Kyvernon

How-to For: developers

PowerCLI

Connect PowerCLI to the controller, the cmdlets that were verified against Kyvernon and the known gaps.

PowerCLI connects to the SOAP endpoint of the controller and, for tags, to the token service and the REST endpoint. The recorded verification used PowerShell 7.6.9 with VMware.PowerCLI 13.3.0.24145083.

Before you start

  • Turn the compatibility endpoints on: Settings of the compatibility endpoints.
  • Use the name or address of the controller, port 8443, and the account of a Kyvernon user.
  • The controller uses a certificate that PowerCLI does not know by default. Trust the certificate on the machine that runs PowerCLI. For a test you can accept it for the session with -InvalidCertificateAction Ignore. Behind a proxy with another certificate, set trust_certificate_file on the controller, because PowerCLI pins the token service to the certificate that the lookup service publishes.

With the CLI

PowerShell
Set-PowerCLIConfiguration -Scope Session -InvalidCertificateAction Ignore -Confirm:$false
$cred = Get-Credential
Connect-VIServer -Server controller.example.com -Port 8443 -Credential $cred
Get-VMHost
Get-VM
Disconnect-VIServer -Confirm:$false

The objects of the inventory have the ids and names that the console shows. Privileges of the account apply to every cmdlet.

Verified cmdlets

These cmdlets ran against Kyvernon without a change of their parameters. The complete list with the result of each is in verified tools.

AreaCmdlets
ConnectionConnect-VIServer, Disconnect-VIServer, the About information of the server
InventoryGet-Datacenter, Get-Cluster, Get-VMHost, Get-Datastore, Get-VirtualPortGroup, Get-ResourcePool, Get-Folder, Get-VM, Get-Template, Get-View of a host
Virtual machinesNew-VM, Set-VM (CPU, memory, notes), Start-VM, Stop-VM (hard), Remove-VM, New-VM -VM (clone), Set-VM -ToTemplate, Set-Template -ToVM
HardwareGet-NetworkAdapter, New-NetworkAdapter, Get-HardDisk, New-HardDisk, New-CDDrive, New-AdvancedSetting (extra configuration)
SnapshotsNew-Snapshot, Get-Snapshot, Set-VM -Snapshot (revert), Remove-Snapshot
FoldersNew-Folder, Remove-Folder
StatisticsGet-Stat for virtual machines and hosts
Events and tasksGet-VIEvent, Get-Task
Roles and permissionsGet-VIRole, Get-VIPermission
TagsNew-TagCategory, Get-TagCategory, New-Tag, Get-Tag, New-TagAssignment, Get-TagAssignment, Remove-TagAssignment, Remove-Tag, Remove-TagCategory

Known gaps

No operation of the recorded verification failed. The set of cmdlets is limited by the methods that Kyvernon serves, so a cmdlet that needs another method fails with a NotSupported fault. Two examples:

  • Stop-VMGuest and Restart-VMGuest call ShutdownGuest and RebootGuest, which are not served. Use Stop-VM, or kyvernon vm shutdown <id> for a graceful shutdown.
  • Cmdlets for distributed switches and licensing call methods that are not served.

The list of served methods is in supported vSphere API methods.

Version 0.1. Last changed: 2026-11-13