Configuration Guide
Kollect is configured entirely through command-line flags and environment variables — there are no configuration files. It uses your existing cloud CLI configurations (AWS CLI, Azure CLI, gcloud, kubectl, Docker) by default, so basic usage needs no setup.
Basic usage
# Discover everything with detected credentials
./kollect --inventory all
# Web interface only (import/view existing data)
./kollect --browser
# A single platform
./kollect --inventory kubernetes
./kollect --inventory openshift
./kollect --inventory aws
./kollect --inventory azure
./kollect --inventory gcp
./kollect --inventory docker
./kollect --inventory terraform
./kollect --inventory vault
./kollect --inventory vsphere
./kollect --inventory proxmox
./kollect --inventory hyperv
./kollect --inventory nutanix
# Snapshots across all platforms
./kollect --snapshots
# Start the MCP server for AI tools
./kollect --mcp
One platform at a time. --inventory takes a single value or all. There is no comma-separated list — run Kollect once per platform, or use all.
Core flags
| Flag | Description | Example |
|---|
--inventory | Type of inventory to collect (all, kubernetes, openshift, aws, azure, gcp, terraform, vault, docker, vsphere, proxmox, hyperv, nutanix) | --inventory aws |
--browser | Open the web interface (can be used alone to import data) | --browser |
--snapshots | Collect snapshots from all available platforms | --snapshots |
--mcp | Start the MCP (Model Context Protocol) server | --mcp |
--output | Save collected data to a JSON file | --output data.json |
--port | Port for the local web/API server (default 8080) | --port 9090 |
--storage | Collect only storage objects (Kubernetes only) | --storage |
--kubeconfig | Path to kubeconfig file | --kubeconfig ~/.kube/config |
--kube-context | Kubernetes context to use | --kube-context prod |
--docker-host | Docker host connection | --docker-host unix:///var/run/docker.sock |
--scenario-csv | Export a Veeam Scenario Builder CSV (single provider: file; --inventory all: directory) | --scenario-csv out.csv |
--scenario-group | Group all workloads into one summary row per sheet in the CSV export | --scenario-group |
--help | Show all flags | --help |
Platform-specific flags
Terraform
--terraform-state | Path to local Terraform state file | --terraform-state ./terraform.tfstate |
--terraform-s3 | S3 bucket containing state (bucket/key) | --terraform-s3 mybucket/prod.tfstate |
--terraform-s3-region | AWS region for the S3 bucket (defaults to AWS_REGION) | --terraform-s3-region us-east-1 |
--terraform-azure | Azure Blob state (storageaccount/container/blob) | --terraform-azure sa/container/blob |
--terraform-gcs | GCS bucket and object (bucket/object) | --terraform-gcs bucket/terraform.tfstate |
Vault
--vault-addr | Vault server address | --vault-addr https://vault.example.com:8200 |
--vault-token | Vault authentication token | --vault-token s.abc123... |
VMware vSphere
--vsphere-server | vCenter server address | --vsphere-server vcenter.example.com |
--vsphere-username | vSphere username | --vsphere-username readonly@vsphere.local |
--vsphere-password | vSphere password | --vsphere-password ****** |
--vsphere-insecure | Skip SSL verification | --vsphere-insecure |
Proxmox VE
--proxmox-server | Proxmox VE server address (host or host:port) | --proxmox-server pve.example.com |
--proxmox-token | API token (user@realm!tokenid=secret) | --proxmox-token root@pam!kollect=... |
--proxmox-username | Username (used when no API token is given) | --proxmox-username root@pam |
--proxmox-password | Password (used when no API token is given) | --proxmox-password ****** |
--proxmox-insecure | Skip SSL verification | --proxmox-insecure |
Microsoft Hyper-V
--hyperv-server | Hyper-V host or failover-cluster address (WinRM) | --hyperv-server 192.168.1.50 |
--hyperv-username | Username (DOMAIN\user or HOST\user) | --hyperv-username CORP\svc-kollect |
--hyperv-password | Password | --hyperv-password ****** |
--hyperv-https | Use HTTPS (WinRM :5986); required for hosts enforcing message encryption | --hyperv-https |
--hyperv-insecure | Skip TLS verification over HTTPS | --hyperv-insecure |
--hyperv-cluster | Also query the Windows Failover Cluster (root/MSCluster) | --hyperv-cluster |
--hyperv-auth | Auth mode: auto (default), ntlm, or kerberos | --hyperv-auth kerberos |
--hyperv-realm | Kerberos realm override | --hyperv-realm CORP.EXAMPLE.COM |
--hyperv-kdc | Kerberos KDC host[:port] override | --hyperv-kdc dc01.corp.example.com |
Nutanix AHV
--nutanix-server | Prism Element address (port defaults to 9440) | --nutanix-server prism.example.com |
--nutanix-username | Prism username | --nutanix-username admin |
--nutanix-password | Prism password | --nutanix-password ****** |
--nutanix-insecure | Skip SSL verification (Community Edition uses a self-signed cert) | --nutanix-insecure |
Environment variables
Most connection flags can also be provided as environment variables — the preferred way to keep secrets off the command line. An explicit flag always wins over its environment variable.
Web server port
export KOLLECT_PORT=9090 # equivalent to --port 9090
Vault
export VAULT_ADDR="https://vault.example.com:8200"
export VAULT_TOKEN="s.abc123..."
VMware vSphere
export VSPHERE_SERVER="vcenter.example.com"
export VSPHERE_USERNAME="readonly@vsphere.local"
export VSPHERE_PASSWORD="******"
export VSPHERE_INSECURE="true"
Proxmox VE
export PROXMOX_SERVER="pve.example.com"
export PROXMOX_TOKEN="root@pam!kollect=..." # or PROXMOX_USERNAME / PROXMOX_PASSWORD
export PROXMOX_INSECURE="true"
Hyper-V
export HYPERV_SERVER="192.168.1.50"
export HYPERV_USERNAME="CORP\\svc-kollect"
export HYPERV_PASSWORD="******"
export HYPERV_HTTPS="true"
export HYPERV_AUTH="kerberos" # HYPERV_REALM / HYPERV_KDC also supported
Nutanix
export NUTANIX_SERVER="prism.example.com"
export NUTANIX_USERNAME="admin"
export NUTANIX_PASSWORD="******"
export NUTANIX_INSECURE="true"
Web server & port
The web/API server listens on port 8080 by default and binds to loopback only (127.0.0.1) since the API is unauthenticated. Change the port with --port or the KOLLECT_PORT environment variable — handy for running a terminal instance and an MCP instance side by side.
# Run on a different port
./kollect --browser --port 9090
# Web interface: http://localhost:9090
Cloud provider authentication
- AWS: AWS CLI profiles (
~/.aws/credentials) and IAM roles
- Azure: Azure CLI authentication (
az login)
- GCP: gcloud application-default credentials and service accounts
- Kubernetes / OpenShift: kubeconfig (
~/.kube/config)
- Docker: the local Docker daemon socket
Example workflows
Kubernetes with a specific kubeconfig
./kollect --inventory kubernetes --kubeconfig ~/.kube/prod-config
Terraform state analysis
# Local state
./kollect --inventory terraform --terraform-state ./terraform.tfstate
# Remote S3 backend
./kollect --inventory terraform --terraform-s3 mybucket/prod.tfstate --terraform-s3-region us-west-2
vSphere via environment variables
export VSPHERE_SERVER="vcenter.company.com"
export VSPHERE_USERNAME="readonly@vsphere.local"
export VSPHERE_PASSWORD="******"
./kollect --inventory vsphere --vsphere-insecure
Export for Veeam Scenario Builder
# Single provider -> CSV file
./kollect --inventory vsphere --scenario-csv vsphere-scenario.csv
# All providers -> directory of CSVs
./kollect --inventory all --scenario-csv ./scenario-out/
Save data to a file
./kollect --inventory all --output infrastructure-audit.json
🔒 Security best practices
- Prefer environment variables over passing passwords/tokens as flags
- Create read-only service accounts for Kollect
- Use IAM roles and managed identities where possible
- Never store credentials in scripts or version control