zw008/VMware-VKS

> **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
> This is a community-driven project by a VMware engineer, not an official VMware product.
> For official VMware developer tools see developer.broadcom.com.
English | 中文
MCP Skill + CLI for VMware vSphere Kubernetes Service (VKS) management — Supervisor clusters, vSphere Namespaces, and VKS Cluster lifecycle. 24 MCP tools.
Upgrading to 3.0
3.0 renames the two kubeconfig tools: get_supervisor_kubeconfig → issue_supervisor_kubeconfig,
get_tkc_kubeconfig → issue_tkc_kubeconfig. They issue a credential (a Supervisor bearer token) rather than
read something, and a get_ name told agents otherwise. Parameters, annotations, safety and CLI commands
(vmware-vks kubeconfig supervisor / kubeconfig get) are unchanged; callers of the old names must switch (saved vmware-pilot workflows are translated by Pilot ≥ 2.0.0). Deny
rules in ~/.vmware/rules.yaml naming the old names keep working with vmware-policy ≥ 1.19.0. Details in
RELEASE_NOTES.md.
Upgrading to 2.0
2.0 renames the three VM Service tools: list_vm_snapshots → list_vm_service_snapshots, list_vm_groups →
list_vm_service_groups, list_vm_network_interfaces → list_vm_service_network_interfaces. The reason is a name
clash: in the family's 2.0, vmware-aiops and vmware-monitor call their **vSphere** VM snapshot tool list_vm_snapshots,
while these list **Kubernetes VM Service** (vm-operator) objects. **Trap:** an agent prompt, script or saved workflow
that still calls list_vm_snapshots with vmware-aiops or vmware-monitor also loaded now reaches the vSphere tool, not
this one — update it. A VKS-scoped deny rule naming list_vm_snapshots now also matches the aiops/monitor tool
(vmware-policy ≥ 1.18 matches both names; vmware-audit policy lists such rules). Parameters, safety gates and CLI
commands are unchanged; the full table is in RELEASE_NOTES.md.
If an install older than 2.0 shares that rules.yaml, give it vmware-policy ≥ 1.18.2 too: it matches each rule
against both the old and the new name, so one file serves both.
Companion Skills
> **Part of the VMware MCP Skills family.** Each skill handles a distinct domain — install only what you need.
| Skill | Scope | Tools | Install |
|-------|-------|:-----:|---------|
| **vmware-aiops** ⭐ entry point | VM lifecycle, deployment, guest ops, clusters | 49 | uv tool install vmware-aiops |
| **vmware-monitor** | Read-only monitoring, alarms, events, VM info | 27 | uv tool install vmware-monitor |
| **vmware-storage** | Datastores, iSCSI, vSAN | 11 | uv tool install vmware-storage |
| **vmware-nsx** | NSX networking: segments, gateways, NAT, IPAM | 33 | uv tool install vmware-nsx-mgmt |
| **vmware-nsx-security** | DFW microsegmentation, security groups, Traceflow | 21 | uv tool install vmware-nsx-security |
| **vmware-aria** | Aria Ops metrics, alerts, capacity planning | 28 | uv tool install vmware-aria |
Prerequisites
- **Python 3.10+** — required for uv tool install
- **vSphere 8.0+** — Workload Management (Supervisor) APIs require vSphere 8.x
- **Workload Management enabled** — WCP must be enabled on at least one compute cluster
- **License** — vSphere Kubernetes Service (Enterprise Plus or VMware Cloud Foundation)
Run vmware-vks check after setup to verify all requirements are met.
Quick Start
Offline / Air-Gapped Install (from source)
This project uses the modern PEP 517 build system (hatchling), so there is **no
setup.py** by design — that is expected, not a missing file. If you cloned the
source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode
currently requires a setuptools-based build, your pip is older than 21.3 and
cannot do an *editable* (-e) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:
For a **truly air-gapped host**, build the wheels on a connected machine and copy
them over — the target then needs no network:
Common Workflows
Deploy a New TKC Cluster
1. Check compatibility → vmware-vks check
2. List available K8s versions → vmware-vks tkc versions -n dev