Kyvernon

Compatibility

vSphere API compatibility

Kyvernon serves the VMware vSphere API endpoints. Tools that use these APIs connect to Kyvernon with their existing configuration.

How a request from an existing tool reaches Kyvernon A tool sends a request to one of four endpoints: SOAP /sdk, REST /api, files /folder or OVF /nfc. Each facade translates the request into native API calls and the answer back into the wire format the tool expects. The conformance harness runs the real tools against the facades and produces the published conformance report. Tool PowerCLI script Connect-VIServer Get-VM New-Snapshot Session cookie, managed object references and task objects in the form the tool expects Facades SOAP /sdkvim25, property collector REST /api, /restAutomation API, tagging Files /folderDatastore upload, download OVF /nfcHttpNfcLease import, export Translation Schema and types Derived from the govmomi bindings bindings only Mapping Datastore to storage pool Port group to segment CBT to change tracking Privilege ids kept Kyvernon Native API Single entry point Control plane Tasks, events, audit Hosts Kyvernon VMM in Rust Conformance harness Runs govc, PowerCLI, the Terraform provider, the Ansible collection, a Zabbix template, Prometheus exporters and recorded vcsim sessions against the facades. The result per release is the public conformance report: methods, properties, tools.

Supported protocols

ProtocolEndpointTypical clients
SOAP web service (vim25)/sdkPowerCLI, govc, Terraform vsphere provider, Ansible community.vmware, Zabbix, Prometheus exporters, backup software
REST automation API/api, /restPowerCLI, tagging, content libraries, scripts
Datastore file access/folderISO upload, VMDK and OVF transfer
OVF transfer/nfcOVA and OVF import and export, Terraform, Packer

Sessions, managed object references, tasks, property paths and privilege identifiers use the formats the vSphere clients expect.

Verified tools

Tools that ran against Kyvernon without changes to their configuration, with the operations recorded in the conformance report. Known gaps are listed per tool in the report.

ToolStatus
govcVerified
Terraform vSphere providerVerified
PowerCLIVerified
Ansible VMware collectionsVerified
Telegraf vSphere inputVerified
Zabbix VMware monitoringNot yet verified
Prometheus vmware_exporterNot yet verified

API coverage

Kyvernon implements 196 of the 972 methods of the vim25 SOAP API, together with the REST automation, datastore and OVF surfaces. The set covers the operations that the verified tools use. Every other method returns a NotSupported fault, so a tool that calls it fails visibly. The list of implemented methods is generated from the handler table of each release.

Tool categories

CategoryExamples
AutomationPowerCLI, govc, Terraform, Ansible, Packer, pyvmomi
MonitoringZabbix, Prometheus exporters, Nagios and Icinga checks, Grafana
Inventory and CMDBServiceNow discovery, NetBox and other collectors
Configuration assessmentCompliance scanners reading host and VM settings
Self-service portalsCloud management platforms using SOAP or REST
BackupSee below

Conformance reports

Each release includes a conformance report with:

Only tools listed in the report are stated as supported.

Backup software

Backup products on vSphere use the API for snapshots and changed block tracking, and the VDDK library for disk access. Kyvernon implements the API functions. Disk access is provided through the Kyvernon backup API: an NBD export of a consistent snapshot with changed-block information.

zekura.eu supports the Kyvernon backup API. Other backup products are listed as supported after verification with the vendor.

Cloud images

Linux cloud images that include cloud-init are personalised with the extraConfig keys the cloud-init VMware datasource reads: guestinfo.userdata, guestinfo.metadata and guestinfo.vendordata, each with an optional .encoding of base64 or gzip+base64. Kyvernon passes the data to the guest as a read-only cloud-init NoCloud disk. The keys set by the Terraform extra_config argument, govc vm.change -e or PowerCLI advanced settings work without changes. Invalid data fails the task that sets it, with the key named.

Product identification

The about information reports Kyvernon as product and GoTrust as vendor. For tools that require vCenter identification strings, a per-tool setting is available. The setting is off by default and recorded in the audit log.

Terminology

The web UI can show the vSphere term next to each Kyvernon term. The setting is per user.

KyvernonvSphere
Management domainvCenter Server instance
DatastoreDatastore
Resource groupResource pool
Network segmentPort group
Host switch, distributed switchStandard switch, distributed switch
Change trackingChanged Block Tracking
SchedulerDRS
Live migrationvMotion, Storage vMotion
Guest agentVMware Tools

Not included