Cluster Manager "LXD UI" link points to a single member's internal address — No existing path to advertise an HA/load-balancer URL

[riancasi]

The "LXD UI" button on the Cluster Manager's cluster details page links to the first cluster member's internal cluster address (the cluster.https_address visible in lxc cluster list). This was found while running MicroCloud demo environments on GCP, where each cluster sits behind a TCP load balancer with a static address across all members (the address operators actually use), but the button links to one member's private IP instead.

Tracing the behavior, the value appears to originate in the connector's status heartbeat: enrichClusterMemberMetrics in cmd/microcloudd/cluster_manager_task.go sets ui_url from lxdMembers[0].URL, and the Cluster Manager stores and renders it as-is (in microcloud-cluster-manager: RemoteClusterStatusPost → remote_cluster_detail.go, refreshed on each heartbeat → ClusterUiButton.tsx). No configuration point was found along that path where an operator-supplied URL could be provided.

Concerns related to current limitations:

1. HA: production deployments front the UI with a VIP/load balancer across all members. Linking to one specific member means the button dies when that member is down for maintenance, even though the cluster and its LB remain healthy.

2. TLS: a member's private IP cannot carry the certificate an operator has issued for their DNS-named LB endpoint, so the link always produces browser warnings, even when the deployment has a perfectly clean HTTPS entry point.

3. Segmented networks: deployments that keep cluster-internal addresses on an isolated management network (exposing only the LB/DNS endpoint to operators) end up with a link that isn't reachable from the browsers meant to use it.

Request: a way to set the UI URL a cluster reports to the Cluster Manager, for example the load balancer's address or DNS name. If nothing is set, the current behavior stays the default. This could potentially be implemented in a preseed field or join field, or another mechanism that would work best.

[edlerd]

Thanks for reporting the issue @riancasi !

We plan to allow a manual override of the LXD-UI URL within the cluster manager UI for a registered cluster. Do you think that will resolve the problem correctly, or would you want to set the external LXD-UI URL at a different point?

Ideally I'd want a configuration-less solution. But the problem with an automated solution is that I don't see a way for the cluster to know if an external load balancer is configured and what its name is.

@tomponline or @roosterfish can you please move this issue to https://github.com/canonical/microcloud-cluster-manager/issues ?

[edlerd]

Slightly changing the plan above after some discussions to the following:

We will add an option to set the external URL in MicroCloud via CLI.
It will be similar to microcloud cluster-manager set lxd-ui-url https://example.org/lxd-ui. The exact terminology still has to be agreed upon. That way the cloud owns the authority over how its ingress to the LXD-UI is configured.

Microcloud reports the LXD-UI URL as the first cluster member's URL. But we allow overriding it in Microcloud CLI to set a custom LXD-UI as described above. If the custom URL is set, then the heartbeat will include that custom URL.

Cluster manager does not need updating. It will receive the correct URL in either case.

[riancasi]

Thanks @edlerd! The CLI override approach sounds great and should cover the cases mentioned. Happy to test it again once these changes are available👍