High Availability for Beginners: Demystifying the HA Stack

High availability is the most misunderstood feature in Proxmox VE. It is frequently configured, rarely tested, and sometimes trusted with workloads it was never designed to protect. Let us strip it back to what actually happens when a node fails.

Quorum is the foundation

A Proxmox VE cluster makes decisions by majority vote, a concept called quorum. Two nodes cannot form a reliable cluster because a network split leaves each side unable to tell whether the other is dead or merely unreachable. That is why we always design for at least three nodes, or two nodes plus a small external quorum device.

The HA stack in plain terms

When a guest is marked as highly available, a component called the resource manager watches it. Each node runs a local resource manager, and a central coordinator decides what should run where. If a node stops responding, the coordinator asks a simple question: can I safely start this guest somewhere else?

The answer is only “yes” if the old node has been fenced — that is, forcibly isolated so it cannot still be running the same guest. Without fencing, you risk two copies of one virtual machine writing to the same disk. This is why a working watchdog and a tested fencing path matter more than any checkbox in the UI.

Design for the failure you can afford

Think in failure domains. If all three nodes share one switch and one power feed, a single failure can take down the entire cluster at once. HA protects you from a node failure, not from a design failure.

Test it or it does not count

A policy that has never survived a real node failure is a hope, not a plan. In our HA deep dive, the final lab is deliberately destructive: we kill nodes, split networks and cut storage, then watch the cluster decide. There is no substitute for seeing the scheduler make its choices under pressure.