Sankofa/docs/proxmox/CRITICAL_AUTHENTICATION_FIX.md

# Critical Authentication Fix Required

**Date**: 2025-12-13  
**Status**: ⚠️ **CRITICAL ISSUE IDENTIFIED - FIX APPLIED TO CODE**

---

## Problem

The provider is experiencing authentication failures when using token-based authentication:

```
ERROR: authentication failed: 401 authentication failure
```

**Root Cause**: The controller uses `proxmox.NewClient()` (username/password authentication) even when a token is provided. Proxmox API tokens require `proxmox.NewClientWithToken()` instead.

---

## Fix Applied

### Code Changes

**File**: `crossplane-provider-proxmox/pkg/controller/virtualmachine/controller.go`

#### 1. Updated `credentials` struct to include `Token` field:

```go
type credentials struct {
	Username string
	Password string
	Token    string  // Added
}
```

#### 2. Updated `getCredentials()` to properly detect and store tokens:

```go
// Check if we have token-based authentication
if tokenData, ok := secret.Data["token"]; ok {
	// Token-based authentication
	token = string(tokenData)
	if tokenidData, ok := secret.Data["tokenid"]; ok {
		username = string(tokenidData)
	} else {
		return nil, fmt.Errorf("tokenid missing in secret (required for token authentication)")
	}
} else {
	// Username/password authentication
	if userData, ok := secret.Data["username"]; ok {
		username = string(userData)
	}
	if passData, ok := secret.Data["password"]; ok {
		password = string(passData)
	}
}
```

#### 3. Updated client creation to use token authentication when available:

```go
// Create Proxmox client - use token authentication if token is available
var proxmoxClient *proxmox.Client
if creds.Token != "" {
	// Use token authentication: format is "tokenid=token"
	token := fmt.Sprintf("%s=%s", creds.Username, creds.Token)
	proxmoxClient, err = proxmox.NewClientWithToken(
		site.Endpoint,
		token,
		site.InsecureSkipTLSVerify,
	)
} else {
	// Use username/password authentication
	proxmoxClient, err = proxmox.NewClient(
		site.Endpoint,
		creds.Username,
		creds.Password,
		site.InsecureSkipTLSVerify,
	)
}
```

#### 4. Updated cleanup function to use token authentication:

```go
if creds.Token != "" {
	// Use token authentication
	token := fmt.Sprintf("%s=%s", creds.Username, creds.Token)
	client, err = proxmox.NewClientWithToken(
		site.Endpoint,
		token,
		site.InsecureSkipTLSVerify,
	)
} else {
	// Use username/password authentication
	client, err = proxmox.NewClient(
		site.Endpoint,
		creds.Username,
		creds.Password,
		site.InsecureSkipTLSVerify,
	)
}
```

---

## Build and Deploy

### Prerequisites

- Go 1.21+ installed
- Make installed
- Docker (for building container image)

### Build Steps

```bash
cd crossplane-provider-proxmox

# Generate manifests
make manifests

# Build the provider
make build

# Build container image
docker build -t crossplane-provider-proxmox:latest .

# Load image into kind (if using kind)
kind load docker-image crossplane-provider-proxmox:latest

# Restart provider pod
kubectl delete pod -n crossplane-system -l app=crossplane-provider-proxmox
```

---

## Verification

After deploying the fix:

1. **Check provider logs**:
   ```bash
   kubectl logs -n crossplane-system -l app=crossplane-provider-proxmox -f
   ```

2. **Verify authentication**:
   - No more "401 authentication failure" errors
   - VMs start being created successfully

3. **Check VM status**:
   ```bash
   kubectl get proxmoxvm -A
   ```

---

## Impact

**Before Fix**:
- ❌ All VMs fail to authenticate
- ❌ No VMs can be created
- ❌ Provider logs show repeated authentication errors

**After Fix**:
- ✅ Token authentication works correctly
- ✅ VMs can be created on both Proxmox nodes
- ✅ No authentication errors in logs

---

## Current Status

- ✅ **Code Fix**: Applied to `controller.go`
- ⚠️ **Build Required**: Provider needs to be rebuilt and redeployed
- ⚠️ **Deployment**: Provider pod needs to be restarted after rebuild

---

**Last Updated**: 2025-12-13  
**Priority**: 🔴 **CRITICAL** - Blocks all VM deployments