaitServicesReady failed (14m45.624153091s)
2026-01-09T17:21:07.307-0600    [Job] [Install the System] execute failed <nil>
2026/01/09 17:21:07 error: Module[Welcome] exec failed:
failed - terminus: [A] terminus: WaitServicesReady exec failed after 60 retires: container authelia in pod os-framework/authelia-backend-cc966fbd5-q7xt8 is not running
2026-01-09T17:21:07.317-0600    ranger install Olares Ubuntu failed: Failed to exec command: wsl -d Ubuntu -u root --cd /root bash -c export KUBE_TYPE=k3s && export REGISTRY_MIRRORS= && export PREINSTALL= && export HOST_IP=192.168.0.100 && export DISABLE_HOST_IP_PROMPT= && export OLARES_SYSTEM_CDN_SERVICE= && curl -fsSLO https://cdn.olares.com/install-wizard-v1.12.3.tar.gz && tar -xf install-wizard-v1.12.3.tar.gz -C ./ ./install.sh && rm -rf install-wizard-v1.12.3.tar.gz && bash ./install.sh
: exit status 1
2026-01-09T17:21:07.318-0600    [A] ranger: InstallOlares failed (25m27.5496077s)
2026-01-09T17:21:07.318-0600    [Job] [Install the System] execute failed <nil>
2026/01/09 17:21:07 error: Module[InstallOlares] exec failed:
failed - ranger: [A] ranger: InstallOlares exec failed after 1 retires: install Olares Ubuntu failed: Failed to exec command: wsl -d Ubuntu -u root --cd /root bash -c export KUBE_TYPE=k3s && export REGISTRY_MIRRORS= && export PREINSTALL= && export HOST_IP=192.168.0.100 && export DISABLE_HOST_IP_PROMPT= && export OLARES_SYSTEM_CDN_SERVICE= && curl -fsSLO https://cdn.olares.com/install-wizard-v1.12.3.tar.gz && tar -xf install-wizard-v1.12.3.tar.gz -C ./ ./install.sh && rm -rf install-wizard-v1.12.3.tar.gz && bash ./install.sh
: exit status 1

From terminus:

root@terminus:~# kubectl logs service/authelia-backend -n os-framework
Defaulted container "authelia" out of: authelia, init-container (init), setsysctl (init)
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_PORT"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_PORT_9091_TCP"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_PORT_9091_TCP_ADDR"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_PORT_9091_TCP_PORT"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_PORT_9091_TCP_PROTO"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_SERVICE_HOST"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_SERVICE_PORT"
time="2026-01-09T23:11:40Z" level=warning msg="Configuration: configuration environment variable not expected: AUTHELIA_BACKEND_SERVICE_PORT_AUTHELIA"
time="2026-01-09T23:11:40Z" level=info msg="Authelia untagged-unknown-dirty (master, unknown) is starting"
time="2026-01-09T23:11:40Z" level=info msg="Log severity set to debug"
time="2026-01-09T23:11:40Z" level=debug msg="Registering client example with policy two_factor (two_factor)"
I0109 23:11:41.317481       1 request.go:690] Waited for 1.047445877s due to client-side throttling, not priority and fairness, request: GET:https://10.233.0.1:443/apis/opentelemetry.io/v1alpha1?timeout=32s
I0109 23:11:41.430633       1 provider.go:287] start to reload token from session redis storage
I0109 23:11:41.433570       1 provider.go:407] tokenList res: [{eyJhbGciOiJIUzUxMiJ9.eyJleHAiOjE3NjgwODYzMzMsImlhdCI6MTc2Nzk5OTkzMywidXNlcm5hbWUiOiJhZG1pbiIsImdyb3VwcyI6WyJsbGRhcF9hZG1pbiJdLCJtZmEiOjAsImppZCI6NDQ0NDUxNzMyNjY5OTI1MjI0N30._-cvGMy2YHruCUOp3gDd-MmawzIRH170ES9_49vDabrgZtUlzA1bNpV_jfMaKbN0_ExK-7N-r53Itjy05rFO4w false} {eyJhbGciOiJIUzUxMiJ9.eyJleHAiOjE3NjgwODYzMzMsImlhdCI6MTc2Nzk5OTkzMywidXNlcm5hbWUiOiJzb21lZGFtbnRoaW5nIiwiZ3JvdXBzIjpbXSwibWZhIjowLCJqaWQiOjM2NjUzNzYyNDQzMjUzOTk0Njl9.gYvArMc_HwCt8_bB-nsO6MigweYJkGslSxcQH0AMYTvoXj0TGXiFeGDaGZocw5x3V6fYVpIrcDJ6bX19fEdtvw false}]
I0109 23:11:41.433636       1 provider.go:318] clear unknown user, admin
E0109 23:11:41.433647       1 provider.go:324] user zone not found in user annotations, somedamnthing
time="2026-01-09T23:11:41Z" level=info msg="Storage schema is being checked for updates"
time="2026-01-09T23:11:41Z" level=info msg="Storage schema is already up to date"
time="2026-01-09T23:11:41Z" level=error msg="Failure running the ntp provider startup check: the system clock is not synchronized accurately enough with the configured NTP server" stack="github.com/authelia/authelia/v4/internal/commands/root.go:134 doStartupChecks\ngithub.com/authelia/authelia/v4/internal/commands/root.go:98  (*CmdCtx).RootRunE\ngithub.com/spf13/cobra@v1.6.1/command.go:916                  (*Command).execute\ngithub.com/spf13/cobra@v1.6.1/command.go:1044                 (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.6.1/command.go:968                  (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10       main\ninternal/runtime/atomic/types.go:194                          (*Uint32).Load\nruntime/asm_amd64.s:1700                                      goexit"
time="2026-01-09T23:11:41Z" level=fatal msg="The following providers had fatal failures during startup: ntp" stack="github.com/authelia/authelia/v4/internal/commands/root.go:142 doStartupChecks\ngithub.com/authelia/authelia/v4/internal/commands/root.go:98  (*CmdCtx).RootRunE\ngithub.com/spf13/cobra@v1.6.1/command.go:916                  (*Command).execute\ngithub.com/spf13/cobra@v1.6.1/command.go:1044                 (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.6.1/command.go:968                  (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10       main\ninternal/runtime/atomic/types.go:194                          (*Uint32).Load\nruntime/asm_amd64.s:1700                                      goexit"

[cringdahl]

I was able to work past this by adding an NTP max_desync to the authelia-configs configMap.

Authelia documentation mentions adding:

ntp:
  max_desync: '20s'

to their configuration yaml.

I ran kubectl edit cm authelia-configs -n os-framework, and changed the fourth line:

apiVersion: v1
data:
  configuration.yaml: "jwt_secret: XXXxxxXXXxxxXXX\nprobe_secret: xxxXXXxxxXXXxxx\ndefault_redirection_url:
    /\nntp:\n  max_desync: '20s'\nserver:\n  host: 0.0.0.0\n  port: 9091\n  buffers:\n    # at the beginning of this line here
# ...

I then restarted the deployment:

root@terminus:~# kubectl rollout restart deployment/authelia-backend -n os-framework

Then finally Ctrl-C'd once past the health check, which dropped the old replicaset, found the new one, saw it up, flagged WaitServicesReady as a success, and completed the wizard.

I'm not sure if a lower value would have worked, I started high to get it working. I'm not sure how this would (or should) translate to a code fix, not sure how many others see this problem or what caused it.

[eball]

Thank you for your interest in Olares and for debugging deeply. There are many time-based features in Olares, so we need make sure the time synchronized in the system not only Authelia

You can refer to the post below to configure your NTP configuration in Windows
#2161 (comment)

[cringdahl]

Thanks for getting back to me on this.

You can refer to the post below to configure your NTP configuration in Windows #2161 (comment)

so i had to shutdown the WSL:

wsl --shutdown

then:

timedatectl status
System clock synchronized: yes
NTP service: active

if System clock synchronized: No

have to check the time on the Windows PC and update, then:

olares-cli uninstall --all

then

curl -fsSL https://olares.sh/ | bash -

this should solve the issue on the WSL installation.

I'm afraid I didn't really understand the instructions in the comment:

• you can't run timedatectl after you shutdown WSL
• is there more to the Windows end than just 'check the time'?
• is the 'olares-cli' portion in the WSL? if so, is this just installing inside a half empty WSL share?

[dkeven]

you can't run timedatectl after you shutdown WSL

This is a precise question, I think what the comment means is to shutdown and restart the WSL instance, and check the time synchronization after that

is there more to the Windows end than just 'check the time'?

A manual time synchronization in the Windows settings is normally needed.

is the 'olares-cli' portion in the WSL? if so, is this just installing inside a half empty WSL share?

Yes, exactly. Installing Olares on WSL is only supposed for experiment purposes, and the installation program for Windows is simply a wrapper to boot up WSL instance, configure firewall settings, and call the olares-cli program for Linux inside the WSL instance. So users are free to execute olares-cli to uninstall and reinstall Olares inside the WSL.