Prepare the ground
Gather the machine, the flows and the accounts before you start. This page can be passed on as it is to your network team.
The machine
The collector is a small standalone service. A small dedicated virtual machine is enough.
- System: Linux with systemd (recommended) or macOS, amd64 or arm64.
- Rights:
sudofor the installation only. The collector then runs under its own system account, without root rights. - Location: where it can reach both Naoshift, on the Internet, and your hypervisors, on your network.
The flows to open
All of them leave the collector. No inbound flow, no VPN.
| From the collector to | Port | Direction |
|---|---|---|
Naoshift (app.naoshift.io) |
HTTPS 443 | outbound, Internet |
| VMware vCenter | 443 | outbound, local network |
| Proxmox VE | 8006 | outbound, local network |
| Xen Orchestra | 443 | outbound, local network |
| Nutanix Prism Central | 9440 | outbound, local network |
| Microsoft Hyper-V, every node of the cluster | 5986 (WinRM HTTPS) | outbound, local network |
| OpenShift Virtualization, Superphenix (Kubernetes API) | 6443 | outbound, local network |
| HPE VM Essentials (VME Manager) | 443 | outbound, local network |
Your backups and arrays are read through the same collector, with their own ports: see the last lesson of this path.
Proxy and TLS inspection
If the machine goes out through a proxy, or if TLS inspection sits on the path, flag it now. These are the two most frequent causes of a collector that cannot reach Naoshift.
Read-only accounts
Plan one dedicated account per platform. Collection never needs write rights.
| Platform | Recommended account |
|---|---|
| VMware vSphere | A user with the Read-only role at the vCenter root, propagated to children |
| Proxmox VE | A user or API token with the PVEAuditor role on / |
| Xen Orchestra | An authentication token from an account with read access to the pools |
| Nutanix Prism Central | An account with the Viewer role |
| Microsoft Hyper-V | An account in Hyper-V Administrators, Remote Management Users, Performance Monitor Users and Event Log Readers on every node, with Grant-ClusterAccess -ReadOnly. Hyper-V has no read-only role: Naoshift only reads with this account |
| OpenShift Virtualization, Superphenix | A service account with the naoshift-collector ClusterRole, with no access to secrets |
| HPE VM Essentials | The API token of a read-only user |
If you get stuck
The firewall takes time to open
That is normal, and it is why this lesson comes first. Only create the install token once the flows are open: it expires after one hour.
Hyper-V does not answer on port 5986
WinRM over HTTPS is not active by default. It must listen on every node of the cluster, and a port test from the collector machine must respond before you go further.
How to test a flow from the collector machine
On Linux: curl -kI https://vcenter.example.local for a platform, curl -I https://app.naoshift.io for Naoshift. Any response, whatever its code, proves the flow is open.
Go further
Try it on your estate
Naoshift Core, 30-day free trial. No credit card, no commitment.
Start my free trial