OKD 4.19-0-okd-scos.15 (SCOS) bootstrap stalls ~57% with CVO “MultipleErrors” on Proxmox UPI (HAProxy + Firewall)

[Kontr3X]

Hi OKD community,

I’m installing OKD 4.19.0-okd-scos.15 (SCOS) in a Proxmox UPI environment and the installation stalls around ~57% with CVO reporting “MultipleErrors”. API becomes reachable during install, then clusterversion progresses and eventually fails. I’d appreciate help to identify the root cause.

Environment

• Hypervisor: Proxmox VE (QEMU/KVM), nodes as VMs (VirtIO disk, VirtIO NIC)
• Network: OPNsense (provides also DNS) with HAProxy (TCP 6443/22623 on API-VIP 192.168.50.10; HTTP 80 and TCP 443 on Ingress-VIP 192.168.50.6)
• DNS: Unbound on OPNsense
  • api / api-int: 192.168.50.10
  • bootstrap: 192.168.50.14
  • masters: 192.168.50.11/12/13
  • workers: 192.168.50.21/22 (not used during bootstrap)
  • *.apps prod02.okd.core.eu-north.local.: 192.168.50.6 (local-zone redirect)
  • Reverse PTRs for all nodes set
  • _etcd-server-ssl._tcp SRV records point to master-0/1/2:2380
• VIPs on OPNsense as IP alias on LAN interface
• Internet egress allowed (quay/ghcr reachable)
• Time sync: chrony on all nodes
• Kustomize Version: v5.5.0
• Kubernetes Version: v1.32.7-dirty

Installer Config (sanitized)

• baseDomain: okd.core.eu-north.local.
• metadata.name: prod02
• controlPlane: 3x master, architecture amd64
• compute: 0 workers (to be added later)
• networking: OVNKubernetes, service 172.30.0.0/16, cluster 10.128.0.0/14, machineNetwork 192.168.50.0/24
• platform: none
• sshKey:
• pullSecret:

What I see

• openshift-install wait-for bootstrap-complete reaches API, then oc get clusterversion shows progress (e.g. “526 of 921”), later fails with:
  Unable to apply 4.19.0-okd-scos.15: an unknown error has occurred: MultipleErrors
• HAProxy frontends are OPEN; backends to masters are DOWN until their services come up (expected early on), bootstrap:6443 was added during bootstrap.
• SSH to bootstrap/master is possible.
• The Image may be not available in the

What I already checked

• Firewall settings / network traffic
• DNS A/PTR/SRV (dig outputs OK)
• VIP binding and backend modes (tcp 6443/22623/443, http 80)
• NTP time in sync
• pending crt requests
• extracted current stable via "oc adm release extract --tools quay.io/okd/scos-release:4.19.0-okd-scos.15"
• CoreOS stream (installed via liveos iso) matches installer (print-stream-json)

The looks just flootet for me, screenshots

Questions

1. Known issues/workarounds with 4.19.0-okd-scos.15 on SCOS/FCOS 42 in UPI?
2. Which components typically raise CVO MultipleErrors at ~50–60% during initial apply?
   3.) Which other version is up-to-date and should work today/now stable in my environment?

This was one of the most difficult implementations I have ever attempted – Vanilla Kubernetes was significantly easier – and for a community edition of a commercial platform, this level of fragility and operational complexity seems inappropriate to me. Few users (especially developers) will have the patience or expertise to navigate it. OpenShift Local was unstable for me (often crashing after a simple restart), and despite trying versions 4.15, 4.17 and 4.19 (with and without UEFI.. etc.), none of the variants are currently working.

Thanks a lot!