It might be due to node fencing, when a node hosts HA resources, and it loses corosync quorum for over 50-60 seconds it will fence itself (reboot). If the network becomes unusable from a majority of nodes in the cluster, that would result in the entire cluster rebooting. See [0] for more info about fencing.
As you know corosync is sensitive to latency changes and network stability and therefore needs a dedicated NIC. The dedicated NIC does not need much bandwidth, 1G is usually recommended.
If that's the case, then ensure to follow the below recommendation:
From Proxmox VE 9 documentation [1]:
- Recommended to use a dedicated NIC exclusively for Corosync communication.
- Configure the migration network on a different interface from the Corosync interface:
Datacenter → Options → Migration Settings. Please make sure to read our wiki 5.14.2. Migration Network for more details [2].
- Recommended to give Corosync at least a secondary link for redundancy.
- Recommended to not use a network bond for Corosync's primary link, see [3] for more details.
[0]
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#ha_manager_fencing
[1]
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvecm_cluster_requirements
[2]
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvecm_migration_network
[3]
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvecm_corosync_over_bonds