VMware VKS

AI-powered VMware vSphere with Tanzu (VKS) management — 20 MCP tools.

Requires vSphere 8.x+ with Workload Management enabled.
Companion skills: vmware-aiops (VM lifecycle), vmware-monitor (monitoring), vmware-storage (storage), vmware-nsx (NSX networking), vmware-nsx-security (DFW/firewall), vmware-aria (metrics/alerts/capacity), vmware-avi (AVI/ALB/AKO).
| vmware-pilot (workflow orchestration) | vmware-policy (audit/policy)

What This Skill Does

Category	Capabilities	Count
Supervisor	Compatibility check, status, storage policies	3
Namespace

List, get, create with quotas, update, delete with TKC guard, VM classes | 6 | | TKC Clusters | List, get, versions, create, scale, upgrade, delete with workload guard | 7 | | Access | Supervisor kubeconfig, TKC kubeconfig, Harbor registry, storage usage | 4 |

Quick Install

CODEBLOCK0

When to Use This Skill

• - Check if vSphere environment supports VKS/Tanzu
• Create, update, or delete Supervisor Namespaces with resource quotas
• Deploy, scale, upgrade, or delete TKC (TanzuKubernetesCluster) clusters
• Get kubeconfig for Supervisor or TKC clusters
• Check Harbor registry info or storage usage

Use companion skills for:

• - VM lifecycle, deployment → INLINECODE0
• Inventory, health, alarms → INLINECODE1
• iSCSI, vSAN, datastore → INLINECODE2
• Load balancing, AVI/ALB, AKO, Ingress → INLINECODE3

Related Skills — Skill Routing

User Intent	Recommended Skill
Read-only monitoring	vmware-monitor
Storage: iSCSI, vSAN

vmware-storage | | VM lifecycle, deployment | vmware-aiops | | Tanzu Kubernetes (vSphere 8.x+) | vmware-vks ← this skill | | NSX networking: segments, gateways, NAT | vmware-nsx | | NSX security: DFW rules, security groups | vmware-nsx-security | | Aria Ops: metrics, alerts, capacity planning | vmware-aria | | Multi-step workflows with approval | vmware-pilot | | Load balancer, AVI, ALB, AKO, Ingress | vmware-avi (uv tool install vmware-avi) | | Audit log query | vmware-policy (vmware-audit CLI) |

Common Workflows

Deploy a New TKC Cluster

1. 1. Check compatibility → INLINECODE6
2. List available K8s versions → INLINECODE7
3. Create namespace (if needed) → INLINECODE8
4. Create TKC cluster → INLINECODE9
5. Get kubeconfig → INLINECODE10

Scale Workers for Load Testing

1. 1. Check current state → INLINECODE11
2. Scale up → INLINECODE12
3. Monitor progress → vmware-vks tkc get dev-cluster -n dev (watch phase)
4. Scale back down after test

Namespace Resource Management

1. 1. List namespaces → INLINECODE14
2. Check usage → INLINECODE15
3. Update quota → INLINECODE16

Architecture

CODEBLOCK1

Usage Mode

Scenario	Recommended	Why
Local/small models (Ollama, Qwen)	CLI	~2K tokens vs ~8K for MCP
Cloud models (Claude, GPT-4o)

Either | MCP gives structured JSON I/O | | Automated pipelines | MCP | Type-safe parameters, structured output |

MCP Tools (20 — 12 read, 8 write)

All accept optional target parameter to specify a named vCenter.

Category	Tool	Type
Supervisor	INLINECODE18	Read

get_supervisor_status | Read |
| | list_supervisor_storage_policies | Read |
| Namespace | list_namespaces | Read |
| | get_namespace | Read |
| | create_namespace | Write |
| | update_namespace | Write |
| | delete_namespace | Write |
| | list_vm_classes | Read |
| TKC | list_tkc_clusters | Read |
| | get_tkc_cluster | Read |
| | get_tkc_available_versions | Read |
| | create_tkc_cluster | Write |
| | scale_tkc_cluster | Write |
| | upgrade_tkc_cluster | Write |
| | delete_tkc_cluster | Write |
| Access | get_supervisor_kubeconfig | Read |
| | get_tkc_kubeconfig | Read |
| | get_harbor_info | Read |
| | list_namespace_storage_usage | Read |

INLINECODE38 / create_tkc_cluster — defaults to dry_run=True, returns a YAML plan for review. Pass dry_run=False to apply.

INLINECODE42 — requires confirmed=True and rejects if TKC clusters still exist (prevents orphaned clusters).

INLINECODE44 — requires confirmed=True and checks for running workloads. Rejects if found unless force=True.

Full capability details and safety features: see INLINECODE47

CLI Quick Reference

CODEBLOCK2

Full CLI reference with all flags and interactive creation: see INLINECODE48

Troubleshooting

"VKS not compatible" error

Workload Management must be enabled in vCenter. Check: vCenter UI → Workload Management. Requires vSphere 8.x+ with Enterprise Plus or VCF license.

Namespace creation fails with "storage policy not found"

List available policies first: vmware-vks supervisor storage-policies. Policy names are case-sensitive.

TKC cluster stuck in "Creating" phase

Check Supervisor events in vCenter. Common causes: insufficient resources on ESXi hosts, network issues with NSX-T, or storage policy not available on target datastore.

Kubeconfig retrieval fails

Supervisor API endpoint must be reachable from the machine running vmware-vks. Check firewall rules for port 6443.

Scale operation has no effect

Verify the cluster is in "Running" phase before scaling. Clusters in "Creating" or "Updating" phase reject scale operations.

Delete namespace rejected unexpectedly

The namespace delete guard prevents deletion when TKC clusters exist inside. Delete all TKC clusters in the namespace first, then retry.

Prerequisites

• - vSphere 8.x+ with Workload Management enabled
• Enterprise Plus or VCF license
• NSX-T (recommended) or VDS + HAProxy networking
• Supervisor Cluster configured and running

Setup

CODEBLOCK3

All tools are automatically audited via vmware-policy. Audit logs: INLINECODE50

Full setup guide, security details, and AI platform compatibility: see INLINECODE51

Audit & Safety

All operations are automatically audited via vmware-policy (@vmware_tool decorator):

• - Every tool call logged to ~/.vmware/audit.db (SQLite, framework-agnostic)
• Policy rules enforced via ~/.vmware/rules.yaml (deny rules, maintenance windows, risk levels)
• Risk classification: each tool tagged as low/medium/high/critical
• View recent operations: INLINECODE55
• View denied operations: INLINECODE56

vmware-policy is automatically installed as a dependency — no manual setup needed.

License

MIT — github.com/zw008/VMware-VKS