Settings of the compatibility endpoints
The controller settings that turn on the vSphere-compatible endpoints, set the product name, the session time and the addresses that clients are given.
The settings are in /etc/kyvernon/controller.toml. A change takes effect when the controller restarts. Check the file first with sudo kyvernon-controller --config /etc/kyvernon/controller.toml check-config.
Section facades
| Key | Default | Meaning |
|---|---|---|
enabled | false | Serve the compatibility endpoints (/sdk, /api, /rest, /nfc and the token and lookup services) on the HTTP listener of the controller. The datastore file endpoint /folder is part of the native API and works with this off. |
session_timeout | 30m | Idle time after which a session of a client ends. |
product_name | not set | The product name that the endpoints report in the service information. Not set: Kyvernon. |
public_host | not set | The host[:port] that the endpoints write into addresses of answers that have no request of their own, such as the addresses of the token, single sign-on and lookup services. Not set: public_address of [http], else localhost. |
trust_certificate_file | not set | A PEM certificate that the lookup service publishes as the certificate to trust. Set it when clients reach the controller through a proxy that terminates TLS with another certificate. Not set: the certificate of the controller. |
[facades]
enabled = true
session_timeout = "30m"The product name
Some tools check the name before they enable a function. The Terraform vSphere provider enables tags only when the endpoint reports the name of the vendor's vCenter Server product, so with the default name every tag resource fails. Set product_name to that name for a deployment that needs tags:
[facades]
enabled = true
product_name = "VMware vCenter Server"The setting applies to every client of the controller. Leave it unset when no tool needs it. See Terraform vSphere provider.
Related settings in other sections
| Key | Default | Meaning |
|---|---|---|
[http] listen | 0.0.0.0:8443 | The address and port of the listener that serves the endpoints. |
[http] public_address | not set | The host[:port] that console tickets name for vSphere clients, for example what govc vm.console prints. Set it to the name clients use to reach the controller. Not set: the address of the listener when it is a real one, else localhost. |
[http] trusted_proxies | 127.0.0.1, ::1 | The proxies whose client address headers are trusted. |
[tls] mode, san | self_signed, localhost | The certificate of the listener and the names it carries. The names clients use must be in san. |
[files] max_upload_bytes | 256 GiB | The largest file that an upload accepts. |
Related
Version 0.1. Last changed: 2026-11-13