VK Cloud

Status: available · package wg-flow-plugin-vkcloud 0.1.0 · provider vkcloud · category cloud.

The plugin requests a Keystone token and reads the VK Cloud service catalog. Inventory receives servers (Nova), disks (Cinder), networks and floating IPs (Neutron), security groups, and load balancers (Octavia). The login and password stay in the agent YAML.

Defaults are Moscow: https://infra.mail.ru/infra/identity/v3, region RegionOne. For Kazakhstan, copy OS_AUTH_URL and OS_REGION_NAME from openrc.sh (Project settings → API access → Download openrc). project_id is OS_PROJECT_ID on that tab, not the id in the project switcher. API access must be enabled.

One source is one project. The plugin only reads the API.

Images, snapshots, file shares, backups, Kubernetes, databases, and object storage are not collected in 0.1.0. If the catalog has no Octavia endpoint, load balancers are skipped and the source still succeeds.

Install

The agent must be connected to the API.

docker compose exec agent wg-flow-agent plugin install vkcloud
# or
wg-flow-agent plugin install vkcloud

Then the local UI → Connections → vkcloud, or YAML.

What lands in inventory

VK Cloud object	resource_type	Notes
Cloud server	server	provider_resource_id = server:{id}. ACTIVE → active, SHUTOFF and paused → stopped, transitional states → pending, ERROR → error. Region is the availability zone. Floating IPv4 → metadata.primary_ipv4, private addresses → metadata.private_ips
Disk	storage	volume:{id}. available and in-use → active, creating → pending. Size in metadata.size_gb
Network	network	network:{id}. Subnet CIDRs in metadata.ip_ranges
Floating IP	network	floating-ip:{id}. metadata.product = floating_ip. DOWN → stopped
Security group	firewall	firewall:{id}. A short rule list in metadata
Load balancer	load_balancer	lb:{id}. operating_status: OFFLINE → stopped, provisioning_status: ERROR → error

Inventory has no separate ip type, so a floating IP is a network.

Each collect flag can be turned off. A disabled slice is absent from the next successful sync, and inventory marks those rows inactive. An error while listing servers, disks, networks, or security groups fails the whole source: a partial list is not sent.

Several projects mean several sources. provider_account is your label.

YAML

plugins:
  vkcloud:
    enabled: true
    sources:
      - id: msk
        provider_account: "vk-msk"
        sync_interval_seconds: 300
        auth_url: "https://infra.mail.ru/infra/identity/v3"
        region: "RegionOne"
        auth_type: password
        username: "user@example.com"
        password: "…"
        project_id: "…"
        user_domain_name: "users"
        collect_servers: true
        collect_volumes: true
        collect_networks: true
        collect_floating_ips: true
        collect_firewalls: true
        collect_load_balancers: true

Instead of a password, set auth_type: application_credential plus application_credential_id and application_credential_secret. The project scope then comes from the credential itself.

Source fields

Field	Required	Description
id	yes	Log key (vkcloud/msk)
provider_account	yes	Project label in inventory
auth_url	no	Default https://infra.mail.ru/infra/identity/v3
region	no	Default RegionOne. Empty uses the first public catalog endpoint
auth_type	no	password (default) or application_credential
username, password, project_id	for password	Project user and OS_PROJECT_ID
user_domain_name	no	Default users
application_credential_id, application_credential_secret	for application credential	The secret is shown once when the credential is created
collect_*	no	Default true
sync_interval_seconds	no	Minimum 300

Check

wg-flow-agent status
wg-flow-agent dry-run

JSON shows provider: vkcloud. Health requests a token and calls GET {nova}/servers/detail?limit=1. The password and secret are not stored in inventory.

Common errors

Symptom	What to check
401 / 403	Login, password, and OS_PROJECT_ID from the API access tab. API access is enabled
Compute endpoint not found	region matches OS_REGION_NAME. Kazakhstan needs its own auth_url
Empty server list	collect_servers is on; the project has servers
Disks disappeared after sync	collect_volumes was turned off; inventory retires omitted rows
No load balancers	The project catalog has no Octavia endpoint — the source did not fail
Duplicates from another plugin	A different provider is expected; merge them in the console