VMware vSphere

Clarity Transform reads inventory and placement from vCenter: which virtual machine runs on which host, in which cluster, in which management domain. Read-only throughout, over the vCenter SDK.

Where to find it

Go to Discover → Integrations, then select the VMware vSphere card. The card's category label is Hypervisor. The integration's page has the Endpoints and History tabs; Integrations describes the page, its grid and its row actions.

Why we do this

Placement matters for migration planning independently of application boundaries. It tells you what moves together, what shares a failure domain, and where an application's components are spread across infrastructure in ways that constrain how it can be moved.

An application map tells you what depends on what. Placement tells you what is physically entangled. Planning Move Groups and Events needs both, and they rarely agree.

What we collect

• Virtual machines with their configuration, guest details and resource allocation
• Hosts and clusters, and the placement relationships between them
• Datastores and network configuration

What it adds

Flow data, firewall policy and load balancer topology all arrive as addresses; it is the vSphere inventory that turns those into named machines.

The Rightsizing tab on Infrastructure Discovery is filled from VM assessment data collected by PowerCLI discovery. Until that data exists, the tab reads "No assessment data".

VMware Tools and statistics level

Application and role detection needs VMware Tools 11.0 or later with the appInfo plugin enabled, and performance history needs vCenter statistics at level 1 or above.

What is deliberately not inferred

• No guest file systems, and no application data.
• No console access and no guest credentials.
• Nothing is written to vCenter. No VM is created, changed, powered on or off.
• Placement is not a dependency. Two machines on the same host are not related by that fact alone.

What we require

The requirement below is read from rb-pautol-vmware-connect-vcenter.ps1 in the Runbooks repository, which is where it is maintained. If it is wrong, the runbook is what gets corrected and this page follows on the next build.

Role required: the built-in Read-only role, granted at the vCenter root object and propagated to child objects. Read-only cannot change a single setting; discovery never writes to vCenter.

Connectivity: the vCenter SDK over HTTPS on TCP 443 from Clarity.

Without propagation the datacentres, clusters and virtual machines beneath the root are invisible even though the account authenticates successfully. That failure presents as an empty inventory rather than a permission error, so it is worth confirming propagation is ticked rather than assuming the grant took.

Two things affect depth rather than success, and both degrade quietly where absent:

• Application and role detection needs VMware Tools 11.0 or later with the appInfo plugin enabled on the guest.
• Performance history needs vCenter statistics at level 1 or above.

Neither stops a run. Each simply produces less than expected, which is why they are recorded here rather than left to be noticed as missing data.

Verification before handover

Run these as the system owner before handing the credential over.

1. Confirm the account authenticates. Log in to vCenter as the account.
2. Confirm propagation, which is the step that matters. Check the Read-only role is granted at the vCenter root object with propagate to child objects ticked. Without propagation the account logs in successfully and sees nothing beneath the root. That presents as an empty inventory rather than a permission error.
3. Confirm the inventory is visible. As the account, browse to the datacentres, clusters and virtual machines. If they are listed, discovery will see them.
4. Check the two depth items. Confirm VMware Tools 11.0 or later with appInfo if application detection is wanted, and vCenter statistics level 1 or above if performance history is wanted.

Configuring the endpoint

On the integration's Endpoints tab, select the add icon (Create New Integration Endpoints). The Create new entry form opens with these fields, in this order:

Field	Value
Name	A name for the endpoint
End Point	The vCenter hostname or IP
Credential	The stored credential for the Read-only account
Job Schedule	A five-field cron expression, for example 0 0 * * * (daily). Inventory changes continuously in most estates
Enabled	Ticked. The box is unticked when the form opens

The help texts: End Point "FQDN or IP Address of management system for technology e.g. vCenter, Nutanix Prism"; Credential "Credentials can be configured under Settings/Identity and Access Management/Credentials."; Job Schedule "Cron schedule – Use five fields: 〈mm〉 〈hh〉 〈day-of-month〉 〈month〉 〈weekday〉".

The Credential list offers the credentials stored under Settings → Identity & Access Management → Credentials, so create the credential there first.

No field is marked as required. Technology is set by the card and is hidden in the form. Select Save to create the endpoint, or Cancel to close the form. The edit icon opens the same fields as Edit entry.

Removing the access

Remove the permission at the vCenter root object, then delete the account. Then, in Clarity, remove the endpoint (select its row on the Endpoints tab, then Remove selected) or clear its Enabled box, and remove the credential under Settings → Identity & Access Management → Credentials.

Troubleshooting

Symptom	Cause
Authenticates but the inventory is empty	The role was not propagated to child objects.
Some clusters visible, others not	The permission was granted at a lower object than the root rather than at the root itself.
No application or role detection	VMware Tools is older than 11.0, or the appInfo plugin is not enabled. Discovery still succeeds with less depth.
No performance history	vCenter statistics are below level 1. Discovery still succeeds.
Certificate error on connect	vCenter is using a self-signed or untrusted certificate. Trust the CA on the Clarity host.