VMware vSphere
On-prem virtualization posture: ESXi host hardening, VM encryption, least-privilege roles, and segmentation. For private or air-gapped vCenter, deploy the collector so evidence flows out signed.
What it covers
On-prem virtualization posture: ESXi host hardening, VM encryption, least-privilege roles, and segmentation. For private or air-gapped vCenter, deploy the collector so evidence flows out signed.
How to connect
VMware vSphere is set up with the guided flow on the Integrations page in Joopler. Open Integrations, choose VMware vSphere, and follow the on-screen steps to grant read-only access. The flow walks you through the exact values to enter and validates the connection before you save.
How Joopler connects to vCenter
You enter your vCenter base URL and a read-only vCenter service account. The URL is stored as configuration; the username and password are stored write-only in a secrets vault and are never shown back to anyone.
vCenter should never be exposed to the internet, and on-prem it usually cannot be reached from outside your network at all. So the standard deployment is the in-network collector: a small container you run inside your own network next to vCenter. It reads vCenter and ESXi locally and pushes signed results outbound to Joopler over HTTPS with a scoped collector token. Your vCenter credentials never leave your network, and no inbound firewall rule is required. The collector is also the only way to collect the deep ESXi host hardening (lockdown mode, remote syslog, NTP, shell and SSH, VM encryption, least-privilege roles, patch level, network segmentation), which the vSphere REST API does not expose.
Only if your vCenter is reachable from Joopler's cloud does a second path apply, for example a hosted or cloud vCenter (such as VMware Cloud on AWS), or an on-prem vCenter you have deliberately connected over a private link (a site-to-site VPN or dedicated interconnect). In that case Joopler can additionally pull the managed-host inventory and connection state directly over the vSphere REST API on each run. Even then the collector still supplies the host-hardening checks. Joopler never asks you to put vCenter on the public internet.
To stand up the collector, see Deploy the vSphere collector.
Deploy the baseline as code
For VMware vSphere you can also deploy the security baseline Joopler verifies using the published Joopler Terraform modules, so getting to green is a terraform apply and staying green is drift-detected like the rest of your infrastructure. See Compliance as code.