Backup software and the vSphere API
Which parts of the vSphere backup workflow Kyvernon serves, how the disk data is read instead, and how backup software integrates.
Backup products for vSphere use the API for snapshots and change tracking, and a separate transport library to read the disk data. Kyvernon serves the API functions. The disk data is read through the NBD export of the Kyvernon backup API, over TLS, and no transport library of another vendor is involved.
Before you start
- Turn the compatibility endpoints on: Settings of the compatibility endpoints.
- Decide whether the product integrates with the Kyvernon backup API. That is the supported route. No third-party backup product is in the list of verified tools.
What the vSphere API serves
| vSphere function | In Kyvernon |
|---|---|
Change tracking of a virtual machine (changeTrackingEnabled) | Set through ReconfigVM_Task; it is the change_tracking setting of the virtual machine |
CreateSnapshot_Task, CreateSnapshotEx_Task, RemoveSnapshot_Task, RevertToSnapshot_Task | Served. A snapshot taken for backup appears in the snapshot tree |
QueryChangedDiskAreas with the change id * | Answers the whole disk from the given offset: a complete full backup, possibly larger than the allocated area |
QueryChangedDiskAreas with a change id of an earlier snapshot | Forwarded to the host, which resolves it; a stale or unknown change id fails |
| Reading the disk through the transport library of the vendor | Not provided. Read the disk through the NBD export of the backup API |
| The proprietary transfer service of the source platform on a TCP port | Not served. The OVF transfer at /nfc is served over HTTP |
With the API
The backup API gives what the vSphere workflow needs, in one interface: a backup point without a snapshot in the snapshot tree, the changed areas per disk, a read-only NBD export with TLS 1.3 and a certificate fingerprint to pin, and a restore into a new disk. The semantics of change ids and changed areas follow the vSphere workflow, so incremental logic of existing products maps over with little change. See Backup concepts and Back up a virtual machine.
For a product that must stay on the vSphere API for snapshots and change ids, the disk read still goes through the NBD export, so the product needs a Kyvernon reader for the data path. A product is stated as supported only when it appears in the list of verified tools.
Related
Version 0.1. Last changed: 2026-11-13