Introduction

Nutanix Prism Central (PC) is the multi-cluster management plane for a Nutanix environment. It exposes the modern v3 intent APIs and the v4 namespaced APIs (Cluster Management, Security) that manage certificates, certificate authorities, certificate signing requests, key management servers, credentials, and SNMPv3 configuration across every registered cluster.

The Nutanix Prism Central Discovery Plugin connects to a single Prism Central endpoint, automatically discovers all clusters it manages, and catalogs the cryptographic assets exposed through the v3/v4 APIs — across every cluster plus the Prism Central-scoped security configuration.

For direct single-cluster discovery through Prism Element (v1/v2 APIs), use the companion nutanix-pe-plugin instead.

Features

  • Automatic multi-cluster discovery — lists all managed clusters via the v4 Cluster Management API, with a v3 intent-API fallback, and scans each cluster.
  • Live TLS certificate capture — performs a TLS handshake on the Prism Central URL (always) and per-cluster external IPs (when available). Clusters without an external IP are skipped for TLS probing.
  • SSL certificate + CA chain — retrieves each cluster's SSL certificate and CA chain via the v4 Cluster Management API.
  • Managed certificates — enumerates managed certificates per cluster (paginated).
  • Certificate authorities — enumerates per-cluster certificate authorities.
  • Certificate signing requests — lists pending CSRs per cluster and reports metadata (common name, purpose, PEM availability). CSR material is downloaded to confirm PEM availability but only metadata is emitted.
  • SNMPv3 keys — reports SNMPv3 users carrying authentication/privacy keys via the v4.2 Cluster Management API. Key values are emitted as separate secret assets (auth-key and priv-key) when present; users with no keys are skipped.
  • Key Management Servers (Security v4.1) — reports KMIP client and CA certificates (from certPem/caPem) and cloud KMS configuration with a key identifier.
  • Credentials (Security v4.1) — reports externally-stored credential configurations that reference a target URL or address. Entries with only administrative metadata (name, validity) are omitted since credential material is write-only server-side.
  • Shared formatter library — all output is produced through the shared common/formatter and common/plugincli packages for standards-compliant, consistent asset records (cert_pem without embedded newlines, PEM-intrinsic fields derived from the certificate, not duplicated in extra).