Integrations
Integrations
All Kyvernon functions are available through a documented native API. The web UI, the CLI, the vSphere endpoints and the integrations below use the same API.
Native API
gRPC and REST, versioned under /v1, documented in OpenAPI 3.1 and protobuf. The definitions are published with each release.
GoTrust products
monsys.ai
Monitoring and compliance evidence. Hosts, virtual machines, storage pools and segments appear in the monsys inventory and topology. Alerts and audit events are forwarded. Configuration drift, backup confirmations and restore results are included in audit packs for NIS2, the Cyber Resilience Act and ISO 27001.
zekura.eu
Verified backups through the Kyvernon backup API, with changed-block reads over NBD. Restores are tested in an isolated network segment and the result is recorded on the virtual machine.
Observability
| Interface | Detail |
|---|---|
| Prometheus | /metrics on every controller and host; /metrics/perf with the newest samples of every host, virtual machine and datastore; scrape configuration and a Grafana dashboard in the repository |
| OpenTelemetry | Traces for API calls and tasks, metrics over OTLP |
| Syslog and CEF | Audit log as CEF over syslog with TLS (RFC 5425 framing, RFC 5424 messages, client certificate optional); RFC 3164 or RFC 5424 over UDP as a documented weaker option |
| Audit retention | Append-only local file with a hash chain and a verify command, next to the SIEM stream |
| Webhooks | CloudEvents with HMAC signatures, retries and dead-letter queue |
monsys adapter
The monsys adapter is a separate service that uses the native API with a read-only API token. It serves a discovery endpoint that lists datacenters, clusters, hosts, virtual machines, datastores and networks with stable ids, tags, usage figures and current samples, pushes the topology to the monsys hub, and forwards alarm changes and task failures as signed alerts with retries and a dead-letter file. Nothing in the controller is specific to monsys; the same endpoints are available to any monitoring product.
Infrastructure as code
| Tool | vSphere-compatible route | Native route |
|---|---|---|
| Terraform | vsphere provider | Kyvernon provider, planned |
| Ansible | community.vmware collection | Kyvernon collection, planned |
| PowerCLI | SOAP and REST endpoints | Not applicable |
| Packer | vsphere-iso and vsphere-clone builders | Not applicable |
Identity
- OIDC and SAML federation
- SCIM 2.0 user and group provisioning
- API tokens with scopes and expiry
Planned integrations
| Integration | Detail |
|---|---|
| Kubernetes | Cluster API provider, CSI driver, cloud controller manager |
| CMDB and IPAM | ServiceNow, NetBox, phpIPAM, Infoblox |
| Key management | HashiCorp Vault, KMIP |
| Extension framework | Out-of-process extensions over gRPC for storage, network, identity, backup and UI |
| Model Context Protocol | Read access to inventory and tasks; write access with approval |
| SNMP v3 | Read-only agent |
Technology partners
Vendors of backup, monitoring, CMDB and provisioning products can join the early access programme to verify their integration. See early access.