Vmware Storage

uv tool install vmware-storage
mkdir -p ~/.vmware-storage
cp config.example.yaml ~/.vmware-storage/config.yaml
Edit config.yaml with your vCenter/ESXi targets
Add to ~/.vmware-storage/.env (create if missing, chmod 600):
VMWARE_MY_VCENTER_PASSWORD=
chmod 600 ~/.vmware-storage/.env
vmware-storage doctor

> All tools are automatically audited via vmware-policy. Audit logs: vmware-audit log --last 20

> Full setup guide with multi-target config, MCP server setup, and Docker: see references/setup-guide.md

iSCSI enable fails with "already enabled"

Not an error. The software iSCSI adapter is already active on that host. The response includes the current HBA device name and IQN. Run iscsi status to see configured send targets.

"Datastore not found" when browsing

Datastore names are case-sensitive. Run vmware-storage datastore list to get the exact name. Common mistakes: Datastore1 vs datastore1, trailing spaces.

vSAN health shows "unknown" status

vSAN health checks require a vCenter connection (not standalone ESXi). The full VsanVcClusterHealthSystem runs via vCenter's vSAN Health Service. If connected to a standalone ESXi host, vSAN queries will fail or return limited info.

Rescan doesn't discover new LUNs

After adding iSCSI targets, the storage subsystem may need 10-30 seconds to enumerate new LUNs. Steps to resolve: 1. Verify the target IP is reachable from the ESXi host (vmkping from ESXi shell) 2. Check that the iSCSI target is correctly configured: vmware-storage iscsi status 3. Wait 15-30 seconds, then rescan again: vmware-storage iscsi rescan

"Password not found" error

The password environment variable is missing. Variable names follow the pattern VMWARE__PASSWORD where hyphens become underscores. Example: target my-vcenter needs VMWARE_MY_VCENTER_PASSWORD. Check your ~/.vmware-storage/.env file.

Doctor reports ".env permissions too open"

The .env file contains passwords and must have owner-only permissions:

chmod 600 ~/.vmware-storage/.env

Connection timeout to vCenter

The doctor command tests connectivity with a 5-second TCP timeout. If your vCenter is on a high-latency network, the check may fail even though the connection works. Use --skip-auth to bypass both connectivity and auth checks, then test manually.

invalid peer certificate: UnknownIssuer when starting MCP via uvx

Corporate TLS proxies inject certificates that uv's bundled CA store doesn't trust. Use the recommended vmware-storage mcp form (no PyPI re-resolve), or set export UV_NATIVE_TLS=true to make uv use system CAs.