Sankofa/docs/proxmox/AUTHENTICATION_FIX_APPLIED.md

Authentication Fix Applied ✅

Date: 2025-12-13
Status: ✅ AUTHENTICATION FIX APPLIED

---

Issue Identified

Problem

• Symptom: "401 permission denied - invalid PVE ticket" errors
• Impact: All node health checks failing, VM creation blocked
• Root Cause: Cookie header format issue

Analysis

The token authentication was using req.AddCookie() which automatically URL-encodes cookie values. However, Proxmox API expects the exact token format tokenid=token-secret without URL encoding.

---

Fix Applied

Code Change

File: crossplane-provider-proxmox/pkg/proxmox/http_client.go

Before:

if c.token != "" {
    req.AddCookie(&http.Cookie{
        Name:  "PVEAuthCookie",
        Value: c.token,
    })
}

After:

if c.token != "" {
    // Token authentication - Proxmox API tokens use Cookie header
    // Use Set() instead of AddCookie() to avoid automatic URL encoding issues
    // Proxmox expects the exact token format: "tokenid=token-secret"
    req.Header.Set("Cookie", fmt.Sprintf("PVEAuthCookie=%s", c.token))
}

Why This Fix Works

1. AddCookie(): Automatically URL-encodes cookie values, which can break the token format
2. Header.Set(): Sets the Cookie header directly without encoding, preserving the exact token format
3. Proxmox API: Expects PVEAuthCookie=tokenid=token-secret exactly as provided

---

Verification

Build and Deployment

• ✅ Code updated
• ✅ Provider rebuilt
• ✅ Image loaded into kind cluster
• ✅ Provider pod restarted

Expected Results

• ✅ No "invalid PVE ticket" errors
• ✅ Node health checks succeed
• ✅ VM creation proceeds

---

Monitoring

Check Authentication Status

# Check for authentication errors (should be 0)
kubectl logs -n crossplane-system -l app=crossplane-provider-proxmox --since=5m | grep -i "invalid PVE ticket" | wc -l

# Check for successful operations
kubectl logs -n crossplane-system -l app=crossplane-provider-proxmox --since=5m | grep -i "node.*healthy\|node.*online" | wc -l

Monitor VM Creation

# Watch all VMs
kubectl get proxmoxvm -A -w

# Check VM creation progress
kubectl get proxmoxvm -A -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.vmId}{"\n"}{end}' | grep -v "\t$"

---

Summary

✅ Authentication Fix Applied:

• Changed from AddCookie() to Header.Set() for Cookie header
• Preserves exact token format required by Proxmox API
• Provider rebuilt and restarted

Status: ✅ FIX APPLIED - VERIFYING RESULTS

---

Last Updated: 2025-12-13
Status: ✅ AUTHENTICATION FIX APPLIED