[READ] List all Virtual Services with name, VIP, enabled state, and health score.

Use this for an overview before drilling into a specific VS with vs_status.

Args: controller: AVI controller name from config (optional, uses default).

[READ] Show detailed status for a specific Virtual Service — VIP, pool, health, connections, and throughput.

Use vs_list first to find the exact VS name.

Args: name: Exact Virtual Service name.

[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to this VS.

Use vs_status first to check current state.

SAFETY: When enable=False, requires confirmed=True to execute. Default False returns a preview message describing the intended action. Enabling a VS is always safe and does not require confirmation.

Args: name: Exact Virtual Service name. enable: true to enable, false to disable. confirmed: Must be True when enable=False to actually disable the VS. Default False returns a preview-only message. Ignored when enable=True.

[READ] Discover pools on the Controller.

Use this BEFORE pool_members when you don't know exact pool names — pools often have different names from VS. Pass vs_filter to narrow to pools referenced by matching Virtual Services.

Args: vs_filter: Optional substring to match VS names (e.g. 'web') — returns pools referenced by those VS only.

[READ] List all members of a pool with server IP, port, enabled state, and health status.

Use this before enabling/disabling individual members during maintenance windows. Run pool_list first if you don't know the exact pool name.

Args: pool: Pool name.

[WRITE] Enable a pool member to start receiving traffic.

Use pool_members first to verify server IP and current state.

Args: pool: Pool name. server: Server IP address.

[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.

Use during maintenance windows or rolling deployments.

SAFETY: Requires confirmed=True to execute. Default False returns a preview message describing the intended action.

Args: pool: Pool name. server: Server IP address. confirmed: Must be True to actually disable the pool member. Default False returns a preview-only message.

[READ] List all SSL/TLS certificates stored on the AVI Controller.

Returns a table of certificate Name, Subject common name, Expiry date, and Type (e.g. CA vs virtual-service certificate), plus a total count. The full set is returned in one call — no pagination or filtering. No parameters required; connects to the default controller from config. Use for certificate inventory or to find a certificate's exact name; use ssl_expiry_check instead when you only need certificates expiring within the next N days.

[READ] Check which SSL certificates expire within N days (default 30).

Returns certificate name, expiry date, and days remaining. Run regularly to prevent outages.

Args: days: Check certs expiring within this many days (default 30).

[READ] Show performance metrics for one Virtual Service over the last hour.

Queries the AVI analytics collection API with a fixed window: 12 samples at 5-minute granularity. Returns L4 metrics (avg bandwidth, completed and new connections) and L7 metrics (avg client transaction latency, % response errors, total responses). Empty output means the VS had no traffic in the window or analytics collection is disabled — not an error. Use when investigating throughput or latency issues after vs_status shows degraded health; use vs_error_logs for per-request error detail with a configurable time window.

Args: vs_name: Exact Virtual Service name, case-sensitive, as shown by vs_list. Fails with a 'not found' message if no VS matches.

[READ] Show recent request error logs for a Virtual Service — HTTP status codes, client IPs, URIs, and response times.

Use to diagnose 5xx errors or latency spikes.

Args: vs_name: Virtual Service name. since: Time window, e.g. '1h', '30m', '2d' (default '1h').

[READ] List all Service Engines (AVI data-plane VMs) on the Controller.

Returns one row per SE: Name, management IP, operational status (e.g. OPER_UP), and SE Group, sourced from the serviceengine-inventory endpoint (config + runtime merged). The full list is returned in one call — no pagination or filtering. No parameters required; connects to the default controller from config. Use to inventory data-plane capacity or find an SE's name and IP; use se_health instead for per-SE operational status and connected-VS counts when investigating degraded Virtual Service health.

[READ] Check health of all Service Engines — operational status and connected-VS counts.

VS placement is reconstructed from the virtualservice-inventory placement map (vip_summary[].service_engine[]). Use when VS health degrades to check if the issue is at the SE level.

[READ] Check AKO (AVI Kubernetes Operator) pod status — running, restarts, age, and ready state.

First step when troubleshooting Ingress or LoadBalancer issues in Tanzu/K8s.

Args: context: K8s context name (optional, uses current context).

[READ] View AKO pod logs to debug Ingress creation failures, sync errors, or AVI Controller connectivity issues.

Use 'since' to narrow the time window.

Args: tail: Number of log lines to show (default 100). since: Time filter, e.g. '30m', '1h'. context: K8s context name (optional, uses current context).

[WRITE] Restart AKO pod by deleting it (its StatefulSet recreates it automatically).

Use when AKO is stuck or after config changes. Brief traffic disruption possible during restart.

SAFETY: Requires confirmed=True to execute. Default False returns a preview message describing the intended action.

Args: context: K8s context name (optional). confirmed: Must be True to actually restart the AKO pod. Default False returns a preview-only message.

[READ] Show AKO version, Helm chart version, and container image tag.

Use to verify AKO version compatibility with AVI Controller.

Args: context: K8s context name (optional).

[READ] Show current AKO Helm values.yaml configuration — controller IP, cloud name, network settings, and feature flags.

[READ] Show pending Helm value changes that haven't been applied yet.

Use before ako_config_upgrade to review what will change.

[WRITE] Apply AKO Helm upgrade with updated values. Defaults to dry_run=true for safety.

Discovers the AKO Helm release in avi-system automatically (official installs use --generate-name) and upgrades from the official Broadcom OCI chart with --reuse-values. Set dry_run=false to apply. Fails with a teaching error if no AKO release is installed.

SAFETY: When dry_run=False, requires confirmed=True to execute. Default False returns a preview message describing the intended action. Dry-run is always safe and does not require confirmation.

Args: dry_run: Preview changes without applying (default true). confirmed: Must be True when dry_run=False to actually apply the upgrade. Default False returns a preview-only message. Ignored when dry_run=True.

[READ] Validate Ingress annotations in a namespace — checks for unsupported or misspelled AKO annotations that prevent VS creation.

Args: namespace: K8s namespace to check. context: K8s context name (optional).

[READ] Show mapping between K8s Ingress resources and AVI Virtual Services.

Use to verify which Ingresses have corresponding VS objects.

Args: context: K8s context name (optional).

[READ] Diagnose why a specific Ingress has no corresponding AVI Virtual Service.

Reads the Ingress and validates three things: IngressClass is 'avi' or 'avi-lb', each referenced TLS secret exists, and every backend Service exists in the namespace. Returns the Ingress annotations, a numbered issue list, and concrete fix suggestions (kubectl commands). If configuration is clean, it points you to ako_logs and ako_sync_status as next steps. Use ako_ingress_map first to find which Ingresses are missing a VS, then diagnose one here.

Args: name: Exact Ingress resource name. Fails with 'not found' if absent. namespace: K8s namespace containing the Ingress (default 'default'). context: kubeconfig context name (optional; uses current context). Discover context names with ako_clusters.

[READ] Check sync status between K8s resources and AVI Controller objects.

Shows in-sync, pending, and error counts.

Args: context: K8s context name (optional).

[READ] Show specific inconsistencies between K8s Ingress/Service definitions and AVI Controller VS/Pool objects.

Use to identify drift.

Args: context: K8s context name (optional).

[WRITE] Force AKO to resync all K8s resources with AVI Controller.

Use when drift is detected. May cause brief traffic disruption.

SAFETY: Requires confirmed=True to execute. Default False returns a preview message describing the intended action.

Args: context: K8s context name (optional). confirmed: Must be True to actually force the resync. Default False returns a preview-only message.

[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.

Iterates contexts from kubectl config get-contexts (KUBECONFIG env var or ~/.kube/config) and probes the avi-system namespace in each. Returns a table of Context, AKO Status (pod phase, or 'Not deployed'), and AKO Version (image tag). No parameters or filtering — all contexts are checked, so unreachable clusters add latency. Requires kubectl on PATH. Start here to discover context names, then pass one as context to ako_status, ako_logs, or ako_ingress_diagnose.

[READ] Show AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status — global services, member clusters, and federation health.