Sankofa/docs/proxmox/CRITICAL_AUTHENTICATION_FIX.md

Critical Authentication Fix Required

Date: 2025-12-13
Status: ⚠️ CRITICAL ISSUE IDENTIFIED - FIX APPLIED TO CODE

---

Problem

The provider is experiencing authentication failures when using token-based authentication:

ERROR: authentication failed: 401 authentication failure

Root Cause: The controller uses proxmox.NewClient() (username/password authentication) even when a token is provided. Proxmox API tokens require proxmox.NewClientWithToken() instead.

---

Fix Applied

Code Changes

File: crossplane-provider-proxmox/pkg/controller/virtualmachine/controller.go

1. Updated credentials struct to include Token field:

type credentials struct {
	Username string
	Password string
	Token    string  // Added
}

2. Updated getCredentials() to properly detect and store tokens:

// Check if we have token-based authentication
if tokenData, ok := secret.Data["token"]; ok {
	// Token-based authentication
	token = string(tokenData)
	if tokenidData, ok := secret.Data["tokenid"]; ok {
		username = string(tokenidData)
	} else {
		return nil, fmt.Errorf("tokenid missing in secret (required for token authentication)")
	}
} else {
	// Username/password authentication
	if userData, ok := secret.Data["username"]; ok {
		username = string(userData)
	}
	if passData, ok := secret.Data["password"]; ok {
		password = string(passData)
	}
}

3. Updated client creation to use token authentication when available:

// Create Proxmox client - use token authentication if token is available
var proxmoxClient *proxmox.Client
if creds.Token != "" {
	// Use token authentication: format is "tokenid=token"
	token := fmt.Sprintf("%s=%s", creds.Username, creds.Token)
	proxmoxClient, err = proxmox.NewClientWithToken(
		site.Endpoint,
		token,
		site.InsecureSkipTLSVerify,
	)
} else {
	// Use username/password authentication
	proxmoxClient, err = proxmox.NewClient(
		site.Endpoint,
		creds.Username,
		creds.Password,
		site.InsecureSkipTLSVerify,
	)
}

4. Updated cleanup function to use token authentication:

if creds.Token != "" {
	// Use token authentication
	token := fmt.Sprintf("%s=%s", creds.Username, creds.Token)
	client, err = proxmox.NewClientWithToken(
		site.Endpoint,
		token,
		site.InsecureSkipTLSVerify,
	)
} else {
	// Use username/password authentication
	client, err = proxmox.NewClient(
		site.Endpoint,
		creds.Username,
		creds.Password,
		site.InsecureSkipTLSVerify,
	)
}

---

Build and Deploy

Prerequisites

• Go 1.21+ installed
• Make installed
• Docker (for building container image)

Build Steps

cd crossplane-provider-proxmox

# Generate manifests
make manifests

# Build the provider
make build

# Build container image
docker build -t crossplane-provider-proxmox:latest .

# Load image into kind (if using kind)
kind load docker-image crossplane-provider-proxmox:latest

# Restart provider pod
kubectl delete pod -n crossplane-system -l app=crossplane-provider-proxmox

---

Verification

After deploying the fix:

1. Check provider logs:

   kubectl logs -n crossplane-system -l app=crossplane-provider-proxmox -f
   

2. Verify authentication:

   • No more "401 authentication failure" errors
   • VMs start being created successfully

3. Check VM status:

   kubectl get proxmoxvm -A
   

---

Impact

Before Fix:

• ❌ All VMs fail to authenticate
• ❌ No VMs can be created
• ❌ Provider logs show repeated authentication errors

After Fix:

• ✅ Token authentication works correctly
• ✅ VMs can be created on both Proxmox nodes
• ✅ No authentication errors in logs

---

Current Status

• ✅ Code Fix: Applied to controller.go
• ⚠️ Build Required: Provider needs to be rebuilt and redeployed
• ⚠️ Deployment: Provider pod needs to be restarted after rebuild

---

Last Updated: 2025-12-13
Priority: 🔴 CRITICAL - Blocks all VM deployments