Console not working when using round-robin domain

[voydus]

Hey everyone

We are having this issue since I've joined my org and none of us have a clue

Our Setup:
- Three node cluster (pve01.domain, pve02.domain and pve03.domain)
- Round-robin dns pve.domain which returns all three IPs
- We use yubikeys with webauthn, which forces us to use the round-robin domain

Problem:
- Trying to open the console fails with "Failed to connect to server"
- System logs show: pveproxy[1297551]: connect to 'localhost:5901' failed: Connection refused at /usr/share/perl5/PVE/APIServer/AnyEvent.pm line 541.

When I access the cluster through one of the direct domain names, it works and I see this in the journal:

pvedaemon[1523719]: starting vnc proxy UPIDve01:some-numbers:that-i-dont-know:if-they-are-secret:vncproxy:102:my.user@pve:
pvedaemon[1157582]: <my.user@pve> starting task UPIDve01:same-numbers-again:vncproxy:102:my.user@pve:

This is not really too bad, but it's annoying and I fear it might be indicative of some misconfiguration that could affect more things.

We're (sadly still) using VE 7.1-8

 

[innerhippy]

Hey everyone

We are having this issue since I've joined my org and none of us have a clue

Our Setup:
- Three node cluster (pve01.domain, pve02.domain and pve03.domain)
- Round-robin dns pve.domain which returns all three IPs
- We use yubikeys with webauthn, which forces us to use the round-robin domain

Problem:
- Trying to open the console fails with "Failed to connect to server"
- System logs show: pveproxy[1297551]: connect to 'localhost:5901' failed: Connection refused at /usr/share/perl5/PVE/APIServer/AnyEvent.pm line 541.

When I access the cluster through one of the direct domain names, it works and I see this in the journal:

pvedaemon[1523719]: starting vnc proxy UPIDve01:some-numbers:that-i-dont-know:if-they-are-secret:vncproxy:102:my.user@pve:
pvedaemon[1157582]: <my.user@pve> starting task UPIDve01:same-numbers-again:vncproxy:102:my.user@pve:

This is not really too bad, but it's annoying and I fear it might be indicative of some misconfiguration that could affect more things.

We're (sadly still) using VE 7.1-8

I have exactly the same problem.

 

[cheiss]

DNS round-robin unfortunately won't work, due to the way the API works.

I'd suggest using a proper reverse proxy like e.g. nginx or haproxy, which can handle these situations (keyword: sticky sessions).
We have some documentation for that: https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy
HAProxy works too, the config can be easily adapted from the nginx example.