-
fix(connectors): self-heal a Proxmox connector whose secret can't be decrypted after a JWT-secret rotation
Release / version (push) Canceled after 0sRelease / frontend (push) Canceled after 0sRelease / linux (amd64) (push) Canceled after 0sRelease / linux (arm64) (push) Canceled after 0sRelease / windows (push) Canceled after 0sRelease / macos (push) Canceled after 0sRelease / release (push) Canceled after 0sBuild and Push Docker Image / build-and-push (push) Canceled after 0sLastSkywalker released this
2026-06-21 13:38:17 +03:00 | 114 commits to main since this releaseThe connector token is AES-GCM encrypted under the cluster JWT secret. When that
secret rotates (e.g. across a wipe-state recovery or re-setup) the stored
ciphertext becomes undecryptable and the poller is stuck reporting auth_failed
('cannot decrypt secret (JWT secret changed?)') forever — which freezes the
entire Proxmox topology (hypervisor + every guest) on all nodes.BootstrapProxmoxFromEnv was idempotent on ANY existing connector, so it never
repaired this. Now it skips only a HEALTHY connector (secret decrypts under the
current key); if the secret is undecryptable and env Proxmox creds are present,
it re-creates the connector from env, re-encrypting the token under the current
key (CreateProxmox upserts by fingerprint, so it updates in place). Self-heals
on the next boot — no manual token re-entry.Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01U3LvJu9qZfspPr21TW9ptvDownloads