Deploy the vSphere collector

Run the in-network collector that reads ESXi hardening and pushes signed evidence to Joopler.

The vSphere collector is the on-prem half of the VMware connector. It runs inside your network, reads the ESXi host hardening the vCenter REST API does not expose, and posts signed results to Joopler with a scoped collector token. Your vCenter credentials never leave your network, and it needs no inbound firewall rule.

Before you start

A read-only vCenter service account (the audit role the vmware Terraform module creates).
A collector token (jpc_...), minted by an admin in the Joopler dashboard (or POST /v1/collector-tokens). It authorizes only evidence ingestion for your tenant and is shown once.
A host inside your network that can reach vCenter and make outbound HTTPS to your Joopler API endpoint, with a container runtime (Docker, Podman, or a Kubernetes cluster).

Get and run the collector

Pull the published image, no build required:

docker pull ghcr.io/joopler/vsphere-collector:preview

Then run it with your vCenter details and collector token:

docker run --rm \
  -e VCENTER_URL=https://vcenter.internal \
  -e VCENTER_USER='svc-joopler@vsphere.local' \
  -e VCENTER_PASSWORD='...' \
  -e JOOPLER_API_URL='https://<your-joopler-api-endpoint>' \
  -e JOOPLER_TOKEN='jpc_...' \
  ghcr.io/joopler/vsphere-collector:preview

Variable	Meaning
`VCENTER_URL`	Your vCenter URL, e.g. `https://vcenter.internal`
`VCENTER_USER`	The read-only service account
`VCENTER_PASSWORD`	Its password
`JOOPLER_API_URL`	Your Joopler API endpoint (shown when you mint the token)
`JOOPLER_TOKEN`	The collector token (`jpc_...`)
`VCENTER_INSECURE`	`true` to skip TLS verification for a self-signed vCenter

The agent runs once and exits, printing one line per control. The same image runs under Podman (podman run with the identical flags) and as a Kubernetes Job.

Or run it as an appliance (OVA)

Prefer a turnkey virtual machine to managing a container? Download the prebuilt appliance and import it into vSphere:

Download joopler-vsphere-collector.ova from the releases page.
In vCenter, choose Deploy OVF Template and select the file.
On the customization step, enter your vCenter URL, the read-only service account, and your Joopler collector token (jpc_...).
Power it on. The appliance runs the collector on a daily schedule and posts signed results to Joopler, with no container runtime for you to manage.

The appliance runs the same public collector image internally, so the controls it collects are identical to the container path above.

Verify it worked

Each run prints a PASS/FAIL line per control and posts the signed result to Joopler. Open Controls in the dashboard (or hit Run now) and the vmware-* controls move from Pending to Pass or Fail within a minute, each backed by a signed, timestamped evidence record you can verify at /verify. A non-zero exit code means the run failed before posting anything; see Troubleshooting below.

Keep evidence fresh

Schedule the container so each run posts updated results. A host cron entry that runs every morning:

# every morning at 06:00 (crontab -e)
0 6 * * *  docker run --rm --env-file /etc/joopler/collector.env ghcr.io/joopler/vsphere-collector:preview

Or as a Kubernetes CronJob (credentials in a Secret named joopler-collector):

apiVersion: batch/v1
kind: CronJob
metadata:
  name: joopler-vsphere-collector
spec:
  schedule: "0 6 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: collector
              image: ghcr.io/joopler/vsphere-collector:preview
              envFrom:
                - secretRef:
                    name: joopler-collector

The vmware Terraform module can also stand up the collector host and inject this configuration for you.

Troubleshooting

401 / token rejected when posting to Joopler: the collector token is wrong, revoked, or from another tenant. Mint a fresh jpc_ token and update JOOPLER_TOKEN.
TLS / certificate errors reaching vCenter: your vCenter uses a self-signed or internal-CA certificate. Trust the CA on the host, or set VCENTER_INSECURE=true to skip verification (fine on a trusted internal network).
Cannot complete login / permission errors from vCenter: the service account is missing the read-only role, or the username is not in user@vsphere.local form.
Cannot reach the Joopler API: the host needs outbound HTTPS to your JOOPLER_API_URL. For a fully disconnected estate, see Air-gapped networks below.

Controls the collector supplies

Control	Check
`vmware-lockdown-mode`	Every host is in lockdown mode
`vmware-remote-syslog`	Every host has a remote syslog target
`vmware-ntp-configured`	Every host has NTP servers and the NTP daemon running
`vmware-shell-ssh-disabled`	The ESXi Shell and SSH services are stopped

More host and VM checks (encryption, roles, segmentation, patch level) are additive: each is one more result posted to the same endpoint.

Air-gapped networks

For a fully disconnected estate that cannot reach the Joopler API, point JOOPLER_API_URL at an internal relay, or run the agent so it writes a locally-signed evidence bundle you import later. The read model is identical; only the transport differs.

Deploy the vSphere collector

On this page