govc
Set the environment of govc for the controller, the commands that were verified against Kyvernon and the known gaps.
govc connects to the SOAP endpoint at /sdk of the controller. Its datastore commands also use the file endpoint at /folder.
Before you start
- Turn the compatibility endpoints on: Settings of the compatibility endpoints.
- Use the account of a Kyvernon user.
- The controller uses a certificate that govc does not know by default. Give govc the certificate with
GOVC_TLS_CA_CERTS, or accept it for a test withGOVC_INSECURE.
With the CLI
export GOVC_URL=https://controller.example.com:8443/sdk
export GOVC_USERNAME=admin
export GOVC_PASSWORD=<password>
export GOVC_TLS_CA_CERTS=/path/to/controller-ca.pem
govc about
govc ls
govc vm.info prod-web-01Take the password from the secret store of your automation, not from a file in a repository. The first certificate of a controller with [tls] mode = "self_signed" is /var/lib/kyvernon/controller/tls/bootstrap-cert.pem on the controller.
Verified commands
These commands ran against Kyvernon without a change of their arguments. The complete list with the result of each is in verified tools.
| Area | Commands |
|---|---|
| Connection | about, about.cert, session.ls, session.logout |
| Inventory | ls, find, datacenter.info, host.info, cluster.ls, datastore.info, datastore.ls, network.ls, host.vswitch.info, host.portgroup.info, object.collect, object.save |
| Virtual machines | vm.create, vm.info, vm.change, vm.power, vm.clone, vm.markastemplate, vm.markasvm, vm.destroy, vm.option.info |
| Devices | vm.disk.create, vm.network.add, device.ls, device.cdrom.add, device.serial.add, device.serial.remove |
| Snapshots | snapshot.create, snapshot.tree, snapshot.revert, snapshot.remove |
| Folders | folder.create and object.destroy of a folder |
| Statistics | metric.ls, metric.sample for virtual machines and hosts |
| Tasks and events | tasks, events, alarm.info |
| Roles and permissions | role.ls, permissions.ls, fields.ls, option.ls |
| Tags | tags.category.create, tags.create, tags.attach, tags.attached.ls, tags.detach, tags.rm, tags.category.rm |
The datastore commands datastore.upload, datastore.download, datastore.mkdir and datastore.rm use the file endpoint, and datastore.cp of a disk file works as a file copy on the datastore.
Known gaps
No command of the recorded verification failed. A command that needs a method that Kyvernon does not serve fails with a NotSupported fault. For example, vm.power -s and vm.power -r call ShutdownGuest and RebootGuest, which are not served; use vm.power -off, or kyvernon vm shutdown <id> for a graceful shutdown. The package import commands import.ova and import.ovf use the import function described in Import an OVA or OVF package; they are not part of the verified list.
Related
Version 0.1. Last changed: 2026-11-13