VMware AVI

VMware AVI

For a read-only check of this skill with your model and agent host, use the shared model-fit self-test in the marketplace root.

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com

This is a community-driven project by a VMware engineer, not an official VMware product.

For official VMware developer tools see developer.broadcom.com.

English | 中文

AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool — 28 tools across 10 categories.

Dual mode: Traditional AVI Controller management + AKO K8s operations in one skill.

Companion skills handle everything else:

| Skill | Scope | Install |

|-------|-------|---------|

| [vmware-aiops](https://github.com/vmware-skills/VMware-AIops) | VM lifecycle, deployment, guest ops, cluster | uv tool install vmware-aiops |

| [vmware-monitor](https://github.com/vmware-skills/VMware-Monitor) | Read-only: inventory, health, alarms, events | uv tool install vmware-monitor |

| [vmware-storage](https://github.com/vmware-skills/VMware-Storage) | Datastores, iSCSI, vSAN management | uv tool install vmware-storage |

| [vmware-vks](https://github.com/vmware-skills/VMware-VKS) | Tanzu Namespaces, TKC cluster lifecycle | uv tool install vmware-vks |

| [vmware-nsx](https://github.com/vmware-skills/VMware-NSX) | NSX networking: segments, gateways, NAT | uv tool install vmware-nsx-mgmt |

| [vmware-nsx-security](https://github.com/vmware-skills/VMware-NSX-Security) | DFW firewall rules, security groups | uv tool install vmware-nsx-security |

| [vmware-aria](https://github.com/vmware-skills/VMware-Aria) | Aria Ops: metrics, alerts, capacity | uv tool install vmware-aria |

---

Upgrading to 2.0

2.0 renames all 28 MCP tools so every name starts with a verb (e.g. ako_amko_status → get_ako_amko_status, ako_clusters → list_ako_clusters, ako_config_diff → diff_ako_config). The full old → new table is in RELEASE_NOTES.md. Nothing else changes: same tools, parameters, safety gates and CLI commands. If an agent prompt, script or ~/.vmware/rules.yaml names a tool, update it — though deny rules written with the old names keep working with vmware-policy ≥ 1.18 (vmware-audit policy lists any rule the renames widened), and vmware-pilot ≥ 1.13 translates old names in saved workflows. If an install older than 2.0 shares that rules.yaml, give it vmware-policy ≥ 1.18.2 too: it matches each rule against both the old and the new name, so one file serves both.

Quick Install

# Via uv (recommended)

uv tool install vmware-avi

Or via pip

pip install vmware-avi

China mainland mirror

pip install vmware-avi -i https://pypi.tuna.tsinghua.edu.cn/simple

Verify installation

vmware-avi doctor

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no `setup.py` by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an *editable* (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:

pip install . # NOT pip install -e .

...or upgrade pip first, and editable works too:

pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:

pip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)

Copy dist/ to the air-gapped host, then install offline:

pip install --no-index --find-links dist vmware-avi

---

Capabilities Overview

What This Skill Does

CLI vs MCP: Which Mode to Use

Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.

Architecture

User (Natural Language)

| AI CLI Tool (Claude Code / Gemini / Codex / Cursor / Trae) | reads SKILL.md | vmware-avi CLI |--- avisdk (AVI REST API) ---> AVI Controller ---> Virtual Services / Pools / SEs |--- kubectl / kubernetes ---> K8s Cluster ---> AKO Pods / Ingress / Services

---

Configuration

Step 1: Create Config Directory

mkdir -p ~/.vmware-avi

vmware-avi init # generates config.yaml and .env templates chmod 600 ~/.vmware-avi/.env

Step 2: Edit config.yaml

controllers:

• name: prod-avi host: avi-controller.example.com username: admin api_version: "22.1.4" tenant: admin port: 443 verify_ssl: true

default_controller: prod-avi

ako: kubeconfig: ~/.kube/config default_context: "" namespace: avi-system

Step 3: Set Passwords

Create ~/.vmware-avi/.env:

# AVI Controller passwords

Format: {CONTROLLER_NAME_UPPER}_PASSWORD

PROD_AVI_PASSWORD=your-password-here

Password environment variable naming convention:

{CONTROLLER_NAME_UPPER}_PASSWORD

Replace hyphens with underscores, UPPERCASE

Example: controller "prod-avi" -> PROD_AVI_PASSWORD

Example: controller "staging-alb" -> STAGING_ALB_PASSWORD

Step 4: Verify

vmware-avi doctor    # checks Controller connectivity + kubeconfig + avisdk

---

CLI Usage

Virtual Service Management

# List all virtual services

vmware-avi vs list [--controller prod-avi]

Check status of a specific VS

vmware-avi vs status my-webapp-vs

Enable / disable a VS (disable requires double confirmation)

vmware-avi vs enable my-webapp-vs vmware-avi vs disable my-webapp-vs

Pool Member Drain / Restore

# List pool members and health status

vmware-avi pool members my-pool

Graceful drain (disable) — double confirmation required

vmware-avi pool disable my-pool 10.1.1.5

Restore traffic (enable)

vmware-avi pool enable my-pool 10.1.1.5

SSL Certificate Expiry Check

# List all certificates

vmware-avi ssl list

Check certificates expiring within 30 days

vmware-avi ssl expiry --days 30

Analytics and Error Logs

# VS analytics: throughput, latency, error rates

vmware-avi analytics my-webapp-vs

Request error logs

vmware-avi logs my-webapp-vs --since 1h

Service Engine Health

# Name, mgmt IP, operational status, SE group — status sourced from the

serviceengine-inventory endpoint (config + runtime merged)

vmware-avi se list

Per-SE operational status + connected-VS counts

vmware-avi se health

AKO Troubleshooting

# Check AKO pod status

vmware-avi ako status [--context my-k8s-context]

View AKO logs

vmware-avi ako logs [--tail 100] [--since 30m]

Restart AKO pod (double confirmation)

vmware-avi ako restart

Show AKO version

vmware-avi ako version

AKO Helm Config Management

The AKO Helm release is discovered automatically (official installs use helm install --generate-name, so the release is not named ako). Upgrades pull the official Broadcom OCI chart oci://projects.packages.broadcom.com/ako/helm-charts/ako with --reuse-values.

# View current AKO Helm values (release auto-discovered)

vmware-avi ako config show

Show pending changes (diff against the official OCI chart)

vmware-avi ako config diff

Helm upgrade (double confirmation + --dry-run default)

vmware-avi ako config upgrade

Ingress Diagnostics

# Validate Ingress annotations

vmware-avi ako ingress check

Show Ingress-to-VS mapping

vmware-avi ako ingress map

Diagnose why an Ingress has no VS

vmware-avi ako ingress diagnose

Sync Diagnostics

# Check K8s-Controller sync status

vmware-avi ako sync status

Show inconsistencies between K8s and Controller

vmware-avi ako sync diff

Force AKO resync (double confirmation)

vmware-avi ako sync force

Multi-cluster AKO

# List every kube-context and whether AKO runs there

vmware-avi ako clusters

Cross-cluster AKO status overview

vmware-avi ako cluster-overview

AMKO GSLB status

vmware-avi ako amko status

---

MCP Server

The MCP server exposes all 28 tools via the Model Context Protocol. Works with any MCP-compatible client.

After `uv tool install vmware-avi`, start the MCP server with one command (v1.5.15+):

# Recommended — single command, no network re-resolve

vmware-avi mcp

With custom config path

VMWARE_AVI_CONFIG=/path/to/config.yaml vmware-avi mcp

Claude Desktop Config

Add to claude_desktop_config.json:

{

"mcpServers": { "vmware-avi": { "command": "vmware-avi", "args": ["mcp"], "env": { "VMWARE_AVI_CONFIG": "~/.vmware-avi/config.yaml" } } } }

Alternative: uvx (no install) or legacy entry point

# Run without installing (requires PyPI access each launch)

uvx --from vmware-avi vmware-avi mcp

Legacy entry point (still works, kept for backward compatibility)

vmware-avi-mcp

Behind a corporate TLS proxy? uvx may fail with invalid peer certificate: UnknownIssuer.

Use the recommended vmware-avi mcp form above (no network needed), or set UV_NATIVE_TLS=true.

MCP Tools (28)

| AKO Config (3) | get_ako_config, diff_ako_config, `upgr