slackhq/nebula · critical

no connection manager

Error message

no connection manager

What it means

Sentinel validation error raised in NewInterface when the InterfaceConfig passed in has a nil connectionManager. It is one of five required-component checks (outside connection, tun device, PKI state, firewall rules, connection manager) that guard construction of a Interface; it fires when the caller (Main) built the config without wiring up a connection manager implementation before calling NewInterface. The interface cannot manage peer handshakes/lighthouse traffic without one, so construction is aborted rather than returning a half-initialized Interface.

Source

Thrown at interface.go:198

		return fmt.Sprintf("invalid(%d)", s)
	}
}

func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
	if c.Outside == nil {
		return nil, errors.New("no outside connection")
	}
	if c.Inside == nil {
		return nil, errors.New("no inside interface (tun)")
	}
	if c.pki == nil {
		return nil, errors.New("no certificate state")
	}
	if c.Firewall == nil {
		return nil, errors.New("no firewall rules")
	}
	if c.connectionManager == nil {
		return nil, errors.New("no connection manager")
	}

	if c.routines <= 1 {
		c.PinThreads = false //pinning is not useful unless there's more than one tun reader
	}

	cs := c.pki.getCertState()
	ifce := &Interface{
		ctx:                   ctx,
		pki:                   c.pki,
		hostMap:               c.HostMap,
		outside:               c.Outside,
		inside:                c.Inside,
		firewall:              c.Firewall,
		dnsServer:             c.DnsServer,
		handshakeManager:      c.HandshakeManager,
		createTime:            time.Now(),
		lightHouse:            c.lightHouse,

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Ensure connectionManager := NewConnectionManager(...) is called and assigned to InterfaceConfig before NewInterface
2. Check startup logs for earlier initialization errors that skipped manager creation
3. Update library usage to match current nebula Main() wiring

if cfg.InterfaceConfig.ConnectionManager == nil {
    return errors.New("connection manager missing; call NewConnectionManager before NewInterface")
}

i, err := NewInterface(ctx, c)
if err != nil {
    if err.Error() == "no connection manager" { /* wire NewConnectionManager into the config */ }
    return err
}

When it happens

Trigger: InterfaceConfig.connectionManager is nil because NewConnectionManager was not called or its result was not assigned before NewInterface.

Common situations: Wiring bug when embedding nebula as a library; earlier initialization failure that left the manager nil; partial refactor dropping the field assignment.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• no outside connection
• no inside interface (tun)
• no certificate state
• no firewall rules
• no pki.key path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/4ae2f421f78e9a54. Report an issue: GitHub.