[READ] Check whether this vCenter supports VKS (requires vSphere 8.x+).

Returns compatible (bool), vcenter_version, wcp_enabled_clusters and wcp_clusters ({cluster, status}). Start here: those cluster MoRefs are the cluster_id for get_supervisor_status and create_namespace. Only reports vCenter-level support — a listed cluster may still be CONFIGURING.

[READ] Get the health of one Supervisor Cluster (vSphere with Tanzu control plane).

Returns cluster_id, config_status (RUNNING = healthy, else CONFIGURING / ERROR / REMOVING), kubernetes_status (READY / WARNING / ERROR), api_server_cluster_endpoint, kubernetes_version (null plus kubernetes_version_hint if unavailable), and network_provider. Run check_vks_compatibility first for cluster IDs; use this to confirm a Supervisor is healthy before create_namespace or create_tkc_cluster.

[READ] List vCenter storage policies assignable to Supervisor Namespaces.

Returns the list envelope: items of {policy (ID), name, description} plus returned/total/truncated — one call returns them all, so truncated is always false. Call this before create_namespace or update_namespace and pass the 'policy' ID as their storage_policy. For PVC-level usage use list_namespace_storage_usage instead.

[READ] List all vSphere Namespaces on the target vCenter with their status.

Returns the list envelope: items of {namespace, config_status (RUNNING = healthy, CONFIGURING, REMOVING, ERROR), description} plus returned/total/truncated — one call returns them all, so truncated is always false. Start here, then call get_namespace for detail, list_tkc_clusters for what runs inside, or update_namespace / delete_namespace to change one.

[READ] Get detailed configuration for a single vSphere Namespace.

Returns one raw vCenter namespace object, not the list envelope: config_status, description, storage_specs, quotas. Use list_namespaces first for the name; follow with list_namespace_storage_usage for PVC usage or list_tkc_clusters for the clusters inside. Point-in-time only — a CONFIGURING namespace may not have quotas applied.

[WRITE] Create a vSphere Namespace on a Supervisor Cluster.

Returns {namespace, status: "created", cluster}, or {dry_run, spec} — a dry run unless dry_run=False. Use update_namespace instead when it already exists; confirm with get_namespace afterwards.

[WRITE] Update resource quotas or storage policy of an existing vSphere Namespace.

Only the fields you pass are patched; omitting all of them returns status "no_changes" without an API call, otherwise {namespace, status: "updated"}. Applies immediately — no dry run, no undo. Use this rather than create_namespace when the namespace exists; valid storage_policy values come from list_supervisor_storage_policies.

[WRITE] Delete a vSphere Namespace and everything inside it.

Returns {namespace, status: "deleted"}, or a preview by default. SAFETY: refused while TKC clusters exist inside — run list_tkc_clusters to see them, then delete_tkc_cluster on each. A dry run unless you pass dry_run=False AND confirmed=True. Irreversible; prefer update_namespace to only change quotas.

[READ] List VM classes available for sizing TKC cluster nodes.

Returns the list envelope: items of {id (e.g. 'best-effort-large'), cpu_count, memory_mb, gpu_count (vGPU + DirectPath I/O; 0 if none)} plus returned/total/truncated — one call returns them all, so truncated is always false. Call this before create_tkc_cluster and pass the chosen 'id' as its vm_class; 'guaranteed-' classes reserve resources, 'best-effort-' do not.

[READ] List TanzuKubernetesCluster (TKC) clusters, optionally in one namespace.

Returns the family list envelope: {items: [{name, namespace, phase, k8s_version}], returned, limit, total, truncated, hint}. The Supervisor list is walked to completion, so truncated is always False. Start here, then call get_tkc_cluster for full detail or get_tkc_kubeconfig for access. 'clusters' is a deprecated pre-1.8.0 alias of 'items', removed in 2.0 — read 'items'.

[READ] Get detailed status for a single TKC cluster.

Returns one object, not the list envelope: name, namespace, phase, k8s_version, control_plane_replicas, worker_replicas, conditions, infrastructure_ready, control_plane_ready. Run list_tkc_clusters first — a TKC name is only unique within one namespace. Poll this after create_tkc_cluster, scale_tkc_cluster or upgrade_tkc_cluster to watch an async change land.

[READ] List Kubernetes versions (TanzuKubernetesReleases) available on the Supervisor.

Returns {versions: [{name, version, e.g. 'v1.28.4+vmware.1'}]}, newest first. If the TanzuKubernetesRelease API is unavailable it returns an empty versions list with error and hint rather than raising. Call this before create_tkc_cluster or upgrade_tkc_cluster to pick a valid k8s_version.

[WRITE] Create a TanzuKubernetesCluster in a vSphere Namespace.

A dry run unless you pass dry_run=False; it then returns {name, namespace, status: "creating", yaml} and provisions in the background — poll get_tkc_cluster until phase is running. Call get_tkc_available_versions for k8s_version and list_vm_classes for vm_class first.

[WRITE] Scale the worker node count of an existing TanzuKubernetesCluster (TKC).

Asynchronous: returns {name, namespace, pool, worker_count, status: "scaling"} immediately — poll get_tkc_cluster to watch nodes appear or drain. Scales workers only; use upgrade_tkc_cluster instead for the K8s version. Not destructive, but lowering worker_count drains removed nodes.

[WRITE] Upgrade a TKC cluster to a new Kubernetes version.

Returns {name, namespace, new_version, status: "upgrading"}. Asynchronous and irreversible — Kubernetes cannot be downgraded, so poll get_tkc_cluster until phase is running. There is no dry run. Use this only for the K8s version; prefer scale_tkc_cluster for node counts.

[WRITE] Delete a TKC cluster and all of its nodes.

Returns {name, namespace, status: "deleting"}, or a preview by default. SAFETY: refused while Deployments/StatefulSets run, unless force=True. A dry run unless you pass dry_run=False AND confirmed=True. Irreversible — use scale_tkc_cluster instead for fewer nodes. Empty a namespace of TKC clusters before delete_namespace accepts it.

[READ] Get a kubeconfig for the Supervisor K8s API endpoint.

Returns {namespace, kubeconfig} as a YAML string, or {namespace, written_to} when output_path is given. Use this for Supervisor-level access; use get_tkc_kubeconfig instead to reach workloads inside a TKC cluster. Security: it carries a short-lived session token — prefer output_path so the credential never enters agent context. This is the higher-privileged of the two kubeconfigs, and until now it had no way to avoid being returned inline while its sibling's docstring recommended exactly that.

[WRITE] Get a kubeconfig for one TKC cluster.

Marked [WRITE] because output_path, when given, mkdir -p's and truncates a caller-chosen file. It reads the managed cluster, but this family's marker means "no side effects", and writing a credentials file is one. With no output_path nothing is written and the kubeconfig is returned inline — this docstring previously said it defaulted to ~/.kube/config, which was never true of either the tool or the CLI. Its sibling vmware-aiops.vm_guest_download was corrected the same way in the same round; the two had been given opposite answers to the same question.

Returns {cluster, kubeconfig}, or {cluster, written_to} when output_path is given. Run list_tkc_clusters first for name and namespace; use get_supervisor_kubeconfig instead for Supervisor-level access. Security: it carries a short-lived session token — always prefer output_path so the credential never enters agent context.

Reads vSphere but is NOT annotated readOnlyHint — output_path creates directories and truncates a caller-chosen file, so output_path='~/.kube/config' overwrites the user's own kubeconfig. readOnlyHint is what an MCP client consults to decide whether to ask the user first, and it is about this tool's whole environment, not just vSphere. The [READ] marker above stays accurate for what it answers: nothing in the managed cluster changes.

[READ] Get status of the embedded Harbor container registry on the Supervisor.

Returns {registries: [{id, cluster (Supervisor MoRef), version, url, status, storage_used_mb}]}; status and storage come from a detail call and are null if it fails. If Harbor is not enabled it returns {error, hint} rather than raising. Use it to check registry health or find the push URL — it does not list repositories or images. Run check_vks_compatibility first if the Supervisor may be down.

[READ] List PersistentVolumeClaims and storage usage inside one vSphere Namespace.

Via the Supervisor K8s API. Returns the family list envelope: {namespace, items: [{name, namespace, status (Bound / Pending / Lost), capacity ('10Gi'), storage_class}], returned, limit, total, truncated, hint}. Every PVC comes back in one call, so truncated is always False. Run list_namespaces first for the namespace; use list_supervisor_storage_policies instead for policy-level rather than PVC-level information. 'pvcs' and 'pvc_count' are deprecated pre-1.8.0 aliases of 'items' and 'returned', removed in 2.0 — read 'items'.

[READ] List VirtualMachineSnapshot objects in a vSphere Namespace.

VM Service snapshots (vmoperator.vmware.com CRD, new at v1alpha5) via the Supervisor K8s API — the served CRD version is discovered at runtime, not hardcoded. Returns the family list envelope: items of {name, namespace, vm_name, created, ready} plus returned/total/truncated (walked to completion, so truncated is always false) and served_version. If the Supervisor is older than v1alpha5 the error names the required version. Run list_namespaces first for the namespace; use list_vm_network_interfaces for a VM's NICs.

[READ] List VirtualMachineGroup objects and their bootOrder in a Namespace.

VM Service groups (vmoperator.vmware.com CRD, v1alpha4+) via the Supervisor K8s API — the served CRD version is discovered at runtime. Returns the family list envelope: items of {name, namespace, boot_order, member_count} plus returned/total/truncated (walked to completion) and served_version. boot_order mirrors spec.bootOrder: an ordered list of {members: [{kind, name}], power_on_delay?}. Older Supervisors without v1alpha4 return a teaching error naming the required version.

[READ] List the network interfaces (multi-NIC) of one VirtualMachine.

Reads spec.network.interfaces[] off a single VM Service VirtualMachine (vmoperator.vmware.com) via the Supervisor K8s API; the served CRD version is discovered at runtime. Returns the family list envelope: items of {name, network_name, network_kind, network_api_version} plus returned/total/truncated and vm_name/served_version. A VM with no network block returns an empty list, not an error. Run list_namespaces for the namespace; the VM name comes from your own VM inventory in that namespace.