Skip to content

ServiceRadar

Open navigation

Visibility

Proxmox VE inventory and console access

See Proxmox clusters, guests, storage, and health in the same inventory you already trust—without parking API tokens on agents or treating console access as free with a view permission.

Enrich Proxmox VE hosts, QEMU VMs, and LXC containers from the edge with least-privilege API tokens, SRQL-scoped credential rules, and optional SSH host consoles that stay separate from read-only inventory.

Launch demo Read the docs Book a discovery call

Inventory-driven Proxmox enrichment

You do not need a second CMDB just for Proxmox. ServiceRadar finds Proxmox hosts in the network inventory you already run—imports, tags, fingerprints, or sources like NetBox and Armis—then uses an edge agent with reach to the PVE API to pull host, VM, and LXC detail into that same living inventory.

  • Pull PVE nodes, QEMU guests, and LXC containers from the edge agent path
  • Normalize results into canonical devices and virtualization tables
  • Keep hypervisor context next to network inventory and telemetry
  • Spot Proxmox candidates from imports, tags, and protocol fingerprints

Least-privilege tokens and SRQL credential rules

Inventory uses read-only Proxmox API tokens delivered through credential rules and a broker grant—not plaintext secrets in agent JSON. Operators scope which devices may receive which credentials with SRQL, and which agents or gateways are allowed to use them.

  • Prefer Sys.Audit / VM.Audit / Datastore.Audit style inventory roles
  • Scope rules with SRQL (site, datacenter, provider tags, and more)
  • Preview matches before enabling a rule so the wrong agent never gets the grant
  • Disable auto-discovery credential trials unless the risk is explicitly accepted

Multi-site clusters without a flat trust domain

Multi-datacenter Proxmox estates should not share one global token. ServiceRadar supports one credential rule per site—token, SRQL query, and agent or gateway scope for that management network—so IAD and DFW (or any pair of sites) stay isolated.

  • Per-site tokens and per-site agent scope
  • Target queries that only match intended PVE devices
  • Partition or gateway scoping for segmented management planes
  • Works alongside imports from NetBox, Armis, and other discovery sources

What operators actually see

Where the token allows, the Proxmox integration collects the operational detail teams need for capacity and health—not just a hostname list.

  • PVE version and cluster status
  • Nodes and runtime status
  • QEMU and LXC guest status and config
  • Storage pools and capacity
  • Node network interfaces, disks, and health
  • Ceph status, OSDs, pools, and filesystems when privileges allow

Console access is a separate, audited path

Viewing a Proxmox device does not grant a shell. Inventory stays on a read-only API token. Host console access uses a separate console_access credential rule, RBAC, and a short-lived single-use browser ticket streamed through the edge agent. Native VM and LXC consoles are reserved for a later connector; guest SSH can follow the broader remote-access path.

  • Separate secrets for inventory versus console
  • devices.console.open (and matching rules) required to open a shell
  • Short-lived tickets bound to user, target, agent, and expiration
  • Audit events for grant, deny, open, close, and credential failures

FAQs

Does inventory collection need write access on Proxmox?

No. Prefer a dedicated read-only inventory role. Avoid write privileges such as VM.Allocate, VM.Config.*, Sys.Modify, or Datastore.Allocate for inventory-only collection.

Where are Proxmox API tokens stored?

In encrypted credential secrets delivered to the edge through scoped credential rules and broker grants. Tokens should not live in agent JSON, plugin parameters, tickets, or screenshots.

Can I open a console to a VM or LXC from ServiceRadar today?

Host shell access is supported for PVE nodes over SSH through the edge agent. Native Proxmox termproxy and VNC guest consoles are not enabled yet. Guests that speak normal SSH can use the remote-access path when enrolled.

How do multi-datacenter deployments stay scoped?

Create one credential rule per site with a site-specific token, SRQL query, and agent or gateway scope. Preview the rule so only the intended devices and edge path receive the grant.

Where are the deep technical docs?

Credential modes, least-privilege roles, SRQL examples, console security, and collected data live in the Proxmox VE integration docs .