数据分析

vmware-avi

Use this skill whenever the user mentions load balancing, ingress, virtual services, pool members, AVI, NSX ALB, AKO, or application delivery in a VMware/NSX ALB or Tanzu/vSphere Kubernetes context. Directly handles: virtual service listing and enable/disable, pool member drain/enable, SSL certificate expiry checks, analytics and error logs, service engine health, AKO pod troubleshooting, AKO Helm config management, Ingress annotation validation, K8s-to-Controller sync diagnostics, and multi-cluster AKO overview. Always use it for "virtual service", "pool member", "AKO status", "AKO logs", "ingress diagnose", "ssl expiry", "load balancer", "NSX ALB", "AVI controller", "AKO sync", or "负载均衡" tasks. Do NOT use to set up or configure nginx/HAProxy/Traefik from scratch — those are not AVI tasks. For VM lifecycle use vmware-aiops, for NSX networking use vmware-nsx, for Kubernetes cluster lifecycle (Supervisor/TKC) use vmware-vks.

它能做什么

技能文档

VMware AVI

Disclaimer: This is a community-maintained open-source project and is not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware", "NSX", and "AVI" are trademarks of Broadcom. Source code is publicly auditable at github.com/vmware-skills/VMware-AVI under the MIT license.

AVI (NSX Advanced Load Balancer) application delivery and AKO Kubernetes operations — 28 MCP tools.

Dual mode: Traditional AVI Controller management + AKO K8s operations in one skill. Family: vmware-aiops (VM lifecycle), vmware-monitor (inventory/health), vmware-storage (iSCSI/vSAN), vmware-vks (Tanzu Kubernetes), vmware-nsx (NSX networking), vmware-nsx-security (DFW/firewall), vmware-aria (metrics/alerts/capacity), vmware-harden (compliance baselines). | vmware-pilot (workflow orchestration) | vmware-policy (audit/policy)

What This Skill Does

Category	Tools	Count	Read or Write
Virtual Service	list, status, enable/disable	3	2R / 1W
Pool Member	pool discovery, member list, enable/disable member (drain/restore traffic)	4	2R / 2W
SSL Certificate	list, expiry check	2	2R
Analytics	VS metrics overview, request error logs	2	2R
Service Engine	list, health check	2	2R
AKO Pod Ops	status, logs, restart, version info	4	3R / 1W
AKO Config	values.yaml view, Helm diff, Helm upgrade	3	2R / 1W
Ingress Diagnostics	annotation validation, VS mapping, error diagnosis (with fix recommendations)	3	3R
Sync Diagnostics	K8s-Controller comparison, inconsistency list, force resync	3	2R / 1W
Multi-cluster	cross-cluster AKO cluster list, AMKO status	2	2R

Total: 28 tools (22 read + 6 write)

Quick Install

uv tool install vmware-avi
vmware-avi doctor            # checks Controller connectivity + kubeconfig + avisdk

When to Use This Skill

List, enable, or disable virtual services on AVI Controller
Add, remove, drain, or restore pool members (maintenance windows, rolling deployments)
Check SSL certificate expiry across all virtual services
View VS analytics — throughput, latency, error rates, request logs
Check service engine status (inventory-based) and per-SE VS placement counts
Troubleshoot AKO pods — status, logs, restarts
Manage AKO Helm configuration — view, diff, upgrade values.yaml
Validate Ingress annotations and diagnose why a VS wasn't created as expected
Detect sync drift between K8s resources and AVI Controller objects
Get a cross-cluster view of AKO deployments and AMKO status

Use companion skills for:

VM lifecycle, deployment, guest ops → vmware-aiops
NSX segments, gateways, NAT → vmware-nsx
DFW firewall rules, security groups → vmware-nsx-security
K8s cluster lifecycle (Supervisor, TKC) → vmware-vks
Read-only vSphere monitoring → vmware-monitor

User Intent	Recommended Skill
Load balancer, VS, pool, AVI, ALB, AKO	vmware-avi ← this skill
VM lifecycle, deployment, guest ops	vmware-aiops (`uv tool install vmware-aiops`)
Read-only vSphere monitoring	vmware-monitor (`uv tool install vmware-monitor`)
Storage: iSCSI, vSAN, datastores	vmware-storage (`uv tool install vmware-storage`)
NSX networking: segments, gateways, NAT	vmware-nsx (`uv tool install vmware-nsx-mgmt`)
NSX security: DFW rules, security groups	vmware-nsx-security (`uv tool install vmware-nsx-security`)
Tanzu Kubernetes (Supervisor/TKC)	vmware-vks (`uv tool install vmware-vks`)
Aria Ops: metrics, alerts, capacity	vmware-aria (`uv tool install vmware-aria`)
Multi-step workflows with approval	vmware-pilot
Compliance baselines (CIS / 等保 / PCI-DSS), drift detection, LLM remediation advisor	vmware-harden (`uv tool install vmware-harden`)
Audit log query	vmware-policy (`vmware-audit` CLI)

Common Workflows

Maintenance Window — Drain a Pool Member

Pre-flight (judgment — affects live traffic):

Capacity check: pool must have ≥ 2 healthy members. Disabling the only-other-healthy member is a self-DoS. Verify with pool members my-pool first.
Connection persistence: if VS uses session persistence (cookie/source-IP), existing sessions stay pinned to the disabled member until they expire. "Drain" is not instant — 5-30 min depending on persistence TTL.
Long-lived connections: WebSocket/streaming sessions can hold for hours. Decide upfront: hard-disconnect (faster, user-visible) or wait (slower, transparent).
Observability: enable analytics on the VS BEFORE disabling — you need the baseline to detect degradation.

Steps:

pool members my-pool → confirm ≥ 2 healthy members and identify session persistence config
pool disable my-pool (graceful drain — new connections stop, existing finish)
analytics my-vs --duration 15m → watch active connection count to the drained member trend toward zero
Perform maintenance only after active connections = 0 (or you've decided to hard-disconnect)
pool enable my-pool → re-enable
Verify before declaring success: health monitor passes (typically 30-90 sec) AND new connections are landing on the member (analytics drill-down)

AKO Ingress Not Creating VS

Judgment: this is a layered failure — figure out which layer broke before randomly probing. AKO is a controller; like all K8s controllers, the failure modes are: (a) controller down, (b) controller running but seeing wrong inputs, (c) controller acting but Avi rejecting outputs.

ako status → controller running, recent reconciles, no panic logs? If not, fix here first
ako ingress check → required annotations present? Common miss: kubernetes.io/ingress.class, aviinfrasetting.ako.vmware.com/name
ako sync status → drift between K8s state and Avi state. Drift > a few minutes usually means controller error
ako ingress diagnose → AKO's own diagnostic; often pinpoints the issue
If sync drifted: ako sync diff → review what's missing on Avi side. Force resync only after you understand why drift happened — blind resync masks bugs that will recur

SSL Certificate Expiry Audit

Judgment: cert expiry is the most preventable outage in the LB world. Run this regularly, not reactively. The 30-day window is a minimum — for prod, set 60+ to allow renewal lead time.

ssl expiry --days 60 → catch certs expiring within 60 days, not 30; enterprise renewal cycles take 2-4 weeks
Cross-reference VS mapping (in output) → identify which apps are at risk; some certs may be unused (orphans, candidates for cleanup)
Decision: certs marked unused (no VS) → propose deletion as part of audit; certs in_use → escalate to cert team with VS list and exact expiry date
Schedule a follow-up rescan post-renewal (not just rely on cert team confirming)

Usage Mode

Scenario	Recommended	Why
Local/small models (Ollama, Qwen)	CLI	~2K tokens vs ~8K for MCP
Cloud models (Claude, GPT-4o)	Either	MCP gives structured JSON I/O
Automated pipelines	MCP	Type-safe parameters, structured output
AKO troubleshooting	CLI	Interactive log tailing, Helm diff output

MCP Tools (28 — 22 read, 6 write)

Category	Tools	R/W
Virtual Service (3)	`vs_list`, `vs_status`	Read
	`vs_toggle`	Write
Pool Member (4)	`pool_list`, `pool_members`	Read
	`pool_member_enable`, `pool_member_disable`	Write
SSL Certificate (2)	`ssl_list`, `ssl_expiry_check`	Read
Analytics (2)	`vs_analytics`, `vs_error_logs`	Read
Service Engine (2)	`se_list`, `se_health`	Read
AKO Pod (4)	`ako_status`, `ako_logs`, `ako_version`	Read
	`ako_restart`	Write
AKO Config (3)	`ako_config_show`, `ako_config_diff`	Read
	`ako_config_upgrade`	Write
Ingress Diagnostics (3)	`ako_ingress_check`, `ako_ingress_map`, `ako_ingress_diagnose`	Read
Sync Diagnostics (3)	`ako_sync_status`, `ako_sync_diff`	Read
	`ako_sync_force`	Write
Multi-cluster (2)	`ako_clusters`, `ako_amko_status`	Read

Read/write split: 22 tools are read-only, 6 modify state. Write tools require double confirmation and are audit-logged.

CLI Quick Reference

# === Traditional Mode (AVI Controller) ===
vmware-avi vs list [--controller ]
vmware-avi vs status 
vmware-avi vs enable 
vmware-avi vs disable            # double-confirm

vmware-avi pool members 
vmware-avi pool enable  
vmware-avi pool disable    # double-confirm (graceful drain)

vmware-avi ssl list
vmware-avi ssl expiry [--days 30]

vmware-avi analytics 
vmware-avi logs  [--since 1h]

vmware-avi se list
vmware-avi se health

# === AKO Mode (K8s) ===
vmware-avi ako status [--context ]
vmware-avi ako logs [--tail 100] [--since 30m]
vmware-avi ako restart                    # double-confirm

vmware-avi ako config show
vmware-avi ako config diff
vmware-avi ako config upgrade             # double-confirm + --dry-run default

vmware-avi ako ingress check 
vmware-avi ako ingress map
vmware-avi ako ingress diagnose 

vmware-avi ako sync status
vmware-avi ako sync diff
vmware-avi ako sync force                 # double-confirm

vmware-avi ako clusters
vmware-avi ako amko status

Full CLI reference: see references/cli-reference.md

Troubleshooting

"Controller unreachable" error

Run vmware-avi doctor to verify connectivity
Check if the controller address and port are correct in ~/.vmware-avi/config.yaml
For self-signed certs: set verify_ssl: false in config.yaml (lab environments only)

AKO Pod in CrashLoopBackOff

Check logs → vmware-avi ako logs --tail 50
Common causes: wrong controller IP in values.yaml, network policy blocking AKO→Controller, expired credentials
Fix config → vmware-avi ako config show to inspect, then vmware-avi ako config upgrade with corrected values (release auto-discovered — official installs use --generate-name; pulls the official Broadcom OCI chart oci://projects.packages.broadcom.com/ako/helm-charts/ako)

Ingress created but no VS on Controller

Validate annotations → vmware-avi ako ingress check
Check AKO logs for rejection reason → vmware-avi ako logs --since 5m
Run sync diff → vmware-avi ako sync diff to see if the object is stuck

Pool member shows "down" after enable

Health monitor may still be failing. Check the actual health status on the Controller side — the member is enabled but unhealthy. Fix the backend service first, then the health status will auto-recover.

SSL expiry check shows 0 certificates

Verify the controller connection has tenant-level access. Certificates are tenant-scoped in AVI — the configured user may only see certs in their tenant.

AKO sync force has no effect

Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists, the issue is likely in the K8s resource definition itself (bad annotation, missing secret). Use vmware-avi ako ingress diagnose to pinpoint the root cause.

Setup

uv tool install vmware-avi
mkdir -p ~/.vmware-avi
vmware-avi init              # generates config.yaml and .env templates
chmod 600 ~/.vmware-avi/.env
vmware-avi doctor            # verify Controller + K8s connectivity

All tools are automatically audited via vmware-policy. Audit logs: vmware-audit log --last 20

Supported versions: AVI Controller 22.1.x (analytics endpoint quirks fixed in v1.5.11) and 30.x. VCF 9.0 / 9.1 declared compatible (avisdk >=22.1,<31.0 covers bundled AVI). Python 3.11+. Full table: references/capabilities.md → Version Compatibility.

Full setup guide, security details, AI platform compatibility, and container/Smithery deployment: see references/setup-guide.md

Audit & Safety

All operations are automatically audited via vmware-policy (@vmware_tool decorator):

Every tool call logged to ~/.vmware/audit.db (SQLite, framework-agnostic)
Policy rules enforced via ~/.vmware/rules.yaml (deny rules, maintenance windows, risk levels)
Each controller may declare environment: in config.yaml (production / staging / lab) as an optional label; an environment-scoped deny rule in ~/.vmware/rules.yaml can match on it to block writes (e.g. freeze production). A controller with no label is simply not matched by such a rule. Reads are never affected
Destructive operations (vs_toggle disable, pool_member_disable, ako_restart, ako_config_upgrade, ako_sync_force) require double confirmation
ako_config_upgrade defaults to --dry-run mode — user must explicitly confirm to apply
View recent operations: vmware-audit log --last 20

License

MIT — github.com/vmware-skills/VMware-AVI

相关技能

vmware-nsx

Use this skill whenever the user needs to manage VMware NSX networking — segments, gateways, NAT, routing, and IP pools. Directly handles: create/manage network segments, configure Tier-0/Tier-1 gateways, set up NAT rules, manage static routes, configure IP pools, check transport node and edge cluster health. Always use this skill for "create segment", "set up gateway", "create NAT rule", "check network health", "troubleshoot connectivity", or any NSX/networking/segment task. Do NOT use for DFW firewall rules or security groups (use vmware-nsx-security), VM lifecycle (use vmware-aiops), or AVI/ALB load balancing (use vmware-avi). For multi-step workflows use vmware-pilot.

49 次安装

vmware-storage

管理 vSphere 存储——数据存储、iSCSI 和 vSAN——通过 12 个 MCP 工具或 CLI。

53 次安装1 星标

vmware-nsx-security

Use this skill whenever the user needs to manage VMware NSX security — distributed firewall (DFW) policies, security groups, microsegmentation, and IDS/IPS. Directly handles: create/manage DFW policies and rules, security groups, VM tags, network traceflow diagnostics, IDPS profiles and status. Always use this skill for "create firewall rule", "set up microsegmentation", "add VM to security group", "run traceflow", "check IDS status", or any NSX security/DFW task. Do NOT use for NSX networking operations like segments, gateways, NAT, or routing (use vmware-nsx), or VM lifecycle (use vmware-aiops). For load balancing/AVI/AKO use vmware-avi.

53 次安装

vmware-vks

Use this skill whenever the user needs to manage vSphere Kubernetes Service (VKS) — Supervisor clusters, vSphere Namespaces, and TKC cluster lifecycle. Directly handles: check VKS compatibility, create/delete namespaces, create/scale/upgrade/delete TKC clusters, get kubeconfig, check Harbor registry. Always use this skill for "create Kubernetes cluster", "scale workers", "upgrade K8s version", "create namespace", "get kubeconfig", or any VKS/TKC task. Do NOT use for vanilla VM operations (use vmware-aiops), non-vSphere Kubernetes (e.g., kubeadm, EKS, AKS), or AVI/AKO load balancing (use vmware-avi). For networking use vmware-nsx.

50 次安装

vmware-aria

Use this skill whenever the user needs VMware Aria Operations (rebranded VMware VCF Operations in VCF 9 and later) data — performance metrics, alerts, capacity planning, anomaly detection, and automated reports. Directly handles: query resource metrics, list/acknowledge/cancel alerts, manage alert definitions, check capacity and time-remaining forecasts, detect anomalies, generate and manage reports. Always use this skill for "check vSphere capacity", "what Aria Operations alerts are active", "show VMware anomalies", "generate an Aria report", "rightsizing recommendations", "VCF Operations alerts", or any Aria Operations / VCF Operations / vRealize Operations task. Combined with LLM, Aria data powers natural language reports: "give me a capacity report" → Aria collects data → LLM formats the report. Do NOT use for real-time vCenter alarms/events (use vmware-monitor), VM operations (use vmware-aiops), or NSX networking (use vmware-nsx). For load balancing/AVI/AKO use vmware-avi.

52 次安装

1panel-skills

1Panel operation skill for agent runtimes. Use when the user wants an assistant to interact with a 1Panel instance for resource monitoring, websites, certifi...

50 次安装2 星标