[READ] List all Virtual Services with name, VIP, enabled state, and health score.

Use this for an overview before drilling into a specific VS with vs_status.

Args: controller: AVI controller name from config (optional, uses default).

[READ] Show detailed status for a specific Virtual Service — VIP, pool, health, connections, and throughput.

Use vs_list first to find the exact VS name.

Args: name: Exact Virtual Service name.

[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to this VS.

Use vs_status first to check current state.

SAFETY: When enable=False, requires confirmed=True to execute. Default False returns a preview message describing the intended action. Enabling a VS is always safe and does not require confirmation.

Args: name: Exact Virtual Service name. enable: true to enable, false to disable. confirmed: Must be True when enable=False to actually disable the VS. Default False returns a preview-only message. Ignored when enable=True.

[READ] Discover pools on the Controller.

Use this BEFORE pool_members when you don't know exact pool names — pools often have different names from VS. Pass vs_filter to narrow to pools referenced by matching Virtual Services.

Args: vs_filter: Optional substring to match VS names (e.g. 'web') — returns pools referenced by those VS only.

[READ] List all members of a pool with server IP, port, enabled state, and health status.

Use this before enabling/disabling individual members during maintenance windows. Run pool_list first if you don't know the exact pool name.

Args: pool: Pool name.

[WRITE] Enable a pool member to start receiving traffic.

Use pool_members first to verify server IP and current state.

Args: pool: Pool name. server: Server IP address.

[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.

Use during maintenance windows or rolling deployments.

SAFETY: Requires confirmed=True to execute. Default False returns a preview message describing the intended action.

Args: pool: Pool name. server: Server IP address. confirmed: Must be True to actually disable the pool member. Default False returns a preview-only message.

[READ] List all SSL/TLS certificates on the AVI Controller with name, type, issuer, and expiry date.

[READ] Check which SSL certificates expire within N days (default 30).

Returns certificate name, expiry date, and days remaining. Run regularly to prevent outages.

Args: days: Check certs expiring within this many days (default 30).

[READ] Show analytics for a Virtual Service — throughput, latency percentiles, connection rate, and error breakdown.

Use to investigate performance issues.

Args: vs_name: Virtual Service name.

[READ] Show recent request error logs for a Virtual Service — HTTP status codes, client IPs, URIs, and response times.

Use to diagnose 5xx errors or latency spikes.

Args: vs_name: Virtual Service name. since: Time window, e.g. '1h', '30m', '2d' (default '1h').

[READ] List all Service Engines with name, status, connected VS count, and resource usage.

[READ] Check health of all Service Engines — CPU, memory, disk usage, and connectivity.

Use when VS health degrades to check if the issue is at the SE level.

[READ] Check AKO (AVI Kubernetes Operator) pod status — running, restarts, age, and ready state.

First step when troubleshooting Ingress or LoadBalancer issues in Tanzu/K8s.

Args: context: K8s context name (optional, uses current context).

[READ] View AKO pod logs to debug Ingress creation failures, sync errors, or AVI Controller connectivity issues.

Use 'since' to narrow the time window.

Args: tail: Number of log lines to show (default 100). since: Time filter, e.g. '30m', '1h'.

[WRITE] Restart AKO pod by deleting it (K8s recreates automatically).

Use when AKO is stuck or after config changes. Brief traffic disruption possible during restart.

SAFETY: Requires confirmed=True to execute. Default False returns a preview message describing the intended action.

Args: context: K8s context name (optional). confirmed: Must be True to actually restart the AKO pod. Default False returns a preview-only message.

[READ] Show AKO version, Helm chart version, and container image tag.

Use to verify AKO version compatibility with AVI Controller.

Args: context: K8s context name (optional).

[READ] Show current AKO Helm values.yaml configuration — controller IP, cloud name, network settings, and feature flags.

[READ] Show pending Helm value changes that haven't been applied yet.

Use before ako_config_upgrade to review what will change.

[WRITE] Apply AKO Helm upgrade with updated values. Defaults to dry_run=true for safety.

Set dry_run=false to apply. Requires double confirmation for non-dry-run.

Args: dry_run: Preview changes without applying (default true).

[READ] Validate Ingress annotations in a namespace — checks for unsupported or misspelled AKO annotations that prevent VS creation.

Args: namespace: K8s namespace to check. context: K8s context name (optional).

[READ] Show mapping between K8s Ingress resources and AVI Virtual Services.

Use to verify which Ingresses have corresponding VS objects.

Args: context: K8s context name (optional).

[READ] Diagnose why a specific Ingress has no corresponding Virtual Service.

Checks annotations, TLS config, service endpoints, and AKO logs for errors.

Args: name: Ingress resource name. namespace: K8s namespace (default 'default'). context: K8s context name (optional).

[READ] Suggest specific fixes for Ingress issues — returns actionable kubectl commands or annotation corrections based on the diagnosed problem.

Args: name: Ingress resource name. namespace: K8s namespace (default 'default'). context: K8s context name (optional).

[READ] Check sync status between K8s resources and AVI Controller objects.

Shows in-sync, pending, and error counts.

Args: context: K8s context name (optional).

[READ] Show specific inconsistencies between K8s Ingress/Service definitions and AVI Controller VS/Pool objects.

Use to identify drift.

Args: context: K8s context name (optional).

[WRITE] Force AKO to resync all K8s resources with AVI Controller.

Use when drift is detected. May cause brief traffic disruption.

SAFETY: Requires confirmed=True to execute. Default False returns a preview message describing the intended action.

Args: context: K8s context name (optional). confirmed: Must be True to actually force the resync. Default False returns a preview-only message.

[READ] List all K8s clusters that have AKO deployed, with version and status.

[READ] Cross-cluster AKO overview — VS count, pool count, health summary per cluster.

Use for multi-cluster fleet health assessment.

[READ] Show AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status — global services, member clusters, and federation health.