[READ] Check whether this vCenter supports VKS (requires vSphere 8.x+).

Returns compatible (bool), vcenter_version, wcp_enabled_clusters and wcp_clusters ({cluster, status}). Start here: those cluster MoRefs are the cluster_id for get_supervisor_status and create_namespace. Only reports vCenter-level support — a listed cluster may still be CONFIGURING.

Args: target: vCenter in config.yaml; omit for the default.

[READ] Get the health of one Supervisor Cluster (vSphere with Tanzu control plane).

Returns cluster_id, config_status (RUNNING = healthy, else CONFIGURING / ERROR / REMOVING), kubernetes_status (READY / WARNING / ERROR), api_server_cluster_endpoint, kubernetes_version (null plus kubernetes_version_hint if unavailable), and network_provider. Run check_vks_compatibility first for cluster IDs; use this to confirm a Supervisor is healthy before create_namespace or create_tkc_cluster.

Args: cluster_id: Compute cluster MoRef, e.g. 'domain-c1' (wcp_clusters field of check_vks_compatibility). target: vCenter in config.yaml; omit for the default.

[READ] List vCenter storage policies assignable to Supervisor Namespaces.

Returns the list envelope: items of {policy (ID), name, description} plus returned/total/truncated — one call returns them all, so truncated is always false. Call this before create_namespace or update_namespace and pass the 'policy' ID as their storage_policy. For PVC-level usage use list_namespace_storage_usage instead.

Args: target: vCenter in config.yaml; omit for the default.

[READ] List all vSphere Namespaces on the target vCenter with their status.

Returns the list envelope: items of {namespace, config_status (RUNNING = healthy, CONFIGURING, REMOVING, ERROR), description} plus returned/total/truncated — one call returns them all, so truncated is always false. Start here, then call get_namespace for detail, list_tkc_clusters for what runs inside, or update_namespace / delete_namespace to change one.

Args: target: vCenter in config.yaml; omit for the default.

[READ] Get detailed configuration for a single vSphere Namespace.

Returns one raw vCenter namespace object, not the list envelope: config_status, description, storage_specs, quotas. Use list_namespaces first for the name; follow with list_namespace_storage_usage for PVC usage or list_tkc_clusters for the clusters inside. Point-in-time only — a CONFIGURING namespace may not have quotas applied.

Args: name: Namespace name, e.g. 'dev' (discover via list_namespaces). target: vCenter in config.yaml; omit for the default.

[WRITE] Create a vSphere Namespace on a Supervisor Cluster.

Returns {namespace, status: "created", cluster}, or {dry_run, spec} — a dry run unless dry_run=False. Use update_namespace instead when it already exists; confirm with get_namespace afterwards.

Args: name: Namespace name (lowercase, no spaces). cluster_id: Supervisor MoRef (from check_vks_compatibility). storage_policy: Policy ID (from list_supervisor_storage_policies). cpu_limit: MHz. Omit for no limit. memory_limit_mib: MiB. Omit for no limit. description: Free-text label. Omit for none. dry_run: Preview only (default: True). target: vCenter in config.yaml; omit for the default.

[WRITE] Update resource quotas or storage policy of an existing vSphere Namespace.

Only the fields you pass are patched; omitting all of them returns status "no_changes" without an API call, otherwise {namespace, status: "updated"}. Applies immediately — no dry run, no undo. Use this rather than create_namespace when the namespace exists; valid storage_policy values come from list_supervisor_storage_policies.

Args: name: Existing namespace name (discover via list_namespaces). cpu_limit: New CPU limit in MHz. Omit to keep current. memory_limit_mib: New memory limit in MiB. Omit to keep current. storage_policy: New storage policy ID. Omit to keep current. target: vCenter in config.yaml; omit for the default.

[WRITE] Delete a vSphere Namespace and everything inside it.

Returns {namespace, status: "deleted"}, or a preview by default. SAFETY: refused while TKC clusters exist inside — run list_tkc_clusters to see them, then delete_tkc_cluster on each. A dry run unless you pass dry_run=False AND confirmed=True. Irreversible; prefer update_namespace to only change quotas.

Args: name: Namespace name to delete (discover via list_namespaces). confirmed: Must be True to proceed. dry_run: Preview only (default: True). target: vCenter in config.yaml; omit for the default.

[READ] List VM classes available for sizing TKC cluster nodes.

Returns the list envelope: items of {id (e.g. 'best-effort-large'), cpu_count, memory_mb, gpu_count (vGPU + DirectPath I/O; 0 if none)} plus returned/total/truncated — one call returns them all, so truncated is always false. Call this before create_tkc_cluster and pass the chosen 'id' as its vm_class; 'guaranteed-' classes reserve resources, 'best-effort-' do not.

Args: target: vCenter in config.yaml; omit for the default.

[READ] List TanzuKubernetesCluster (TKC) clusters, optionally in one namespace.

Returns the family list envelope: {items: [{name, namespace, phase, k8s_version}], returned, limit, total, truncated, hint}. The Supervisor list is walked to completion, so truncated is always False. Start here, then call get_tkc_cluster for full detail or get_tkc_kubeconfig for access. 'clusters' is a deprecated pre-1.8.0 alias of 'items', removed in 2.0 — read 'items'.

Args: namespace: vSphere Namespace to filter by. Omit to list every one. target: vCenter in config.yaml; omit for the default.

[READ] Get detailed status for a single TKC cluster.

Returns one object, not the list envelope: name, namespace, phase, k8s_version, control_plane_replicas, worker_replicas, conditions, infrastructure_ready, control_plane_ready. Run list_tkc_clusters first — a TKC name is only unique within one namespace. Poll this after create_tkc_cluster, scale_tkc_cluster or upgrade_tkc_cluster to watch an async change land.

Args: name: Cluster name (via list_tkc_clusters). namespace: Namespace holding it. target: vCenter in config.yaml; omit for the default.

[READ] List Kubernetes versions (TanzuKubernetesReleases) available on the Supervisor.

Returns {versions: [{name, version, e.g. 'v1.28.4+vmware.1'}]}, newest first. If the TanzuKubernetesRelease API is unavailable it returns an empty versions list with error and hint rather than raising. Call this before create_tkc_cluster or upgrade_tkc_cluster to pick a valid k8s_version.

Args: namespace: vSphere Namespace used to reach the Supervisor K8s API. target: vCenter in config.yaml; omit for the default.

[WRITE] Create a TanzuKubernetesCluster in a vSphere Namespace.

A dry run unless you pass dry_run=False; it then returns {name, namespace, status: "creating", yaml} and provisions in the background — poll get_tkc_cluster until phase is running. Call get_tkc_available_versions for k8s_version and list_vm_classes for vm_class first.

Args: name: Cluster name. namespace: Must already exist (see list_namespaces). k8s_version: e.g. 'v1.28.4+vmware.1'. vm_class: Node sizing, e.g. 'best-effort-large'. control_plane_count: 1 or 3. worker_count: Worker nodes (>= 1). storage_class: Storage class. dry_run: YAML plan only (default: True). target: vCenter in config.yaml; omit for the default.

[WRITE] Scale the worker node count of an existing TanzuKubernetesCluster (TKC).

Asynchronous: returns {name, namespace, pool, worker_count, status: "scaling"} immediately — poll get_tkc_cluster to watch nodes appear or drain. Scales workers only; use upgrade_tkc_cluster instead for the K8s version. Not destructive, but lowering worker_count drains removed nodes.

Args: name: Cluster name (via list_tkc_clusters). namespace: Namespace holding it. worker_count: Desired total, integer >= 1 (below 1 is rejected). pool_name: Node pool (machineDeployment). Omit for the first; other pools are always preserved. target: vCenter in config.yaml; omit for the default.

[WRITE] Upgrade a TKC cluster to a new Kubernetes version.

Returns {name, namespace, new_version, status: "upgrading"}. Asynchronous and irreversible — Kubernetes cannot be downgraded, so poll get_tkc_cluster until phase is running. There is no dry run. Use this only for the K8s version; prefer scale_tkc_cluster for node counts.

Args: name: Cluster name (via list_tkc_clusters). namespace: Namespace holding it. k8s_version: Target version from get_tkc_available_versions. target: vCenter in config.yaml; omit for the default.

[WRITE] Delete a TKC cluster and all of its nodes.

Returns {name, namespace, status: "deleting"}, or a preview by default. SAFETY: refused while Deployments/StatefulSets run, unless force=True. A dry run unless you pass dry_run=False AND confirmed=True. Irreversible — use scale_tkc_cluster instead for fewer nodes. Empty a namespace of TKC clusters before delete_namespace accepts it.

Args: name: Cluster name (via list_tkc_clusters). namespace: Namespace holding it. confirmed: Must be True to proceed. dry_run: Preview only (default: True). force: Skip the workload check (dangerous). target: vCenter in config.yaml; omit for the default.

[READ] Get a kubeconfig for the Supervisor K8s API endpoint.

Returns {namespace, kubeconfig} as a YAML string. Use this for Supervisor-level access; use get_tkc_kubeconfig instead to reach workloads inside a TKC cluster. Security: it carries a short-lived session token — treat it as a credential, do not log or share.

Args: namespace: vSphere Namespace to set as the kubeconfig context. target: vCenter in config.yaml; omit for the default.

[READ] Get a kubeconfig for one TKC cluster.

Returns {cluster, kubeconfig}, or {cluster, written_to} when output_path is given. Run list_tkc_clusters first for name and namespace; use get_supervisor_kubeconfig instead for Supervisor-level access. Security: it carries a short-lived session token — always prefer output_path so the credential never enters agent context.

Args: name: TKC cluster name. namespace: Namespace holding it. output_path: File to write, e.g. '~/.kube/my.yaml'. Omit to return the kubeconfig inline. target: vCenter in config.yaml; omit for the default.

[READ] Get status of the embedded Harbor container registry on the Supervisor.

Returns {registries: [{id, cluster (Supervisor MoRef), version, url, status, storage_used_mb}]}; status and storage come from a detail call and are null if it fails. If Harbor is not enabled it returns {error, hint} rather than raising. Use it to check registry health or find the push URL — it does not list repositories or images. Run check_vks_compatibility first if the Supervisor may be down.

Args: target: vCenter in config.yaml; omit for the default.

[READ] List PersistentVolumeClaims and storage usage inside one vSphere Namespace.

Via the Supervisor K8s API. Returns the family list envelope: {namespace, items: [{name, namespace, status (Bound / Pending / Lost), capacity ('10Gi'), storage_class}], returned, limit, total, truncated, hint}. Every PVC comes back in one call, so truncated is always False. Run list_namespaces first for the namespace; use list_supervisor_storage_policies instead for policy-level rather than PVC-level information. 'pvcs' and 'pvc_count' are deprecated pre-1.8.0 aliases of 'items' and 'returned', removed in 2.0 — read 'items'.

Args: namespace: Namespace to inspect. target: vCenter in config.yaml; omit for the default.