[PDM 1.1.7] Questions re: Multiple Endpoints for the Same Node (Single-Node Remote)

[SInisterPisces]

Hello,

Using ACME with the Cloudflare DNS plugin, I've configured a PVE node with a Let's Encrypt certificate for pve-host.mydomain.com.
So, adding that PVE node as a single-node remote to PDM was really easy; I didn't have to worry about fingerprints at all.

Except, I still want PDM to be able to talk to the PVE node even if DNS is fried.
Under Remotes > Configuration, under the pve-host remote, I can Edit to add what the Edit window calls Endpoints, but the Remotes > Configuration page calls Nodes. (I think Endpoints is more correct, as a single PVE host can have multiple entries in the list).

Is adding a second endpoint with the IP address of the pve-host.mydomain.com endpoint the correct way to make sure that PDM can access the node even when DNS resolution isn't working?
I'm not sure, since the default is to use the first endpoint, and it doesn't mention anything about failover.
Does it support failover in the event the first endpoint times out?


Aside: I'm using the fingerprint from the PVE node's self-signed certificate for the IP address (not shown). That's probably fine?

If PDM doesn't yet support failover in the event of a DNS failure (or rather, a timeout on the first endpoint), I'll remove the second entry and open an enhancement request.

 

[n.frey]

Hi,

While I personally thought that the multiple endpoints were only for clusters (i.e. 3 endpoints for 3 nodes in a cluster), I tested it out myself and IMO nothing speaks against using it this way.

PDM has it's own failover mechanism to make sure the cluster can still be accessed if e.g. one of the nodes is down. It will probe which nodes on a cluster are reachable, but technically that mechanism does not care if those endpoints all point to the exact same node or if it's all separate nodes.

I'm using the fingerprint from the PVE node's self-signed certificate for the IP address (not shown). That's probably fine?

Yes, that's actually needed in order to establish the SSL connection to the remote (if it's not a CA-signed cert).

 

[SInisterPisces]

[…] While I personally thought that the multiple endpoints were only for clusters (i.e. 3 endpoints for 3 nodes in a cluster), I tested it out myself and IMO nothing speaks against using it this way.

PDM has it's own failover mechanism to make sure the cluster can still be accessed if e.g. one of the nodes is down. It will probe which nodes on a cluster are reachable, but technically that mechanism does not care if those endpoints all point to the exact same node or if it's all separate nodes.
[…]

Thanks for testing it out and for the additional info.

Right now, I'm testing it with a single Remote that contains a single node, so there's not really an alternative path to a second node if the first one becomes unreachable. I have occasionally borked my DNS, which is what got me thinking about using multiple endpoints even on a single-node cluster.

How does the failover mechanism work? Would it actually be able to find a way to access a cluster that only defines a single hostname endpoint even if DNS went down? I might be over-complicating it for no reason.

 

[n.frey]

IIRC, the failover takes all the remotes' node URLs, probes the connection to them and uses the next-best if one of them happens to fail the probe. PDM can only fall back if two or more node URLs are specified in a cluster.

 

[SInisterPisces]

IIRC, the failover takes all the remotes' node URLs, probes the connection to them and uses the next-best if one of them happens to fail the probe. PDM can only fall back if two or more node URLs are specified in a cluster.

Thanks again.

Just to be explicit for anyone who finds this later (and also for me, who managed to confuse myself after marking this as SOLVED), for the IP/fingerprint-based endpoints, the fingerprint is from pve-ssl.pem, correct?

On my nodes, when a proper Let's Encrypt certificate is set up for a local domain set up with the ACME plugin (pve.mydomain.com), the certificate associated with that is pveproxy-ssl.pem. That has a different fingerprint.

Or, should I just use the LE cert's fingerprint for all the endpoints?