Collector Reference: Infrastructure

Parascope's infrastructure collectors discover and monitor the foundational platforms that run your workloads — container orchestrators, hypervisors, cloud platforms, and network source-of-truth systems. Each collector connects to one or more instances of its target platform and periodically scans for configuration items, relationships, and changes.

Kubernetes Collector

The Kubernetes collector discovers workloads, configuration, and infrastructure across one or more Kubernetes clusters.

CI Types Discovered

The Kubernetes collector discovers a broad set of resource types — workloads, networking, storage, and RBAC. The most common are:

Standalone Jobs and individual CronJob runs are tracked as billing-free sub-resources (kubernetes.namespacejob and kubernetes.cronjobjob) rather than as standalone CIs.

Authentication

• In-cluster ServiceAccount — automatic when running inside the target cluster
• Kubeconfig — for remote clusters, uses standard kubeconfig files

Collection Modes

• Periodic — Full inventory scan on a fixed interval
• Watch — Real-time event streaming for near-instant change detection

Multi-Cluster Support

Configure multiple Kubernetes clusters as separate sources. Each cluster gets its own scope ID for data isolation and independent health tracking.

Key Relationships

• Pods runs_on Nodes
• Pods is_contained_by Namespaces
• Deployments manages ReplicaSets manages Pods
• Services selects Pods
• PVCs mounts PVs

Proxmox Collector

The Proxmox collector discovers virtualization infrastructure from Proxmox VE clusters.

CI Types Discovered

Physical node disks (with SMART health) and storage content items are tracked as billing-free sub-resources (proxmox.nodedisk, proxmox.storagecontentitem) on their parent node and storage CIs.

Authentication

• API Token — recommended, uses Proxmox API tokens with configurable privileges
• Username/Password — falls back to ticket-based authentication

Required Privileges

Parascope is read-only, but it needs cluster-wide audit access. Missing privileges are the most common cause of empty or partial results. The simplest grant is the built-in PVEAuditor role on the root path / with propagate enabled. If your policy requires a tighter set, grant the minimal read-only privileges instead:

# Recommended: read-only auditor on the whole cluster
pveum acl modify / --roles PVEAuditor --users monitor@pve --propagate 1

A token missing Sys.Audit still collects nodes, VMs, and storage — the disk, patch, and certificate sections simply come back empty.

TLS

Use CA-verified TLS in production. Proxmox ships a per-cluster CA; point the collector at it (PROXMOX_VERIFY_SSL set to the CA bundle path) or replace the node certificate with a publicly-trusted one. Disabling verification is a homelab convenience only — the collector already anchors each cluster's identity to its CA fingerprint, so verified transport is the natural pairing.

What Gets Collected

• Config (tracked): VM/container hardware config (CPU, memory, disk, network), status, node membership; node patch posture (pending updates) and certificate expiry
• Metrics (not tracked): CPU utilization, memory usage, disk I/O, uptime
• Node sub-resources: physical disk inventory with SMART health and wearout, shown on the node detail view

Key Relationships

• VMs/Containers runs_on Nodes
• Nodes member_of Cluster
• VMs/Containers use Storage

OpenStack Collector

The OpenStack collector discovers cloud resources across one or more OpenStack deployments, including both private clouds and public OpenStack deployments.

CI Types Discovered

The OpenStack collector spans Nova (compute), Cinder (block storage), Neutron (networking), Glance (images), Keystone (identity), Octavia (load balancing), Heat (orchestration), Magnum (container clusters), Manila (shared filesystems), and Barbican (secrets). The most common types are:

Project governance evidence — role assignments (openstack.roleassignment) and quotas (openstack.quota) — is surfaced as billing-free sub-resources on each project's detail view rather than as standalone CIs.

Authentication

• Application Credentials — recommended, scoped to specific project access
• Username/Password — standard Keystone authentication

Credential scope for complete coverage

With all_projects: true (the default), completeness depends on the OpenStack application credential holding a reader role across all projects. An under-scoped credential silently reduces coverage with no error — Neutron, Cinder, and Keystone list calls return only the resources visible to the token's own project, so resources in other projects are simply missing from the inventory. Grant the credential's user a project-reader (or equivalent read-only) role on every project you want discovered.

Project governance collection has the same requirement:

• Role assignments (openstack.roleassignment) need Keystone identity read scope to list assignments across projects.
• Quotas (openstack.quota) need project read scope to read each project's compute, network, and volume quota limits.

When scope is missing, the affected collector skips and logs a warning rather than failing — so the cycle stays healthy but coverage is reduced. Role assignments and quotas are project-scoped governance evidence surfaced on the project's detail view (they are billing-free sub-resources, not standalone CIs).

Multi-Cloud Support

Configure multiple OpenStack deployments as separate sources with independent credentials and scoping. Per-source configuration supports:

• all_projects: false — limit to authenticated project only
• Selective collector disabling (e.g., skip image collector if credentials lack permission)

Key Relationships

• Instances runs_on Hypervisors (when admin access available)
• Instances use Flavors, Images, Networks
• Ports connects_to Networks/Subnets
• Volumes attached_to Instances

Netbox Collector

The Netbox collector synchronizes network infrastructure data from NetBox, the network source of truth.

CI Types Discovered

Authentication

• API Token — standard NetBox API token with read permissions

Key Features

• IPAM Sync — IP address and prefix data for network planning
• DCIM Sync — Physical device, rack, and site inventory
• API Pagination — Handles large NetBox instances with automatic pagination
• Enrichment Source — Netbox data enriches CIs from other collectors (e.g., adding physical location to a Proxmox node)

Key Relationships

• Devices located_in Racks located_in Sites
• Interfaces member_of Devices
• IP Addresses assigned_to Interfaces
• Cables connects Interfaces

Related Documentation

• Managing Collectors — Collector health and configuration
• Collector Reference: Platform Services — Ceph, PostgreSQL, Prometheus, Grafana, Vault, DNS collectors
• Collector Reference: Discovery — OS and SNMP collectors
• CI Types — Complete CI type reference