VCF Platform Definition & Construct Hierarchy (Taxonomy)
VMware Cloud Foundation® (VCF) — Definition
A full-stack private cloud IaaS platform delivering software-defined compute, storage, networking, security, and management. Provides public cloud scale & agility with on-premises security, resilience & performance, while lowering total cost of ownership. Supports traditional VMs, containers, AI/ML workloads, and self-service IaaS consumption across any environment — customer-managed DC, edge, or any cloud endpoint.
Full-Stack IaaS
Software-Defined
Multi-Tenant
Edge to Cloud
Self-Service
AI/ML Ready
Day 0/1/2 Automation
▸ VCF Construct Hierarchy — Private Cloud → Fleet → Instance → Domain → Cluster
📐 VCF Construct Reference — Hierarchy & Components
| Construct | Scope | Key Components |
|---|---|---|
| VCF Private Cloud | Highest Level | One or more VCF Fleets |
| VCF Fleet | Fleet Level | 1+ VCF Instances · 1+ standalone vCenters · VCF Operations · VCF Automation (fleet components run in 1st instance management domain) |
| VCF Instance | Instance Level | SDDC Manager · NSX Manager · vCenter(s) · ESX hosts · VCF Mgmt Services · License Server · Management Domain + optional Workload Domains |
| Management Domain | Domain Level | Created by VCF Installer · Hosts VCF Instance mgmt components · In 1st instance also hosts fleet components (VCF Ops, VCF Auto, License Server) · Min 4 ESX hosts |
| Workload Domain | Domain Level | Created in VCF Operations · Dedicated vCenter · Shared or dedicated NSX · ≥1 vSphere cluster with HA+DRS · ≥1 VDS · Optional Edge/VNA clusters · Optional vSphere Supervisor |
| VCF Domain | Generic | 1 vCenter · ≥1 vSphere clusters · ≥1 VDS per cluster · NSX Manager (shared or dedicated) · Optional NSX Edge or VNA clusters · ≥1 shared storage allocation |
⚡ Key Architectural Rules & Constraints
- First VCF Instance: Hosts both fleet-level components (VCF Ops, VCF Auto) AND instance-level components in its management domain
- Additional VCF Instances: Each has own SDDC Manager, NSX, vCenter(s), and instance-level VCF Mgmt Services (Fleet Lifecycle + Identity Broker)
- NSX Sharing: New workload domains can share NSX with an existing WLD or management domain, OR get a new dedicated NSX Manager cluster
- Workload Domain Without Cluster: Can deploy vCenter + NSX without a vSphere cluster (but cannot patch/upgrade until cluster is added) — NEW in 9.1
- Converged Environments: Management components CAN reside in workload domain vSphere clusters (not just management domain) when multiple vCenters are converged
- Standalone vCenters: VCF fleet can manage standalone vCenters (vSphere Foundation licensed) via VCF Operations without full VCF Instance status
- NSX Federation: Multiple NSX Local Managers managed by 1 Global Manager cluster (multi-site / multi-instance scenarios)
- VCF Installer OVA:
VCF-SDDC-Manager-Appliance-9.x.x.ova— contains both VCF Installer and SDDC Manager binaries
Core Component Overviews — VCF 9.1 Stack
🔧 VCF Installer / SDDC Manager — v9.1.0.0 (Build 25371088)
- Role: Dedicated VM that plans, configures, and deploys VCF and vSphere Foundation components
- OVA:
VCF-SDDC-Manager-Appliance-9.x.x.ova(contains both Installer + SDDC Manager binaries) - Scope: Major, minor, and maintenance releases — does NOT support patch or express patch releases
- Post-workflow: Apply patches manually after VCF Installer workflows complete
⚙️ VCF Installer Modes
| Mode | When | Capability |
|---|---|---|
| Installer Mode | Deployed on ESX host NOT part of target mgmt domain | Stays in installer mode post-deploy · Can deploy additional VCF Instances + run convergence workflows |
| SDDC Manager Mode | Deployed on host that IS part of mgmt domain | Switches to SDDC Manager during deployment · Cannot revert to installer mode · Migrates from local datastore → primary datastore (best practice) |
🚀 VCF Installer Operations
- Download binaries for VCF / vSphere Foundation deployment
- Plan size and configuration of new VCF or vSphere Foundation deployment
- Deploy and configure a new VCF or vSphere Foundation platform
- Reuse existing VCF Operations / VCF Automation instances for new VCF fleets
- Converge existing virtual infrastructure → VCF or vSphere Foundation platform
- Extend an existing VCF fleet by deploying an additional VCF Instance
- Deploy VCF management services + license server to complete vSphere Foundation upgrade to 9.1
- Review historical deployment details, download passwords, download JSON specifications
ℹ️ FC Storage Deployment Note
For FC storage environments: appliance CAN be initially deployed on the FC datastore directly (not just local datastore first).
🖥️ ESX Hypervisor — v9.1.0.0 (Build 25370933)
- User-Level Monitor (ULM): Default VM monitor in 9.1 — reimplements VMM in ESX, minimizes hypervisor code in privileged mode
- Zero Touch Provisioning (ZTP): UEFI+HTTPS-based network boot, replaces Auto Deploy (deprecated 9.0)
- Live Patching: Covers up to 80% patches; VMs remain running — requires TPM-enabled hosts
- NVMe Memory Tiering: Active pages→DRAM, cold pages→local NVMe
- Confidential VMs: AMD SEV-SNP (GA, Zen 3/Milan+) and Intel TDX (GA, Xeon Gen 5/Emerald Rapids+)
- Quick Boot + Confidential VMs: Now supported — bypasses full power cycle
- DirectPath GPUs: NVIDIA ConnectX-7, BlueField-3, AMD MI350 with vMotion+Live Patch support
- System Storage Min: 32 GB; USB/SD boot deprecated in 9.1
🖥️ vCenter Server — v9.1.0.0 (Build 25370922)
- vSphere Lifecycle Manager Images: Required for vSAN clusters — Baseline mode deprecated path
- vSphere Cluster Services (vCLS): Deactivated by default in 9.1; cannot re-enable; removed next major release
- Port 514 (syslog): BLOCKED — use port 1514 (TLS encrypted)
- vCenter Group Federated API (VGFA): Single endpoint for multi-vCenter management (enable from VCF Ops UI)
- Query API: Server-side filtering, pagination, projections for vSphere inventory
- Utilization API: Monitor vCenter connections and service request limits
- vSphere HA + DRS: Enabled on all VCF domain clusters
- Per-domain deployment: 1 vCenter per VCF domain
💾 vSAN ESA/OSA — v9.1.0.0 (ESA Witness: 25370927 / OSA Witness: 25370925)
- Function: Aggregates local/direct-attached storage across all ESX hosts → single shared storage pool
- Enables: vSphere HA, vMotion, DRS without external shared storage
- vSAN ESA: Optimized for high-performance NVMe-based TLC flash devices — default in VCF 9.1
- Auto RAID-6: Default RAID level for ESA clusters in 9.1 — automatic, no manual selection
- Scale: 2-node (+ witness) minimum up to 64 nodes per cluster
- Scaling modes: Scale-out (add nodes), Scale-up (add drives), Disaggregated (compute + storage independently)
- Global Deduplication: Cluster-wide, post-processing, encryption-supported (new in 9.1)
- File Services: NFS + SMB, AD integration, Kerberos auth, works in 2-node + stretched deployments
- Policy-based: VM-centric SPBM — per-VM compression policies, per-VM data services
- Cyber Recovery cluster: Deployable via vCenter Quickstart — on-premises clean room recovery
💾 vSAN Deployment Options
| Type | Architecture | Key Notes |
|---|---|---|
| HCI Cluster | Compute + Storage on same hosts | Standard single-rack or multi-rack; ESA or OSA |
| Storage Cluster | Dedicated storage nodes | Disaggregated — storage separate from compute |
| Compute Cluster | Compute-only, mounts vSAN datastore | Consumes storage from separate storage cluster |
| Stretched Cluster | 2 AZs + witness | ESA or OSA; witness in 3rd site/AZ; NSX Edge HA for networking |
| 2-Node (Edge) | 2 hosts + witness | For edge/remote sites; witness in cloud or central DC |
🌐 NSX Networking — v9.1.0.0 (Build 25318225)
- Model: Software-defined networking spanning DCs, clouds, and application frameworks
- L2-L7 stack: Logical switching, routing, distributed LB, VPN, QoS, monitoring
- Overlay: Virtual networks deployed non-disruptively over hardware — extend across DCs, private clouds, containers
- NSX Manager: 3-node cluster for HA; hosts Policy API and management UI
- NSX Policy API: +264 new operations in 9.1 (largest API expansion)
- VPC Networking: Transit Gateways (centralized or distributed VLAN), VPCs, subnets, external IPs, NAT
- vDefend Firewall: DFW + Gateway Firewall + ATP — now integrates with VCF Automation
- Virtual Network Appliance (VNA): New in 9.0/9.1 — L4 LB for VPCs; distributed VLAN connectivity for Supervisor
- Avi LB: Full integration with VPCs + Transit Gateways; L4/L7 self-service (add-on, v32.1.1)
- NSX Global Manager: Federation across multiple sites/instances
- Multi-tenancy: NSX Projects, VPCs — native isolation between tenants
🌐 NSX Connectivity Models
| Model | Type | Components |
|---|---|---|
| Centralized | NSX Edge Cluster | Tier-0 + Tier-1 Gateways; physical uplinks; N-S routing + services (LB, VPN, NAT, DHCP) |
| Distributed | VNA Cluster | Virtual Network Appliance; distributed VLAN connectivity; L4 LB for VPCs; Supervisor integration |
| VPC | NSX VPC | Self-service subnets; external IPs; NAT; DHCP; VLAN extension; consumed from vCenter + VCF Automation |
| Transit Gateway | NSX TGW | Centralized (Tier-0/VRF) or Distributed VLAN; multi-tenant E-W + N-S; Avi LB; IPSec VPN |
| Stretched | NSX Federation | Global Manager + Local Managers; stretched Tier-0/1; NSX Edge HA for dual-AZ; EVPN support |
📊 VCF Operations — v9.1.0.0 (Build 25346025)
- Role: Single-pane-of-glass fleet management and operational intelligence platform
- New UI structure: Build · Manage · Operate · Protect (4 functional pillars)
- Fleet Management: IAM (SSO, IdP), Certificates, Passwords, Tags, Config Templates across fleet
- Licensing: Unified license view; connected + disconnected modes; split/merge/change capacity
- Cloud Proxy: v9.1.0.0 (Build 25346033) — data collection agent for distributed environments
- VCF Ops Orchestrator: v9.1.0.0 (Build 25346069) — workflow automation engine
- VCF Ops for Networks: v9.1.0.0 (Build 25318550) — network flow analytics, topology, micro-segmentation
- VCF Ops HCX: v9.1.0.0 (Build 25318520) — workload mobility; moving from PhotonOS → NSX Edge stack
- Security Posture Mgmt: Replaces legacy Compliance feature; continuous assessment + remediation
- Real-Time Metrics: Prometheus/PromQL; up to 2-sec granularity; native Grafana integration
📊 VCF Operations Functional Scope
| Pillar | Key Capabilities |
|---|---|
| BUILD | Deploy/import workload domains · Software Depot · LCM (Fleet Lifecycle + SDDC Lifecycle) · Binary management · Converge/upgrade workflows · Developer Center (APIs/SDKs) |
| MANAGE | IAM (VCF SSO) · Certificate Mgmt · Password Mgmt · License Mgmt · Config Templates · Tag Mgmt · Cloud Proxy · Drift Detection |
| OPERATE | Real-Time Metrics (PromQL) · Dashboards · Alerts · Log Management · VCF Ops for Networks · Storage Ops · Workload Monitoring · FinOps/Capacity · VCF Health |
| PROTECT | Security Posture Mgmt · Compliance · Protection & Recovery · vSAN Snapshots · vSphere Replication · Audit Records · Governance · Ransomware Recovery |
🤖 VCF Automation — v9.1.0.0 (Build 25370929)
- Role: Self-service private cloud for AI, Kubernetes, and VM-based applications (formerly VMware Aria Automation)
- Cloud Services: Self-service provisioning of VMs, K8s workloads, networking, volumes, secrets, DBs, Harbor registries, External DNS, Certs, AI workloads, Catalogs
- Provider Management: Multi-tenancy via Organizations; isolated environments with dedicated network setup; resource monitoring; permission control
- Organization Management: Projects + vSphere Namespaces for app teams; VPCs; resource limits; Policy as Code
- vSphere Supervisor: Embedded K8s control plane in ESX; VKS; vSphere Pods; OCI registries; Data Services API; GitOps workflows
- New in 9.1: VCD → VCF Automation migration tool · vDefend DFW/GW Firewall integration · Avi LB self-service · Multiple external connections · Shared VLAN extension subnets · External IP Blocks + Infoblox
- Interfaces: UI · CLI · API (REST) · Terraform Provider
- Tenancy Models: VM Apps Org (traditional) and All Apps Org (modern/K8s) — bimodal consumption
🤖 VCF Automation Architecture Layers
CLOUD SERVICES LAYER (Consumer-facing)
Self-service portal · UI / CLI / API · Catalogs · Blueprints / Templates · Policy-as-Code · AI workload provisioning
ORGANIZATION MANAGEMENT (Tenant Admin)
Projects · vSphere Namespaces · VPC delegation · Resource limits/quotas · Policy-as-Code enforcement
PROVIDER MANAGEMENT (IT / CSP Admin)
Organizations · External connections (Tier-0/VRF or VLAN) · IP Blocks (multi-CIDR + Infoblox) · Avi LB quota delegation · vDefend Firewall delegation
vSPHERE SUPERVISOR (Infrastructure Foundation)
K8s control plane in ESX · VKS clusters · vSphere Pods · OCI registries · Data Services · GitOps · Native API surface
VCF Management Services Architecture — NEW in 9.1
✅ NEW in VCF 9.1 — Unified Service-Oriented Platform
VCF Management Services is a new unified platform introduced in 9.1 for centralized lifecycle management and operational functionality. All components automatically deployed on new VCF installations (Day 0).
⚙️ VCF Services Runtime — Kubernetes-Based Architecture
🧩 VCF Management Services Components — Default Day 0 Deployment
| Component | Role | Build | VCF | vSF |
|---|---|---|---|---|
| VCF Services Runtime | Shared K8s runtime for all mgmt svc components | 25370367 | ✅ | ✅ |
| Fleet Lifecycle | LCM for VCF Ops, Mgmt Services, VCF Auto across fleet | 25371109 | ✅ | ✅ |
| SDDC Lifecycle | LCM for components on VCF Instances | 25371107 | ✅ | ✅ |
| Identity Broker | Federation SSO; SAML/OIDC/AD/LDAP IdP integration | 25368698 | ✅ | — |
| Software Depot | Binary management + distribution for VCF components | 25371105 | ✅ | ✅ |
| Log Management | Centralized log aggregation for VCF stack | 25346055 | ✅ | ✅ |
| Real-Time Metrics | Prometheus/PromQL metrics; up to 2-sec granularity | 25346020 | ✅ | — |
| Salt RaaS + Master | Configuration automation and state management | 25346036 | ✅ | ✅ |
| Telemetry | Usage telemetry collection | 25181946 | ✅ | ✅ |
| License Server | License distribution; connected/disconnected mode | 25346031 | ✅ | ✅ |
ℹ️ Services Runtime = Kubernetes Cluster
The VCF Services Runtime is a purpose-built K8s cluster running as VMs on the management domain's vSphere cluster. It is NOT the same as a customer workload Kubernetes cluster. Self-healing, anti-affinity, and component rebalancing are built-in behaviors.
⚠️ Multi-Replica vs. Single-Instance Components
Components WITH HA support (e.g., Identity Broker): multiple replicas distributed across worker nodes. Components WITHOUT HA: scheduled with reserved overhead so they can restart on a running worker node if one fails — they do NOT achieve true HA.
VCF Operational Pillars — Build · Manage · Operate · Protect
BUILD
Deploy & Lifecycle
- Deploy new VCF fleet / instances
- Import/converge existing vCenter
- Create workload domains
- Add vSphere clusters + ESX hosts
- Upgrade VCF components (LCM)
- Software Depot binary management
- Fleet Lifecycle + SDDC Lifecycle
- Deploy post-initial components
- Developer Center (APIs + SDKs)
- Backup + Restore fleet
MANAGE
Compliance & Standardization
- VCF SSO (fleet-wide IdP)
- Certificate lifecycle management
- Password management + rotation
- License entitlement + usage
- Tag management across vCenters
- Config Templates + Drift Detection
- Cloud Proxy deployment + groups
- Link vCenters (VGFA)
- Workload migration (HCX)
- FinOps + Capacity management
OPERATE
Visibility & Intelligence
- Real-Time Metrics (Prometheus)
- Dashboards (Capacity/Perf/Cost)
- Intelligent Alerts + Notifications
- Log Management + Analysis
- Network Operations (Ops for Nets)
- Storage operations monitoring
- Workload monitoring (Telegraf)
- VCF Health + Diagnostics
- Reports + Views
- Sustainability metrics
PROTECT
Security & Recovery
- Security Posture Management
- Continuous compliance enforcement
- Protection + Recovery dashboards
- vSAN Snapshots + Replication
- vSphere Replication
- Cyber Recovery (on-prem clean room)
- Ransomware recovery (integrated)
- Audit Records + Audit Trail
- CVE / Security Advisories
- VM encryption status monitoring
VCF vs vSphere Foundation (vSF) — Feature Scope & Differences
🔵 VMware Cloud Foundation (VCF) — Full Private Cloud Platform
- Full-Stack IaaS: Software-defined compute + storage + networking + security + management
- Integrated automation → self-service platform (VCF Automation)
- VCF Installer + SDDC Manager for full lifecycle automation
- NSX for software-defined networking (included in SKU)
- VCF Automation for multi-tenant self-service provisioning
- VCF Operations (includes VCF Ops for Networks + HCX + Orchestrator)
- VCF Fleet management (cross-instance SSO, certs, passwords)
- VCF Management Services (Fleet Lifecycle, Identity Broker, etc.)
- Hardened platform: built-in resilience, scaling, clustering
- Provides cloud agility without scaling staff
🟢 vSphere Foundation (vSF) — Enterprise Workload Platform
- Subset of VCF: Enterprise-grade workload platform without cloud mgmt + automation
- Unified workload platform: VMs + containers side by side (native K8s runtime)
- Intelligent operations management for visibility + optimization
- HCI: compute + storage virtualization integration (vSAN)
- Simplified deployment + scalability for faster app delivery
- Excludes: Cloud management capabilities, integrated automation (VCF Automation)
- Includes VCF Operations (for monitoring, licensing, basic fleet mgmt)
- Includes VCF Mgmt Services (subset): Fleet Lifecycle, SDDC Lifecycle, Log Mgmt, Salt, Telemetry, License Server, Software Depot, Services Runtime
- Excludes: NSX (in base SKU), Identity Broker, VCF Automation, VCF Ops for Networks/HCX, Real-Time Metrics
📊 VCF vs vSF — Component Inclusion Matrix
| Component | VCF SKU | vSF SKU | Notes |
|---|---|---|---|
| ESX Hypervisor | ✅ | ✅ | Core compute platform |
| vCenter Server | ✅ | ✅ | Per domain |
| vSAN Storage | ✅ | ✅ | ESA + OSA; HCI, Storage, Compute, Stretched cluster models |
| vSphere Supervisor | ✅ | ✅ | K8s control plane in ESX |
| VCF Operations | ✅ | ✅ | Full platform in VCF; monitoring + LCM in vSF |
| VCF Services Runtime | ✅ | ✅ | K8s runtime for mgmt services |
| Fleet Lifecycle + SDDC Lifecycle | ✅ | ✅ | LCM components |
| Log Management | ✅ | ✅ | Centralized logging |
| Salt RaaS + Master | ✅ | ✅ | Config automation |
| Telemetry + Software Depot | ✅ | ✅ | Binary mgmt |
| License Server | ✅ | ✅ | Connected + disconnected mode |
| VCF Ops Orchestrator | ✅ | ✅ | Workflow automation |
| VMware Tools + VMRC | ✅ | ✅ | Guest agent + console |
| NSX Networking | ✅ | — | Not included in vSF base SKU |
| VCF Automation | ✅ | — | Cloud mgmt + self-service automation |
| Identity Broker | ✅ | — | Fleet-wide SSO federation |
| VCF Ops for Networks | ✅ | — | Network flow analytics |
| VCF Ops HCX | ✅ | — | Workload mobility |
| Real-Time Metrics (VODAP) | ✅ | — | Prometheus-compatible 2-sec granularity |
| VCF Installer / SDDC Manager | ✅ | ✅ | Used for deployment; vSF uses for upgrading to 9.1 + deploying mgmt svcs |
| Protection and Recovery (Add-on) | Add-on | Add-on | Optional for both |
| Avi Load Balancer | Add-on | Add-on | v32.1.1; separate versioning |
VCF Capabilities by Job Function
👤 Job Functions in VCF 9.1
| Role | Category | Primary Responsibility |
|---|---|---|
| VI Admin / Provider Admin | Infrastructure | Build, manage, and operate cloud infrastructure to provide resources for running applications |
| Platform Operator | Operations | Track and analyze performance and behavior of workloads across the platform |
| Org Admin / Tenant Admin | Tenant | Enable consumers to operate autonomously and efficiently in allocated cloud resources |
| Platform Engineer | Automation | Manage, automate, and monitor cloud infrastructure for self-service workload provisioning |
| Application Developer | End User | Develop and deploy VM- or container-based applications in the cloud |
| DevOps Engineer | End User | Manage K8s and VM infrastructure on vSphere Supervisor for CI/CD of applications |
| Storage Administrator | Specialist | Build and manage all centralized storage in the private cloud |
| Network Administrator | Specialist | Build and manage network services across the VCF stack |
⚙️ VI Admin — Full Capability Scope
- Deploy a new VCF platform
- Converge existing virtual infrastructure to VCF
- Upgrade to VCF 9.1
- Deploy a workload domain
- Import existing vCenter as workload domain
- Add vSphere cluster or ESX host to workload domain
- Configure vSAN stretched cluster
- Manage network connectivity (Transit Gateways in vCenter)
- Manage VPCs in vCenter (backed by NSX Edge/VNA)
- Manage virtual infrastructure in vCenter
- Manage binaries (Software Depot) for LCM
- Add VCF components post initial deployment
- Back up and restore VCF fleet and managed instances
- Manage lifecycle of VCF components
- Manage Licensing
- Configure identity and access using VCF SSO
- Link vCenter instances for centralized inventory (VGFA)
- Manage certificates across VCF fleet
- Manage passwords across VCF fleet
- Manage tags across VCF fleet
- Manage config settings for vCenters + vSphere clusters
- Migrate workloads across workload domains and vCenter instances
- Configure alerts and notifications
- Perform log analysis and troubleshooting
- Monitor network operations (Ops for Networks)
- Monitor storage operations
- Perform infrastructure diagnostics + VCF health monitoring
- Configure and use monitoring dashboards
- Configure and use monitoring reports
- Perform workload monitoring and observability (Telegraf)
- Manage cost and capacity (FinOps)
- Mitigate security risks + compliance discovery
- Deploy and configure vSphere Supervisor for K8s + VM workloads
- Manage infrastructure and IAM for consumer organizations
Getting Started — Paths to Building a VCF / vSF Platform
🔵 Getting Started with VCF — 4 Paths
🏗️ Path 1: Deploy a New VCF Fleet▸
- Deploy fleet components + first VCF Instance with first management domain
- 1st management domain hosts both fleet components (VCF Ops, VCF Auto) and instance components
- Tool: VCF Installer (in installer mode) → then switches to SDDC Manager mode
- Post-deploy: Assign license → Configure Software Depot → Configure IAM → Configure Backup
➕ Path 2: Deploy Additional VCF Instance in Existing Fleet▸
- Deploy new VCF Instance with its management domain into existing VCF fleet
- Use existing VCF Operations + VCF Automation from fleet (no redeployment needed)
- Tool: VCF Installer (stays in installer mode for additional instances)
- New instance gets: own SDDC Manager, NSX, vCenter, instance-level VCF Mgmt Services
🔄 Path 3: Converge Existing Virtual Infrastructure → VCF▸
- Converge to new VCF fleet: Use VMware Aria Operations + existing vCenter as the fleet; ESX hosts running Aria Ops become 1st instance mgmt domain
- No Aria Ops? Use plain vCenter + ESX as 1st instance; deploy VCF Operations + fleet components on top
- Converge to existing fleet: Add existing vCenter + managed ESX hosts as a new VCF Instance (management domain) to existing fleet
- Supported: vCenter 8.0 U3a+ with NSX 4.2+; or vCenter 8.0 U3a+ without NSX (manual vCenter upgrade to 9.1 required)
⬆️ Path 4: Upgrade Existing VCF Platform (5.2.x / 9.0.x → 9.1)▸
- Upgrade existing Aria components + management domain components first
- If Aria Operations not in VCF 5.2 env: deploy VCF Operations as part of upgrade
- Then upgrade Aria components + mgmt domain; deploy VCF Management Services
- Deploy remaining fleet components as needed
- Critical pre-req: Redeploy Identity Broker 9.0.x to supported network/datastore before upgrading to 9.1
📋 Post-Deployment Config Checklist
- Assign license to VCF fleet/instance/workload domain in VCF Operations (must be done immediately after deployment)
- Configure Software Depot settings
- Configure IAM using VCF Single Sign-On
- Configure certificate management
- Configure backup of management components
- Deploy vSphere Supervisor (if K8s workloads needed)
- Add workload domains to VCF Automation for end-user consumption
🟢 Getting Started with vSphere Foundation (vSF) — 3 Steps
Step 1: Deploy VCF Operations
→
Step 2: Add vCenter Instances
→
Step 3: Complete Config
Step 1: Deploy VCF Operations (2 options)▸
- Option A: Deploy VCF Operations with a new vCenter instance from scratch
- Option B: Deploy VCF Operations on an existing vCenter instance (with managed vSphere clusters)
- Upgrade path: Upgrade Aria Operations → VCF Operations 9.0 first, then vCenter + ESX → 9.0; then upgrade to 9.1
Step 2: Add vCenter Instances to VCF Operations▸
- Add vCenter instances running consumer workloads as data sources in VCF Operations
- Managed as "vSphere as a data source" — monitored, licensed, and managed from VCF Operations
- These become part of the VCF fleet even without full VCF Instance status
Step 3: Complete Platform Config▸
- Assign license (immediately after deployment)
- Configure backup of management components
- Configure certificate management
- Deploy and configure vSphere Supervisor (for K8s workloads)
- Deploy VCF Mgmt Services + License Server (for vSF upgrade to 9.1)
🔗 Workload Domain Addition Options (Post Fleet/Instance Deploy)
| Method | How | Notes |
|---|---|---|
| Deploy New WLD | VCF Operations workflow | VCF Ops deploys vCenter + NSX Manager (shared or new); optional Supervisor + NSX VPC on initial cluster |
| Deploy WLD Without Cluster | VCF Operations workflow (NEW 9.1) | Deploys vCenter + joins/deploys NSX Manager; cannot patch until cluster added; shared NSX domains also blocked |
| Import Existing vCenter | Convergence workflow | vCenter 5.x compatible; upgrade to 9.1 after import; workload domain created from existing infra |
| Add to VCF Automation | Post WLD creation | Add initial WLD infrastructure to VCF Automation for end-user self-service consumption |
VCF Design Guidance — Structure, Elements & Groups
📐 Design Guidance Structure
| Section | Purpose |
|---|---|
| Architectural Options | Overview of each VCF component with high-level comparisons of benefits + implications of available options |
| Design Blueprints | Collection of design requirements + recommendations based on a defined design profile; use as full end-to-end design OR starting point; adjust to suit specific objectives |
| Design Library | Detailed design for each VCF component — requirements + recommendations for every architectural choice |
🔖 Design Element Types
| Element | Meaning | Can Deviate? |
|---|---|---|
| Design Requirement | Required for operation of VCF | ❌ NO — deviations not permitted |
| Design Recommendation | Recommended as best practice | ✅ YES — deviations permitted |
| Design Choice | Must choose one of multiple options; simple config options or choice between elemental models | ✅ YES — choose one valid option |
📋 Design Blueprint Groups
🏗️ Infrastructure Modernization Blueprints▸
- VCF Fleet in a Single Site with Minimal Footprint
- VCF Fleet in a Single Site (Standard)
- VCF Fleet with Multiple Sites in a Single Region
- VCF Fleet with Multiple Sites Across Multiple Regions
- VCF Fleet with Multiple Sites in a Single Region plus Additional Region(s)
- VCF Fleet Management Blueprint (IAM, Certs, Passwords, Config, Tags, Monitoring)
- VCF Edge Design Blueprints (Government/Defense, Manufacturing)
📱 Application Modernization Blueprints▸
- Self-Service Multi-Tenant Private Cloud Consumption Design
- VMware vSphere Kubernetes Service Consumption Blueprint
- Private AI Services Consumption Blueprint
- Securing VCF Automation Deployment Pattern 3 with vDefend and Avi
🛡️ Security Modernization Blueprints▸
- VCF Component Backup and Restore
- VCF Instance Backup and Restore
- VCF Fleet Disaster Recovery
- Cyber Recovery for VMware Cloud Foundation
- Lateral Security with vDefend (Management Domain + Workload Domain Security)
- Security Services Platform for VMware Cloud Foundation
⚙️ Administration — SDKs, APIs, CLI▸
- VCF SDKs (Java, Python, PowerCLI)
- VCF Programming Guide (vCenter REST, vSphere Automation, Web Services APIs)
- VCF Operations API
- VCF Operations for Networks API
- VCF Automation APIs (VM Apps + All Apps)