[READ] Validate every Ingress in one namespace: IngressClass and TLS secret references that would stop AKO creating a Virtual Service.

Returns name, IngressClass, issues and OK/ISSUES per Ingress. Run list_ako_ingresses first for namespace names; use diagnose_ako_ingress instead for one named Ingress. Covers one namespace only, and TLS checks are skipped when its secrets cannot be listed.

[READ] Check which SSL certificates expire within N days (default 30).

Returns name, expiry date and days remaining, soonest first. Use this instead of list_ssl_certs when you only want certificates near expiry. Expired certs are included, with negative days remaining. Certificates whose expiry could not be read are counted and named separately — they are unknown, not "not expiring".

[READ] Diagnose why one Ingress has no corresponding AVI Virtual Service.

Validates IngressClass ('avi'/'avi-lb'), TLS secrets and backend Services. Returns annotations, a numbered issue list and kubectl fixes. "Not found"/"missing" is reported only for a 404; any other error reading the Ingress, a TLS secret or a backend Service says it could not be read (with the HTTP status). Use list_ako_ingresses first to find Ingresses lacking a VS. Checks configuration only; when it is clean, try get_ako_logs and get_ako_sync_status.

[READ] Pending Helm value changes that have not been applied yet.

Returns helm's diff output; empty means nothing would change. Credential values in it read <redacted> — that is this skill blanking them, not the configured value. Use this before upgrade_ako_config — it runs the same command, so the preview is real. Note: with chart_version empty the registry's moving latest is resolved, so two runs can differ with no local change; read get_ako_version and pass it to both.

[READ] List Ingresses with no matching Virtual Service or pool on the Controller.

Returns Type, namespace/name and Status per suspect Ingress. Use when get_ako_sync_status reports a mismatch; force_ako_sync reconciles. Shard-mode Ingresses are matched heuristically against AKO pool names, so confirm a 'Missing' result with list_lb_pools before acting.

[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.

Without confirm=True this only previews: it returns blast_radius (pool name and uuid, the member's IP/port/state, and how many members are enabled before and after) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. An already disabled member returns action "noop".

Refused with confirm=True: the pool's only enabled member (the pool would serve nothing — enable another first, or use set_virtual_service_enabled on purpose), an IP that matches more than one member, and a pool whose members cannot be read. Use for maintenance or rolling deployments; run list_lb_pool_members first for the server IP, enable_lb_pool_member to reverse it.

[WRITE] Enable a pool member so it receives traffic again.

Returns a one-line confirmation. Use list_lb_pool_members first to verify the server IP. The server must already belong to the pool — this adds nothing.

[WRITE] Force AKO to resync all K8s resources with the AVI Controller.

The resync restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources. Without confirm=True this only previews: it returns blast_radius (context, namespace, the pod's name, uid and phase, and the Ingresses it re-programs) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet.

Refused with confirm=True: a pod already terminating, and a pod or Ingress list that cannot be read. Use when drift is detected; may cause brief traffic disruption. Run diff_ako_sync first to see what is out of sync, then get_ako_sync_status.

[READ] AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status.

Returns raw kubectl output: the AMKO pods in avi-system, then the GSLBConfig YAML if one exists. 'AMKO not deployed' means kubectl answered and found no AMKO pods; if kubectl cannot read the cluster the call fails with its reason. A GSLBConfig that cannot be read is reported, not skipped. Use this only for multi-cluster GSLB questions — for single-cluster AKO health use get_ako_status instead. Always reads the current kubectl context; see list_ako_clusters.

[READ] The AKO Helm release's values — controller IP, cloud name, network settings, feature flags.

Returns YAML as helm reports it. Use this first to read the live config; use diff_ako_config instead to see what an upgrade would change. Only values supplied at install time appear; chart defaults do not.

[READ] AKO pod logs — Ingress creation failures, sync errors, Controller connectivity.

Returns raw log text, not a table. Use when get_ako_status shows the pod unhealthy or diff_ako_sync reports a missing Ingress. Only the running container's logs are returned.

[READ] Check AKO (AVI Kubernetes Operator) pod status in Kubernetes.

Returns pod name, phase, ready flag, restart count and namespace. First step for Ingress or LoadBalancer issues in Tanzu/K8s; follow with get_ako_logs when it is not Running. Looks in one context's AKO namespace only — run list_ako_clusters if not found.

[READ] Compare the number of K8s Ingresses with the number of AVI Virtual Services.

Returns both counts and a match/mismatch verdict. Use this first as a cheap check, then diff_ako_sync for which objects differ. A count comparison only — in AKO shard mode many Ingresses share one VS, so a mismatch does not by itself mean trouble.

[READ] AKO version running in a cluster, read from the pod's image tag.

Returns the pod name and an Image/Version pair per container. Use it to check compatibility with the Controller, and before diff_ako_config or upgrade_ako_config so both target the installed chart. The tag is the only source, so 'latest' reports 'latest', not a number.

[READ] Health of every Service Engine — operational status and VS counts.

Returns name, operational state and the number of VSes placed on each SE. Use when VS health degrades to check if the issue is at the SE level; list_service_engines gives the management IP and SE Group, get_virtual_service_status the affected VS. An SE hosting no VS reports 0, not an error.

[READ] Performance metrics for one Virtual Service over the last hour.

Returns L4 (bandwidth, connections) and L7 (latency, % errors, responses) averages over a fixed window that cannot be changed (12 samples, 5 min apart). Empty output means no traffic, not an error. Use when get_virtual_service_status shows degraded health; get_virtual_service_error_logs gives per-request detail.

[READ] Recent request error logs for one Virtual Service.

Returns up to 50 lines — timestamp, HTTP status, URI path, client IP — for status 400 and above. Use this instead of get_virtual_service_analytics for per-request detail. An empty result may mean no errors, or capture disabled on the VS.

[READ] Detailed status for one Virtual Service: VIP, pool, health, connections, throughput.

Returns one detail block, not a list. Use list_virtual_services first for the exact name — a name that does not match exactly fails. If the runtime read fails, the block says so (with the HTTP status) and health is UNKNOWN. Then get_virtual_service_analytics for metrics, get_virtual_service_error_logs for 5xx.

[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.

Returns Context, AKO Status (pod phase, 'Not deployed' when kubectl answered with no AKO pods, or 'Unreachable'/'Unreadable' with kubectl's reason when it could not read the context — unknown, not absent) and Version per context. Fails when no context could be read. Requires kubectl on PATH; every context is probed, so unreachable clusters add latency. Start here for context names, then pass one to get_ako_status, get_ako_logs or diagnose_ako_ingress.

[READ] Inventory Kubernetes Ingresses across all namespaces.

Returns Namespace, Ingress name, Host(s) and IngressClass per Ingress. Start here for namespace and Ingress names, then pass them to check_ako_ingress or diagnose_ako_ingress. Lists the K8s side only — use diff_ako_sync for Ingresses with no Controller object.

[READ] List the members of a pool.

Returns Server IP, Port, Enabled and Ratio per member. Use before enable_lb_pool_member or disable_lb_pool_member; run list_lb_pools first for the pool name. Reports configured state only, not live health-monitor results.

[READ] Discover pools on the Controller.

Returns Name, member count, Enabled and short UUID per pool. Use this before list_lb_pool_members: pools are often named differently from the VS that use them.

[READ] List Service Engines (AVI data-plane VMs) on the Controller.

Returns Name, management IP, status (e.g. OPER_UP) and SE Group per SE, in one call that cannot be paged or filtered. Use to inventory capacity or find an SE's name and IP — use get_service_engine_health instead for degraded VS health.

[READ] List SSL/TLS certificates stored on the AVI Controller.

Returns Name, Subject, Expiry and Type per certificate, in one call that cannot be paged or filtered. Use for inventory or a certificate's exact name — use check_ssl_cert_expiry instead for only the ones expiring soon.

[READ] List Virtual Services on the AVI Controller.

Returns Name, Enabled, VIP and short UUID for every VS in one call; it cannot be paged or filtered, and carries no health score. Use this before drilling into one VS with get_virtual_service_status.

[WRITE] Restart the AKO pod by deleting it — its StatefulSet recreates it.

Without confirm=True this only previews: it returns blast_radius (context, namespace, the pod's name, uid, phase and restarts, and the Ingresses whose programming pauses until the new pod is Running) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. The pod deleted is the one measured (uid precondition).

Refused with confirm=True: a pod already terminating, and a pod or Ingress list that cannot be read. Use when AKO is stuck or after config changes; brief traffic disruption is possible. Run get_ako_status afterwards, and get_ako_logs if the pod is not Running.

[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to it.

Without confirm=True this only previews: it returns blast_radius (the VS name and uuid, whether it is enabled now, its VIPs and oper status, and the pools and member counts behind it) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. A VS already in the requested state returns action "noop".

Refused with confirm=True: a VS whose uuid or pools cannot be read (the change would be blind). Use get_virtual_service_status first to check current state.

[WRITE] Apply an AKO Helm upgrade to the avi-system release.

Finds the avi-system release automatically and upgrades the Broadcom OCI chart with --reuse-values. Without confirm=True this only previews: it returns blast_radius (release, the chart and app version it is on, revision and status, the chart it would move to) plus helm_dry_run, the output of helm upgrade --dry-run, and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet.

Refused with confirm=True: a failing dry-run (the real upgrade would fail too), a release with another helm operation pending, and a release whose status cannot be read. Helm output has credential values blanked to <redacted> by this skill. Run diff_ako_config first to review the change.