Architecture & Component Topology — VCF 9.1
9.1
Platform Release
33+
BOM Components
11
New Features (Major)
4
Patch Sub-Releases
▸ VCF 9.1 Full-Stack Architecture (Click components for details)
Bill of Materials (BOM) — VCF 9.1.0.0 · GA: 12 MAY 2026
| Component | Category | VCF SKU | vSF SKU | Version | Build Number |
|---|---|---|---|---|---|
| VCF Installer / SDDC Manager | Core | ✅ | ✅ | 9.1.0.0 | 25371088 |
| ESX Hypervisor | Core | ✅ | ✅ | 9.1.0.0 | 25370933 |
| vCenter Server | Core | ✅ | ✅ | 9.1.0.0 | 25370922 |
| vSAN ESA Witness | Storage | ✅ | ✅ | 9.1.0.0 | 25370927 |
| vSAN File Services | Storage | ✅ | ✅ | 9.1.0.0 | 25370922 |
| vSAN OSA Witness | Storage | ✅ | ✅ | 9.1.0.0 | 25370925 |
| NSX (Networking) | Network | ✅ | — | 9.1.0.0 | 25318225 |
| Supervisor (vSphere Supervisor) | Supervisor | ✅ | ✅ | 9.1.0.0 | 25370922 |
| VKS Standard Packages | Supervisor | ✅ | ✅ | 3.6.0+20260211 | N/A |
| vSphere Kubernetes Releases | Supervisor | ✅ | ✅ | 1.34.2+vmware.2-vkr.2 | N/A |
| VMware Kubernetes Service (VKS) | Supervisor | ✅ | ✅ | 3.6.1+v1.35 | N/A |
| Harbor (Supervisor Service) | Sup. Service | ✅ | ✅ | 9.1.0.0 | 25220498 |
| Argo CD Supervisor Service | Sup. Service | ✅ | ✅ | 9.1.0.0 | 25100889 |
| CA Cluster Issuer Supervisor Service | Sup. Service | ✅ | ✅ | 9.1.0.0 | 25317155 |
| Contour Supervisor Service | Sup. Service | ✅ | ✅ | 9.1.0.0 | 25276585 |
| External DNS Supervisor Service | Sup. Service | ✅ | ✅ | 9.1.0.0 | 25276584 |
| Supervisor Management Proxy | Sup. Service | ✅ | ✅ | 9.1.0.0 | 25317170 |
| VCF Operations | Operations | ✅ | ✅ | 9.1.0.0 | 25346025 |
| Cloud Proxy | Operations | ✅ | ✅ | 9.1.0.0 | 25346033 |
| VCF Operations for Networks | Operations | ✅ | — | 9.1.0.0 | 25318550 |
| VCF Operations HCX | Operations | ✅ | — | 9.1.0.0 | 25318520 |
| VCF Operations Orchestrator | Operations | ✅ | ✅ | 9.1.0.0 | 25346069 |
| VCF Automation | Automation | ✅ | — | 9.1.0.0 | 25370929 |
| Fleet Lifecycle NEW | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25371109 |
| Identity Broker | Mgmt Svc | ✅ | — | 9.1.0.0 | 25368698 |
| License Server | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25346031 |
| Log Management | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25346055 |
| Real-Time Metrics | Mgmt Svc | ✅ | — | 9.1.0.0 | 25346020 |
| Real-Time Metrics Store | Mgmt Svc | ✅ | — | 9.1.0.0 | 25346020 |
| Salt RaaS | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25346036 |
| Salt Master | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25346036 |
| SDDC Lifecycle | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25371107 |
| Software Depot | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25371105 |
| Telemetry | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25181946 |
| VCF Services Runtime NEW | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25370367 |
| VCF Download Tool | Mgmt Svc | ✅ | ✅ | 9.1.0.0 | 25371089 |
| Secret Store Service | VCF Svc | ✅ | — | 9.1.0.0 | 25367485 |
| Migration Service Engine | VCF Svc | ✅ | — | 9.1.0.0 | 25370929 |
| VKS Cluster Management | VCF Svc | ✅ | — | 9.1.0.0 | 25370929 |
| Configuration Service | VCF Svc | ✅ | — | 9.1.0.0 | 25303350 |
| DSM Data Services (Add-on) | VCF Svc | — | — | 9.1.0.0 | 25367580 |
| Encryption Management | VCF Svc | ✅ | — | 9.1.0.0 | 25370929 |
| Metrics Aggregator Package | VCF Svc | ✅ | — | 9.1.0.0 | 25317134 |
| Protection and Recovery (Add-on) | VCF Svc | — | — | 9.1.0.0 | 25367487 |
| Harbor (VCF Svc) | VCF Svc | ✅ | — | 9.1.0.0 | 25370929 |
| VMware Remote Console | Tools | ✅ | ✅ | 13.1.0.0 | 25236164 |
| VMware Tools | Tools | ✅ | ✅ | 13.1.0.0 | 25294452 |
| VCF Consumption CLI | Tools | ✅ | ✅ | 9.1.0.0 | 25296329 |
| VCF Consumption CLI Plugins & DB | Tools | ✅ | ✅ | 9.1.0.0 | 25305443 |
| Deep Learning VM | Add-on | ✅ | ✅ | 9.1.0.0 | 25217931 |
| VMware Data Services Manager | Add-on | — | — | 9.1.0.0 | 25367580 |
| Protection and Recovery | Add-on | ✅ | ✅ | 9.1.0.0 | 25367487 |
| Avi Load Balancer | Add-on | — | — | 32.1.1 | 25377988 |
| Private AI Services | Add-on | — | — | 2.0.89 | Separate |
⚡ VCF = VMware Cloud Foundation SKU | vSF = vSphere Foundation SKU | Build 9.1.0.0 GA date: 12 MAY 2026
What's New in VCF 9.1 — By Component
🔒 Security & Hypervisor
🛡️ User-Level Monitor (ULM) — GA Default▸
ULM is now the default VM monitor for all VMs. Completely reimplements the VMM for ESX, significantly reducing hypervisor code in privileged mode → reduced attack surface for guest escapes.
🔐 AMD SEV-SNP — General Availability▸
Hardware-based Trusted Execution Environment (TEE). Adds memory integrity protection against data re-play and memory re-mapping attacks. Remote attestation support. Compatible with AMD EPYC Zen 3 (Milan) and later.
🔐 Intel TDX — General Availability▸
Hardware-based TEE with attestation. Compatible with Intel Xeon Gen 5 (Emerald Rapids) and later. Integrity + confidentiality for critical workloads.
⚡ Quick Boot for Confidential VMs▸
Quick Boot now supports hosts running confidential VMs. Bypasses full power cycle/firmware initialization. Significantly reduces upgrade time and maintenance windows.
🚀 Performance & Hardware
🧠 NVMe Memory Tiering — Enhanced▸
Hypervisor tiers active pages to DRAM, cold pages to local NVMe. Expands effective memory capacity without additional DRAM. Includes software-based mirroring and cost savings analysis.
🎮 NVIDIA ConnectX-7 + BlueField-3 Enhanced DirectPath▸
vSphere vMotion, Storage vMotion, Live Patch, Hot-Add/Remove virtual hardware support with passthrough for AI/HPC. Enhanced operational flexibility.
🎮 AMD MI350 GPU — Enhanced DirectPath▸
New GPU support for AI/HPC workloads. Supports Live Patch, Storage vMotion, Hot-Add/Remove. Hugging Face + PyTorch + OPEA + UALink partnerships for optimized AI performance.
💻 Intel NIC E825 (Xeon Gen 6 Granite Rapids-D)▸
Support for Intel NIC E825 as LAN on Motherboard (LOM) NIC in Intel Xeon Gen 6 (Granite Rapids-D) platform. Expands hardware compatibility.
🔀 AMD IOMMU Virtualization for DirectPath▸
IOMMU virtualization for AMD hosts with DirectPath devices. Near-native hardware access performance, improved security and memory isolation.
📋 Guest OS, APIs & Operations
🌐 Zero Touch Provisioning (ZTP) — ESX Install▸
Secure UEFI + HTTPS-based network boot provisioning at scale. No PXE/TFTP infrastructure required. Static network config on bare metal. Forward-looking replacement for Auto Deploy (deprecated in 9.0).
🔧 Live Patching for ESX (TPM-enabled hosts)▸
Patches applied to running kernel memory. VMs continue running with no maintenance window. Covers up to 80% of patches. Requires TPM-enabled hosts.
📋 New Guest OS Support in ESX 9.1▸
New: Ubuntu 26.04 LTS · SUSE Linux Enterprise 16 · Debian 13.0 · FreeBSD 15.0 · Pardus 25.0 · CentOS Stream 10 (Tech Preview) · CentOS Stream 9 (Tech Preview).
Terminated: RHEL 4.x · Oracle Linux 5.x · CentOS 4.x/5.x · SLES 10 SP4 · Debian 7.x · Asianux 3.x/4.x.
Terminated: RHEL 4.x · Oracle Linux 5.x · CentOS 4.x/5.x · SLES 10 SP4 · Debian 7.x · Asianux 3.x/4.x.
🔌 Guest Customization API Updates▸
IPv6-Only Support (deactivate IPv4). Partial network customization (network fields only). Expanded account management (root pwd on Linux). Live network customization for powered-on VMs. Windows script execution support.
🖥️ vCenter: vSphere Cluster Services (vCLS) Deactivated by Default▸
Starting vCenter 9.1: vCLS deactivated by default. Cannot be re-activated. APIs/configs not supported → removed in next major release. Port 514 (UDP/TCP, unencrypted syslog) blocked — use port 1514 (TLS).
🔗 CBT Enhancement for Snapshot Operations▸
Change Block Tracking (CBT) enablement removes VM unresponsiveness during snapshot operations. VM responsiveness maintained throughout snapshot; overall snapshot time unchanged but unresponsiveness window eliminated.
🔄 vSAN ESA Auto RAID-6 (Default)▸
vSAN clusters now use RAID-6 as the default RAID level. Automatic configuration removes manual selection. Superior data protection with no performance impact.
🌐 vSAN ESA Global Deduplication▸
Cluster-wide, post-processing deduplication setting. Encryption support included. Increases storage space savings, reduces consumption without impacting performance.
🔒 Cyber Recovery vSAN Storage Cluster▸
New cyber recovery vSAN storage cluster deployable via vCenter Quickstart. Integrated EDR + vDefend push-button network isolation. Immutable snapshots. On-premises clean room recovery.
⏩ Seeding for vSAN Replication▸
Optimizes data transfer using existing replicas. Avoids full synchronization on new replications. Syncs only incremental changes → saves time and bandwidth.
🏷️ Tag-Based VM Membership for Protection Groups▸
Protection group membership via VM tags. Automatically protects new workloads based on assigned metadata. No manual intervention required for newly deployed VMs.
📅 Multiple Retention Schedules for vSAN Snapshots▸
Daily, weekly, and monthly snapshot schedules. Supports long-term cyber recovery strategies. Operational recovery for day-to-day needs.
📡 vSAN Replication from Any Source Site▸
Extends vSAN replication to support workloads on any storage (using vSAN ESA as target). Dynamic protection groups, immutable snapshots, integrated vCenter UI across broader workloads.
📦 vSAN ESA Compression Enhancements▸
Improved vSAN ESA compression delivers better storage efficiency. Increased space savings vs previous releases. Storage consumption reduced without performance impact.
🌐 VPC & Networking
☁️ Avi LB Integration with VPC + Distributed Transit GW▸
Avi load balancers now supported with VPCs and Transit Gateways with distributed VLAN connection. Full self-service from provider management portal.
📡 Distributed VLAN Connection for Supervisor + VCF Automation▸
Virtual Network Appliance (VNA) integration adds services to enable Distributed Transit Gateway for Supervisor. VCF Automation connects to DC via simple VLAN — eliminates complex networking prerequisites.
🔒 IPSec VPN on Centralized Transit Gateway▸
IPSec VPN service now supported for VPC using centralized external connectivity. Enables secure VPN for VPC-based workloads without additional infrastructure.
⚖️ L4 Load Balancer on Virtual Network Appliance▸
VPCs now support L4 LB functionality via Virtual Networking Appliance (VNA). Full L4 load balancing, dedicated appliance ensures scalability and service isolation.
🛡️ Security & Platform
🌍 Extended vCenter Integration (Transit GW / VPC)▸
Transit Gateway visible + fully configurable from vCenter. Subnet extension to VLAN in vCenter. Full IPAM visibility + IP allocation. Extended Topology views + Traceflow from vCenter. DHCP server/relay configurable from vCenter.
🔧 Terraform Extended Coverage (TGW + VPC)▸
NSX Terraform Provider evolves with new capabilities: multiple TGW, advanced connectivity options, improved IPAM, VLAN Extension, VPC features.
📊 Real-Time Metrics APIs (Prometheus/PromQL)▸
High-granularity (up to 2-second) metrics across ESX, vCenter, vSAN, NSX stack. Native Grafana integration. Built-in collection profiles: Essentials, Standard, Verbose. Single API call configuration replaces complex legacy model.
🔄 NSX UI Reorganization for VPC/IPAM▸
Extended VPC section with per-feature views (subnet, NAT). Full IP allocation workflow. Re-organized Networking tabs: VPC objects (TGW) vs Segment objects (Tier-1, segments) clearly delineated.
🚀 VCF Installer — New Capabilities
🏗️ Default Component Deployment (Day 0)▸
VCF Installer now deploys a default set of VCF Management Services during new deployment: VCF Services Runtime, Fleet Lifecycle, Identity Broker, Software Depot, Salt RaaS, Telemetry, License Server. Critical services available from Day 0.
📋 Integrated Planning Workflow▸
Define deployment topology + component selection in UI. VCF Installer generates CPU, Memory, Storage, VLAN, and FQDN requirements. Validates against target infrastructure prior to deployment.
🔗 LACP Configuration via Native UI▸
Native UI controls for configuring LACP on vSphere Distributed Switches during management domain deployment. Includes validation prechecks for physical network fabric. Previously API-only.
🔐 Auto-Generated Passwords During Deployment▸
VCF Installer auto-generates complex passwords for system-managed and break-glass accounts. Credentials retrieved post-deployment. Reduces risk from static/shared passwords during initial config.
⚙️ SDDC Manager — New Capabilities
🔀 Dual Stack (IPv4/IPv6) Networking Support▸
Native support for Dual Stack networking for management and workload domains. New deployments: configure with IPv4 or Dual Stack. Existing: after upgrade to 9.1, configure SDDC Manager for Dual Stack → deploy new workload domains in Dual Stack mode.
🛠️ Out-of-Band Operations in vCenter▸
New operations supported in vCenter without impacting SDDC Manager: vDS changes (add/remove/teaming/MTU/PNICs), primary datastore changes, datastore changes, manual vCenter upgrade.
🌐 Custom Networking for VCF Operations/Automation Deployment▸
VCF Installer UI supports deployment of VCF Operations and VCF Automation on custom network configurations: separate VDS, DVPGs, VPCs, NSX Segments.
🔄 Convergence: vCenter 8.0 U3a+ with NSX 4.2+ Supported▸
Convergence/import now supported for: existing vCenter 8.0 U3a+ with NSX 4.2+ (no manual upgrades). vCenter 8.0 U3a+ without NSX (manual vCenter upgrade to 9.1 required). vCenter instances in NSX Federation configurations.
🏗️ Build Capabilities
🔄 Fleet Lifecycle (Replaces Fleet Management Appliance)▸
Standalone Fleet Management Appliance is replaced by Fleet Lifecycle component. Streamlines lifecycle management of VCF management components. Fetches inventory from legacy Fleet management appliance on deployment.
🌐 UI Support for LACP▸
Native UI controls for LACP on vSphere Distributed Switches during workload domain deployment. Includes validation prechecks for physical network fabric. Previously API-only capability.
📦 Workload Domain Without vSphere Cluster▸
New workflow: deploy vCenter + new/existing NSX Manager without a vSphere Cluster. Warning: Cannot patch/upgrade components until cluster is added. Domains sharing NSX with a clusterless domain are also blocked from patch/upgrade.
📊 Operate & Protect
🛡️ Security Posture Management (Replaces Compliance)▸
Compliance feature deprecated → replaced by Security Posture Management. Enhanced assessment and remediation capabilities. Continuous compliance enforcement. Unified security posture management for VCF stack.
📊 Real-Time Metrics API (VODAP) — New▸
High-granularity (up to 2-second) Prometheus-compatible APIs. Covers ESX, vCenter, vSAN, NSX. Native Grafana/PromQL support. Built-in profiles: Essentials, Standard, Verbose. Replaces legacy vStats Tech-Preview APIs.
🔍 vCenter Group Federated API (VGFA)▸
Single unified API endpoint for managing all vCenter instances in a group. View/manage inventory across multiple vCenters as one. No changes to existing API integrations. Enables from VCF Operations UI with SSO + vCenter group config.
🤖 Provider Management
🔄 Migration Tool (VCD → VCF Automation)▸
In-place migration from VMware Cloud Director (VCD) to VCF Automation. Contact Broadcom representative for access. Full provider management transition support.
🛡️ vDefend DFW + Gateway Firewall Integration▸
Provider admins can delegate vDefend Firewall services to org admins. Control over vDefend Gateway for Transit Gateway Firewall and DFW. Out-of-the-box security profiles for VPCs. RBAC labeling for dynamic security groups.
⚖️ Full Avi Load Balancer Self-Service▸
Delegate LB creation/management to All Apps org. Set quotas (SE limits, app limits). Provision namespaces with Avi LB. Full VIP, pool, health monitors, persistence profiles. Also supported for VM Apps orgs.
🏢 Organization Management
🔗 Multiple External Connections per Org▸
Multiple exit points for external communication per organization. Supports centralized connections (NSX Tier-0/VRF) and distributed VLAN connections. Previously limited to single provider gateway.
🌐 Shared VLAN Extension Subnets▸
Configure VLAN extension NSX subnets + share with one or multiple orgs. Enables workloads to directly connect to devices on VLAN. Provider Management UI control.
📊 External IP Blocks with Multiple CIDRs▸
IP spaces renamed to external IP blocks. Multiple CIDRs per block. Included/excluded custom IP ranges. NSX + Infoblox External IPAM integration. Option to hide IP block content from consuming orgs.
☕ Java SDK
- New components: NSX, VCF Ops Log Mgmt, Ops for Networks, Fleet Lifecycle, SDDC Lifecycle
- VODAP OpenAPI specifications now available
- New samples for VCF Installer, vCenter, NSX, VCF Operations, SDDC workflows
- Build system changed: Gradle → Maven
- Code samples shipped as separate .ZIP
🐍 Python SDK
- New components: NSX, VCF Ops Log Mgmt, Ops for Networks, Fleet Lifecycle, SDDC Lifecycle
- VODAP OpenAPI specifications now available
- New samples: VCF Installer, vCenter, NSX, VCF Operations, SDDC workflows
- Code samples shipped as separate .ZIP
⚡ PowerCLI 9.1
- High-performance storage capabilities
- Advanced networking features
- Critical security capabilities
- VCF PowerCLI Changelog tracked separately
🔌 New REST API Capabilities
- Real-Time Metrics APIs (VODAP): Prometheus-compatible, up to 2-sec granularity, Grafana-native
- vCenter Utilization API: Monitor vCenter capacity, connections, service request limits; configurable thresholds + alarms
- vCenter Group Federated API (VGFA): Single endpoint for multi-vCenter management
- Query API: Fast vSphere inventory retrieval, server-side filtering, pagination, projections, entity counts
- vSAN Data Protection API: 17 new operations for vSAN protection workflows
Upgrade Sequence & Paths to VCF 9.1
⚠️ STRICT UPGRADE SEQUENCE REQUIRED
Upgrading to 9.1 requires a strict component upgrade sequence. Incorrect sequence results in errors. Follow upgrade path exactly as documented.
Path A: VCF 5.2.x → 9.1
VCF 5.2.x
→
Identity Broker
→
VCF Operations 9.1
→
SDDC Manager 9.1
→
Mgmt Services
→
vCenter+NSX 9.1
→
ESX 9.1
→
NSX Edge 9.1
→
vDS Upgrade
→
vSAN On-Disk
Path B: VCF 9.0.x → 9.1
VCF 9.0.x
→
Redeploy Identity Broker
→
VCF Operations 9.1
→
SDDC Manager 9.1
→
Core Components
🔧 Pre-Req: Identity Broker 9.0.x
Must redeploy VCF Identity Broker 9.0.x to supported network/datastore before upgrading to 9.1.
Path C: vSphere Foundation → 9.1
vSF 5.2.x / 9.0.x
→
Deploy Mgmt Services + License Server
→
vSphere 9.1
Path D: vSphere 8 + Aria Ops 8 → 9.1
vSphere 8
→
Phase 1: Follow Upgrade Order
→
Aria Ops 8 → VCF Ops 9.1
→
vSphere 9.1
⚙️ VCF Installer to vSphere LCM Images Transition (Critical Pre-Req)
- vSphere LCM Baseline → Image transition required before ESX 9.1 upgrade
- Methods: PowerShell Script (menu-driven or CLI) or SDDC Manager API
- API workflows: Cluster API workflow or Standalone Hosts API workflow
- PowerShell script has CLI options: cluster, standalone hosts, verbose mode
- NSX Upgrade Checklist: Pre-upgrade tasks + manage unsupported features
- Two NSX upgrade modes: Optimized (parallel) or Sequential
- NSX Edge Cluster upgrades finalize AFTER NSX Manager upgrade
- vDS + vSAN On-Disk format upgrades AFTER ESX upgrade
- VCF Automation SSO migration: vIDM → Identity Broker required
API Changelog Summary — VCF 9.1
🖥️ vSphere APIs
Virtual Infrastructure JSON API
48
New Ops
0
Deprecated
0
Deleted
vSphere Automation API
101
New Ops
28
Deprecated
28
Deleted
🌐 NSX APIs
| Spec | 🟢 New | 🟡 Dep | 🔴 Del |
|---|---|---|---|
| NSX Policy API | 264 | 6 | 9 |
| NSX Global Policy API | 58 | 3 | 0 |
| NSX Manager API | 31 | 11 | 17 |
| NSX Autonomous Edge API | 9 | 0 | 1 |
📊 VCF Operations & Management APIs
| Spec | 🟢 New | 🟡 Dep | 🔴 Del |
|---|---|---|---|
| VCF Operations API | 134 | 0 | 0 |
| Log Management API | 23 | 0 | 136 |
| SDDC Manager API | 48 | 21 | 0 |
| VCF Fleet LCM Service APIs | 51 | 0 | 0 |
| VCF SDDC LCM Service APIs | 26 | 0 | 0 |
| VCF Ops Orchestrator API | 7 | 0 | 1 |
| VCF Ops for Networks API | 5 | 22 | 1 |
🔐 Identity, Installer, Protection APIs
| Spec | 🟢 New | 🟡 Dep | 🔴 Del |
|---|---|---|---|
| VMware Identity Broker - vCenter API | 9 | 0 | 0 |
| VCF Installer API | 5 | 0 | 0 |
| vSAN Data Protection API | 17 | 0 | 0 |
| All Apps Org - Access Control | 77 | 0 | 32 |
Deprecations & End of Support — VCF 9.1
| Component | Feature/Item | Status | Notes |
|---|---|---|---|
| ESX | USB and SD boot devices | DEPRECATED → Next Major | Support deprecated, removed in next major release |
| ESX | ESX without persistent system storage (OSDATA) | DEPRECATED → Next Major | Devices < 32GB also deprecated |
| ESX | APIs for reconfiguring system storage locations | DEPRECATED → Next Major | Part of system storage deprecation |
| ESX | Suspend-to-RAM during ESX upgrades | DEPRECATED → Future | Use suspend-resume or vSphere vMotion in maintenance mode |
| ESX | Marvell/Aquantia (Atlantic) NIC drivers (10GbE USB/PCIe) | DEPRECATED → Future | Commonly used in home labs |
| ESX | AMD Solarflare 8000 and X2 series Ethernet adapters | DEPRECATED → Future | — |
| ESX | SHA1-based cryptographic algorithms | DEPRECATED → Future | — |
| ESX | Marvell E3/E4 Drivers (FastLinQ 57800/41000 series) | DEPRECATED → Future Major | CNAs: FastLinQ 57800/57810/57811, 41000/45000 series |
| ESX | Cisco VIC 1200/1300 Series | DEPRECATED → Future Major | Lack of support for Enhanced Data Path (EDP) |
| ESX | First Class Disk on NFS v3 (>128 hosts) | NOT SUPPORTED | FCD/IVD in NFS v3 datastores shared by >128 ESX hosts |
| vCenter | IPFIX on VDS Uplink Port Group + LagIpfixConfig | DEPRECATED → Future Major | Upgrade blocked if IPFIX active on uplink ports — remove before upgrading |
| vCenter | Syslog Port 514 (UDP/TCP unencrypted) | BLOCKED in 9.1 | Use port 1514 (TLS). Use syslog.ext.tls.port for scripted installs |
| vCenter | vSphere Cluster Services (vCLS) | REMOVED — Deactivated by Default | Cannot be re-activated. APIs removed in next major release. vCLS decoupled from DRS/HA in 9.0 |
| NSX | LagIpfixConfig + overwrite port policy Netflow | DEPRECATED | VDS IPFIX backed by NSX Connection Track IPFIX; uplink port not supported |
| NSX | Logical MP API for port mirroring | REMOVED in 9.1 | No longer supported |
| VCF Installer | vSphere Cluster Services (vCLS) in SDDC Manager UI | ALL vCLS UI REMOVED | In 9.0 vCLS was decoupled from DRS/HA; in 9.1 all UI removed |
| VCF Operations | Compliance feature | DEPRECATED → Replaced | Replaced by Security Posture Management |
| VCF Operations HCX | PhotonOS-based appliances | DEPRECATED | New NSX Edge-based stack introduced (better performance) |
| VCF Operations | Legacy cluster expansion method (via newly deployed node) | DEPRECATED in 9.1 | — |
| Ops for Networks | Microsoft Azure + Amazon AWS as data sources | DEPRECATED | — |
| Ops for Networks | Bundled OpenSSL in VCF Ops for Logs Agent | DEPRECATED | — |
| Auto Deploy | Legacy Auto Deploy (PXE/TFTP-based) | DEPRECATED in 9.0 | Replaced by Zero Touch Provisioning (ZTP) in 9.1 |
| APIs | Legacy vStats Tech-Preview APIs | DEPRECATED | Replaced by Real-Time Metrics APIs (VODAP / Prometheus-compatible) |
Critical Notes, Warnings & Key Considerations
🔐 Microsoft Secure Boot Certificates Expiration
Microsoft UEFI + KEK CA 2011 certs expire June 2026. Windows Production PCA 2011 expires October 2026. ESX 9.1 is multi-signed: Microsoft UEFI CA 2011 + 2023 + VMware Secure Boot. Host Secure Boot of ESX 9.1 NOT affected. Complex effects on Windows/Linux guest VMs — see KB article 423893.
⚠️ Workload Domain Without vSphere Cluster — Patch Blocker
Creating a workload domain without a vSphere cluster blocks patch/upgrade until a cluster is added. All workload domains sharing NSX with a clusterless domain are also blocked.
🔄 VCF Automation SSO Migration Required
Must migrate VCF Automation SSO config from VMware Identity Manager (vIDM) to VCF Identity Broker before completing upgrade. Complex multi-step migration involving user groups, accounts, and OIDC connections.
📦 VCF Versioning Not Applicable to External Dependencies
OEM driver add-ons, ESX device drivers, UI plugins, and Kubernetes versions maintain their own external versioning. VCF 9.1 versioning does not apply to these. Clusters without active VMware Supervisor supported but cannot use key VCF capabilities (VCF Automation workflows).
ℹ️ Non-ASCII Input Not Supported
Components of VMware Cloud Foundation 9.1 do not accept non-ASCII input. This applies across the platform.
ℹ️ VCF Installer Default Component Deployment (Day 0)
New deployments now automatically deploy: VCF Services Runtime, Fleet Lifecycle, Identity Broker, Software Depot, Salt RaaS, Telemetry, License Server. No additional configuration required.
ℹ️ Live Patch Requirement
Live Patching for ESX requires TPM-enabled hosts. Covers up to 80% of patches. VMs continue running with no maintenance window.
ℹ️ Avi Load Balancer 32.1.1 — Separate BOM Version
Avi LB ships at version 32.1.1 (Build 25377988) — separate versioning scheme from VCF 9.1 components. Not included in VCF or vSphere Foundation SKU; add-on only.
ℹ️ Private AI Components — Separate Delivery
VMware Deep Learning VM 9.1 (Build 25217931) and Private AI Services 2.0.89 delivered separately from VCF 9.1 software bits. Guided deployment workflow and AI catalog items included in VCF software.
ℹ️ VCF Login URL Format
When logging in to VCF Operations, use https://<IP> or FQDN — not plain IP.
🛠️ Critical Technical Parameters & Limits
- ESX system storage min: 32 GB (USB/SD deprecated)
- NFS v3 FCD host limit: 128 ESX hosts max
- Live Patch coverage: Up to 80% of patches
- vCenter syslog port: 1514 (TLS); 514 blocked
- Grafana metrics granularity: Up to 2 seconds (VODAP)
- VCF supported languages: English, Japanese, Spanish, French
- SEV-SNP compatibility: AMD EPYC Zen 3 (Milan)+
- Intel TDX compatibility: Intel Xeon Gen 5 (Emerald Rapids)+
- ConnectX-7/BlueField-3: Enhanced DirectPath in 9.1
- AMD MI350: Enhanced DirectPath in 9.1
- Patch sub-releases tracked: 9.1.0.x (4 sub-releases)
- SDDC Manager patch count: 4 tracked (0100-0400)
- ZTP imaging: UEFI + HTTPS; static network config on bare metal
- vCLS: Deactivated by default; cannot be re-enabled in 9.1
- vSAN RAID default: RAID-6 (ESA, automatic in 9.1)