VMware vCenter

The VMware vCenter connector allows you to centralize your virtual machine inventory, ESXi clusters and IT resources from your VMware infrastructure.

Read-only. The connector only performs read calls against the vCenter REST API. No write privilege is required or requested.

Objective

The VMware vCenter connector retrieves the following information:

• Virtual machine (VM) inventory
• Clusters and ESXi hosts (configurations, status)
• Resources (CPU, RAM, storage, network)

Prerequisites

• Access to VMware vCenter Server with read permissions
• Credentials for a vCenter user with appropriate permissions
• Network access to vCenter server (HTTPS port 443)

Information to provide in OverView

Procedure

Create a vCenter service account

1. Log in to vCenter Server with an administrator account.
2. Go to Administration > Users and Groups.
3. Create a new user:
   • Username: oversoc-service
   • Password: Generate a strong password
4. Click Create.

Assign permissions

Inventory reads through the vCenter REST API rely on vSphere's system privileges (System.View, System.Read), which are not exposed in the role editor. Do not look for checkboxes such as "View configuration": they do not exist in vSphere. The built-in Read-only role already carries these privileges.

The procedure starts from a clone of the Read-only role. This is required: vSphere system roles are immutable ("System roles are permanent. You cannot delete system roles nor can you edit the privileges associated with these roles."), and the connector needs additional privileges that Read-only does not include.

1. Create the role

1. Log in to vCenter Server using the vSphere Client.
2. Select Administration and click Roles in the Access Control area.
3. Select the Read-only role and click Clone.
4. Enter a name for the role (e.g. OverView-Read) and click OK.
5. Close the dialog, select OverView-Read in the list again, then click Edit.
6. Expand the VMware vSphere Lifecycle Manager category and select the following five privileges:
   • ESXi Health Perspectives: Read
   • Lifecycle Manager: General Privileges: Read
   • Lifecycle Manager: Hardware Compatibility Privileges: Access hardware compatibility
   • Lifecycle Manager: Image Privileges: Read
   • Lifecycle Manager: Settings Privileges: Read
7. Click Save.

The clone dialog only asks for a role name — it shows no privilege list. The VMware documentation states this explicitly: "When creating a cloned role, you cannot change privileges. To change privileges, select the cloned role and click Edit."

Do not skip step 5: without it you end up with a role identical to the original Read-only, and the connector will finish as a partial import.

All five privileges are read-only: none grants any modification right on vSphere Lifecycle Manager. A single one of them is not enough — they must all be selected together.

These labels were observed on vSphere Client 8.0.3.01000. They may vary depending on the build and the interface language: when in doubt, refer to the API names in the table below.

2. Assign the role to the service account

1. Select the root vCenter Server object in the inventory.
2. Go to the Permissions tab > Add Permission.
3. Fill in:
   • User: the service account (e.g. oversoc-service@vsphere.local)
   • Role: OverView-Read
   • Propagate to children: selected
4. Click OK.

The assignment must be made on the root vCenter Server object, with propagation. The vSphere Lifecycle Manager privileges from step 6 are only recognised at that level: assigning them on a datacenter or a cluster is not enough.

Configure the connector in OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select VMware vCenter and click Configure.
3. Fill in the required fields:
   • vCenter Server URL: Complete URL of your vCenter server
   • Username: Service account created
   • Password: Account password
   • API Version: Leave empty for auto-detection (optional)
4. Click Test Connection to verify connectivity.
5. Click Save Configuration.

Required permissions

Privileges carried by the OverView-Read role:

The first two rows come from the Read-only role clone. The following five must be selected manually at step 6 and govern ESXi host software inventory collection (vCenter 7.0+). Without them, the connector finishes as a partial import.

No write privilege is needed.

Troubleshooting

Partial import: "insufficient permissions (HTTP 403)" on host_software

Message shown in OverView:

CRAWL_PERMISSION_DENIED
Endpoint: esx/hosts/host-XXXXXX/software/installed-components

Cause: one or more of the five vSphere Lifecycle Manager privileges from step 6 is missing. The number of denied requests matches the number of ESXi hosts in the infrastructure.

Fix: repeat step 6. Three frequent causes if the error persists:

• only one privilege was selected instead of all five — they are all required;
• the role was cloned but never edited (see the warning about the clone dialog);
• the permission is assigned on a datacenter or a cluster instead of the root vCenter Server object.

The rest of the inventory (VMs, hosts, network, tags) is not affected by this error: only ESXi host software components are missing.

I cannot find the privilege in the tree

The role editor only displays labels, never API names: searching for VcIntegrity... in the tree returns nothing. On top of that, VMware's labels and API names do not map intuitively:

Inferring the label from the API name therefore leads to the wrong group. Rely on the list in step 6, and failing that on the role editor's search field by typing lifecycle.

Known functional limitation

Guest information (IP addresses, FQDN, operating system) comes from the vCenter API guest/* endpoints, which require VMware Tools to be running inside the VM. VMs without running VMware Tools appear in the inventory but without network or operating system details. This is not a permissions issue and no additional privilege fixes it.