Console access from behind an LB

[krustymonkey]

HI all, I'm fairly new to Proxmox and I've got a question around how others are managing clusters behind a load balancer. Specifically, below is my setup.

I'm running haproxy as an LB, which also terminates the incoming SSL connections with a valid cert (pmx.example.com) and then proxies the connection to one of the 3 backend proxmox cluster servers (pmx-01 - pmx-03). Everything regarding this works great, with one exception. The exception is when I try to open a console connection, which will fail unless my die roll between which of the 3 pmx nodes happens to match the node that the VM is running on. Now, there's a pretty easy workaround for this, which is just connecting directly to the node running the VM instance I want to console to, then hitting the Console button there. While it's easy, it's also annoying.

So, the question is: How have others solved this particular problem? I'm open to ideas for hacks here too.

 

[psalkiewicz]

Hi. The console issue happens because Proxmox's noVNC/SPICE console connections use a ticket-based system where the ticket is issued by and valid only on the specific node running the VM. So when HAProxy routes your initial API/UI request to node A but the console WebSocket connection lands on node B or C, the ticket is rejected.

You can route console traffic to the correct node. Proxmox's console URLs contain the node name in the path, e.g.:
/api2/json/nodes/pmx-01/qemu/100/vncproxy

You can write HAProxy ACLs to parse the node name out of the URL path and route accordingly:

backend proxmox_nodes
    use-server pmx-01 if { path_reg -i /nodes/pmx-01/ }
    use-server pmx-02 if { path_reg -i /nodes/pmx-02/ }
    use-server pmx-03 if { path_reg -i /nodes/pmx-03/ }
    balance leastconn

server pmx-01 192.168.1.1:8006 check ssl verify none
server pmx-02 192.168.1.2:8006 check ssl verify none
server pmx-03 192.168.1.3:8006 check ssl verify none