[READ] Check if this vCenter supports VKS (requires vSphere 8.x+).

Returns: compatible (bool), vcenter_version, wcp_enabled_clusters, hint. Call this first before any VKS operations.

[READ] Get the status of one Supervisor Cluster (vSphere with Tanzu control plane).

Returns cluster_id, config_status (RUNNING = healthy, CONFIGURING, ERROR, REMOVING), kubernetes_status (READY / WARNING / ERROR), api_server_cluster_endpoint (Supervisor K8s API address), kubernetes_version (from the software/clusters endpoint; null plus a kubernetes_version_hint if that call fails), and network_provider. Read-only. Run check_vks_compatibility first to discover cluster IDs; use this to verify a Supervisor is healthy before creating namespaces or TKC clusters on it.

Args: cluster_id: Compute cluster MoRef ID, e.g. 'domain-c1' (from the wcp_clusters field of check_vks_compatibility). target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[READ] List vCenter storage policies (the policies assigned to Supervisor Namespaces).

Returns a list of {policy (policy ID), name (display name), description}. Returns all policies in one call — no pagination. Read-only, no side effects. Call this before create_namespace or update_namespace to obtain a valid storage_policy value (pass the 'policy' ID). For PVC-level usage inside a namespace, use list_namespace_storage_usage instead.

Args: target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[READ] List all vSphere Namespaces on the target vCenter with their configuration status.

Returns a list of objects: namespace (name), config_status (RUNNING = healthy, CONFIGURING = being set up, REMOVING = being deleted, ERROR = failed), and description. Returns all namespaces in one call — no pagination. Read-only, no side effects. Use this to discover namespace names, then call get_namespace for full details of one, or update_namespace / delete_namespace to change it.

Args: target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[READ] Get detailed information for a single vSphere Namespace.

Args: name: Namespace name (e.g. 'dev', 'production'). target: vCenter target name (uses default if not specified).

[WRITE] Create a vSphere Namespace on a Supervisor Cluster.

IMPORTANT: dry_run=True by default — set dry_run=False to actually create.

Args: name: Namespace name (lowercase, no spaces). cluster_id: Supervisor cluster MoRef (use get_supervisor_status to find). storage_policy: Storage policy name (use list_supervisor_storage_policies). cpu_limit: CPU limit in MHz (optional). memory_limit_mib: Memory limit in MiB (optional). dry_run: Preview without creating (default: True).

[WRITE] Update resource quotas or storage policy of an existing vSphere Namespace.

Only the fields you provide are patched; omitted fields keep their current values. If no field is provided, returns status "no_changes" without calling the API. On success returns {namespace, status: "updated"}. Applies immediately (no dry_run); not destructive. Audited to ~/.vmware/audit.db (SQLite) and ~/.vmware-vks/audit.log (JSON Lines). Use create_namespace for new namespaces; use list_supervisor_storage_policies to find valid storage_policy values.

Args: name: Existing namespace name (discover via list_namespaces). cpu_limit: New CPU limit in MHz. Omit to keep current. memory_limit_mib: New memory limit in MiB. Omit to keep current. storage_policy: New storage policy name. Omit to keep current. target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[WRITE] Delete a vSphere Namespace.

SAFETY: Rejects if TKC clusters exist inside. Delete TKC clusters first. IMPORTANT: dry_run=True by default — set dry_run=False AND confirmed=True to delete.

Args: name: Namespace name to delete. confirmed: Must be True to proceed (safety gate). dry_run: Preview without deleting (default: True).

[READ] List VM classes available for sizing TKC cluster nodes.

Returns a list of {id (class name, e.g. 'best-effort-large'), cpu_count (vCPUs), memory_mb (RAM in MB), gpu_count (vGPU + dynamic DirectPath I/O devices; 0 if none)}. Returns all classes in one call — no pagination. Read-only, no side effects. Call this before create_tkc_cluster and pass the chosen 'id' as its vm_class argument; 'guaranteed-' classes reserve resources, 'best-effort-' classes do not.

Args: target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[READ] List TanzuKubernetesCluster (TKC) clusters.

Args: namespace: vSphere Namespace to filter by (lists all if not specified). target: vCenter target name.

Returns: total count and list of clusters with status and K8s version.

[READ] Get detailed info for a single TKC cluster.

Args: name: TKC cluster name. namespace: vSphere Namespace containing the cluster. target: vCenter target name.

[READ] List Kubernetes versions (TanzuKubernetesReleases) available on the Supervisor.

Returns {versions: [{name (release name), version (e.g. 'v1.28.4+vmware.1')}]} sorted newest first. If the TanzuKubernetesRelease API is unavailable on this Supervisor, returns an empty versions list with error and hint fields instead of raising. Read-only, no side effects. Call this before create_tkc_cluster or upgrade_tkc_cluster to pick a valid k8s_version.

Args: namespace: vSphere Namespace used to reach the Supervisor K8s API. target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[WRITE] Create a TanzuKubernetesCluster.

IMPORTANT: dry_run=True by default — returns YAML plan. Set dry_run=False to apply.

Workflow: call get_tkc_available_versions first to find valid k8s_version, call list_vm_classes to find valid vm_class.

Args: name: Cluster name. namespace: vSphere Namespace. k8s_version: K8s version (e.g. 'v1.28.4+vmware.1'). vm_class: VM class for nodes (e.g. 'best-effort-large'). control_plane_count: 1 or 3. worker_count: Number of worker nodes (>= 1). storage_class: Storage class name. dry_run: Return YAML plan without applying (default: True).

[WRITE] Scale the worker node count of an existing TanzuKubernetesCluster (TKC).

Asynchronous: patches the cluster spec and returns immediately with status "scaling" — node provisioning or removal continues in the background; poll get_tkc_cluster to watch progress. Scales workers only (control plane is unchanged); use upgrade_tkc_cluster to change the K8s version instead. Not destructive, but reducing worker_count drains the removed nodes. Audited to ~/.vmware/audit.db (SQLite) and ~/.vmware-vks/audit.log (JSON Lines).

Args: name: TKC cluster name (discover via list_tkc_clusters). namespace: vSphere Namespace containing the cluster. worker_count: Desired total worker node count, integer >= 1 (values below 1 are rejected with an error). pool_name: Node pool (machineDeployment) to scale. Omit to scale the first existing pool. Other pools are always preserved. target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[WRITE] Upgrade TKC cluster to a new K8s version.

Args: name: TKC cluster name. namespace: vSphere Namespace. k8s_version: Target K8s version (use get_tkc_available_versions to list).

[WRITE] Delete a TKC cluster.

SAFETY: Rejects if Deployments/StatefulSets are running (unless force=True). IMPORTANT: dry_run=True by default — set dry_run=False AND confirmed=True to delete.

Args: name: TKC cluster name. namespace: vSphere Namespace. confirmed: Must be True to proceed (safety gate). dry_run: Preview without deleting (default: True). force: Skip workload check (dangerous).

[READ] Get kubeconfig for the Supervisor K8s API endpoint.

Security: The returned kubeconfig contains a short-lived session token. Treat the raw output as a credential — do not log or share.

Args: namespace: vSphere Namespace (context for the kubeconfig). target: vCenter target name.

Returns: kubeconfig YAML string.

[READ] Get kubeconfig for a TKC cluster.

Security: The returned kubeconfig contains a short-lived session token. Prefer writing to file (output_path) over returning inline to reduce credential exposure in agent context.

Args: name: TKC cluster name. namespace: vSphere Namespace. output_path: Write to file if provided (e.g. '~/.kube/my-cluster.yaml'). Returns kubeconfig string if not specified.

[READ] Get status of the embedded Harbor container registry on the Supervisor.

Returns {registries: [...]} where each entry has id (registry ID), cluster (Supervisor cluster MoRef), version, url (UI access URL), status (registry health, e.g. RUNNING), and storage_used_mb. Status and storage come from a per-registry detail call and are null if that call fails. If Harbor is not enabled on this Supervisor, returns {error, hint} instead of raising. Read-only, no side effects. Use this to check registry health or find the registry URL before pushing images; it does not list repositories or images.

Args: target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.

[READ] List PersistentVolumeClaims and storage usage inside one vSphere Namespace.

Connects to the Supervisor K8s API and returns {namespace, pvc_count, pvcs: [{name, namespace, status (Bound / Pending / Lost), capacity (e.g. '10Gi'), storage_class}]}. Returns all PVCs — no pagination. Read-only, no side effects. Use list_namespaces to find namespace names; use list_supervisor_storage_policies for policy-level (not PVC-level) information.

Args: namespace: vSphere Namespace name to inspect. target: Name of a vCenter entry in ~/.vmware-vks/config.yaml. Omit to use the default target defined in that file.