[READ] List Virtual Services on the AVI Controller.

Returns Name, Enabled, VIP and short UUID for every VS in one call; it cannot be paged or filtered, and carries no health score. Use this before drilling into one VS with vs_status.

Args: controller: Controller name from config (optional, uses default).

[READ] Detailed status for one Virtual Service: VIP, pool, health, connections, throughput.

Returns one detail block, not a list. Use vs_list first for the exact name — a name that does not match exactly fails. Then vs_analytics for metrics, vs_error_logs for 5xx.

Args: name: Exact Virtual Service name.

[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to it.

Returns a one-line result. Use vs_status first to check current state.

SAFETY: disabling requires confirmed=True; without it you get a preview only. Enabling is always safe.

Args: name: Exact Virtual Service name. enable: true to enable, false to disable.

[READ] Discover pools on the Controller.

Returns Name, member count, Enabled and short UUID per pool. Use this before pool_members: pools are often named differently from the VS that use them.

Args: vs_filter: Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools.

[READ] List the members of a pool.

Returns Server IP, Port, Enabled and Ratio per member. Use before pool_member_enable or pool_member_disable; run pool_list first for the pool name. Reports configured state only, not live health-monitor results.

Args: pool: Pool name.

[WRITE] Enable a pool member so it receives traffic again.

Returns a one-line confirmation. Use pool_members first to verify the server IP. The server must already belong to the pool — this adds nothing.

Args: pool: Pool name. server: Server IP address.

[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.

Returns a one-line result. Use for maintenance or rolling deployments; run pool_members first for the server IP, pool_member_enable to reverse it.

SAFETY: requires confirmed=True; without it you get a preview only.

Args: pool: Pool name. server: Server IP address.

[READ] List SSL/TLS certificates stored on the AVI Controller.

Returns Name, Subject, Expiry and Type per certificate, in one call that cannot be paged or filtered. Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon.

[READ] Check which SSL certificates expire within N days (default 30).

Returns name, expiry date and days remaining, soonest first. Use this instead of ssl_list when you only want certificates near expiry. Expired certs are included, with negative days remaining.

Args: days: Report certs expiring within this many days (default 30).

[READ] Performance metrics for one Virtual Service over the last hour.

Returns L4 (bandwidth, connections) and L7 (latency, % errors, responses) averages over a fixed window that cannot be changed (12 samples, 5 min apart). Empty output means no traffic, not an error. Use when vs_status shows degraded health; vs_error_logs gives per-request detail.

Args: vs_name: Exact Virtual Service name, case-sensitive, from vs_list.

[READ] Recent request error logs for one Virtual Service.

Returns up to 50 lines — timestamp, HTTP status, URI path, client IP — for status 400 and above. Use this instead of vs_analytics for per-request detail. An empty result may mean no errors, or capture disabled on the VS.

Args: vs_name: Exact Virtual Service name, from vs_list. since: Window — seconds or '30m', '1h', '2d' (default '1h').

[READ] List Service Engines (AVI data-plane VMs) on the Controller.

Returns Name, management IP, status (e.g. OPER_UP) and SE Group per SE, in one call that cannot be paged or filtered. Use to inventory capacity or find an SE's name and IP — use se_health instead for degraded VS health.

[READ] Health of every Service Engine — operational status and VS counts.

Returns name, operational state and the number of VSes placed on each SE. Use when VS health degrades to check if the issue is at the SE level; se_list gives the management IP and SE Group, vs_status the affected VS. An SE hosting no VS reports 0, not an error.

[READ] Check AKO (AVI Kubernetes Operator) pod status in Kubernetes.

Returns pod name, phase, ready flag, restart count and namespace. First step for Ingress or LoadBalancer issues in Tanzu/K8s; follow with ako_logs when it is not Running. Looks in one context's AKO namespace only — run ako_clusters if not found.

Args: context: K8s context name (optional, uses current context).

[READ] AKO pod logs — Ingress creation failures, sync errors, Controller connectivity.

Returns raw log text, not a table. Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress. Only the running container's logs are returned.

Args: tail: Number of log lines (default 100). since: Narrows the window, e.g. '30m', '1h'. context: K8s context (optional, uses current).

[WRITE] Restart the AKO pod by deleting it — its StatefulSet recreates it.

Returns a one-line result. Use when AKO is stuck or after config changes; brief traffic disruption is possible. Run ako_status afterwards, and ako_logs if the pod is not Running.

SAFETY: requires confirmed=True; without it you get a preview only.

Args: context: K8s context name (optional).

[READ] AKO version running in a cluster, read from the pod's image tag.

Returns the pod name and an Image/Version pair per container. Use it to check compatibility with the Controller, and before ako_config_diff or ako_config_upgrade so both target the installed chart. The tag is the only source, so 'latest' reports 'latest', not a number.

Args: context: K8s context name (optional).

[READ] The AKO Helm release's values — controller IP, cloud name, network settings, feature flags.

Returns YAML as helm reports it. Use this first to read the live config; use ako_config_diff instead to see what an upgrade would change. Only values supplied at install time appear; chart defaults do not.

[READ] Pending Helm value changes that have not been applied yet.

Returns helm's diff output; empty means nothing would change. Use this before ako_config_upgrade — it runs the same command, so the preview is real. Note: with chart_version empty the registry's moving latest is resolved, so two runs can differ with no local change; read ako_version and pass it to both.

Args: chart_version: Pin the chart, e.g. "1.11.1". Empty = registry latest.

[WRITE] Apply an AKO Helm upgrade (dry_run=true by default).

Returns helm's output. Run ako_config_diff first to review the change. Finds the avi-system release automatically and upgrades the Broadcom OCI chart with --reuse-values.

SAFETY: applying (dry_run=False) requires confirmed=True, else preview only.

Args: dry_run: Preview without applying (default true). chart_version: Pin the chart, e.g. "1.11.1". Empty = registry latest.

[READ] Validate every Ingress in one namespace: IngressClass and TLS secret references that would stop AKO creating a Virtual Service.

Returns name, IngressClass, issues and OK/ISSUES per Ingress. Run ako_ingress_map first for namespace names; use ako_ingress_diagnose instead for one named Ingress. Covers one namespace only, and TLS checks are skipped when its secrets cannot be listed.

Args: namespace: K8s namespace to check. context: K8s context name (optional).

[READ] Inventory Kubernetes Ingresses across all namespaces.

Returns Namespace, Ingress name, Host(s) and IngressClass per Ingress. Start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. Lists the K8s side only — use ako_sync_diff for Ingresses with no Controller object.

Args: context: K8s context name (optional).

[READ] Diagnose why one Ingress has no corresponding AVI Virtual Service.

Validates IngressClass ('avi'/'avi-lb'), TLS secrets and backend Services. Returns annotations, a numbered issue list and kubectl fixes. Use ako_ingress_map first to find Ingresses lacking a VS. Checks configuration only; when it is clean, try ako_logs and ako_sync_status.

Args: name: Exact Ingress resource name. namespace: Namespace holding the Ingress (default 'default'). context: kubeconfig context (optional), from ako_clusters.

[READ] Compare the number of K8s Ingresses with the number of AVI Virtual Services.

Returns both counts and a match/mismatch verdict. Use this first as a cheap check, then ako_sync_diff for which objects differ. A count comparison only — in AKO shard mode many Ingresses share one VS, so a mismatch does not by itself mean trouble.

Args: context: K8s context name (optional).

[READ] List Ingresses with no matching Virtual Service or pool on the Controller.

Returns Type, namespace/name and Status per suspect Ingress. Use when ako_sync_status reports a mismatch; ako_sync_force reconciles. Shard-mode Ingresses are matched heuristically against AKO pool names, so confirm a 'Missing' result with pool_list before acting.

Args: context: K8s context name (optional).

[WRITE] Force AKO to resync all K8s resources with the AVI Controller.

Returns a one-line result. Use when drift is detected; may cause brief traffic disruption. Run ako_sync_diff first to see what is out of sync, then ako_sync_status.

SAFETY: requires confirmed=True; without it you get a preview only.

Args: context: K8s context name (optional).

[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.

Returns Context, AKO Status (pod phase or 'Not deployed') and Version per context. Requires kubectl on PATH; every context is probed, so unreachable clusters add latency. Start here for context names, then pass one to ako_status, ako_logs or ako_ingress_diagnose.

[READ] AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status.

Returns raw kubectl output: the AMKO pods in avi-system, then the GSLBConfig YAML if one exists. Use this only for multi-cluster GSLB questions — for single-cluster AKO health use ako_status instead. Always reads the current kubectl context; see ako_clusters.