Programmable Infrastructure with VCF 9.1

It is our pleasure to announce the general availability of VMware Cloud Foundation (VCF) 9.1. This release is the culmination of our efforts to deliver an API-first private cloud platform that fulfills the promise of providing programmable infrastructure to our customers and partners. What was once a siloed platform with discrete APIs and fragmented automation tools is now a simplified platform with a unified, API-first consumption interface. All of our automation tools are now dictated by these API contracts to deliver a simple, consistent, and extensible developer experience when working with VCF.

Our developer communities are as diverse as the workloads they manage, spanning every industry vertical and utilizing a vast array of programming languages and frameworks. We recognize that these teams operate under stringent compliance mandates and unique security requirements. Regardless of the platform, the fundamental requirement remains the same: frictionless access to API specifications and the secure, verified delivery of automation tooling.

Whether your team relies on Python, Java, PowerCLI, or Terraform, VCF 9.1 helps ensure that your choice of language is never a compromise. By adopting OpenAPI specifications as our single source of truth, we have moved to a model of automated SDK generation. This shift allows us to package our entire developer tooling as a single, secure, and synchronized deliverable.

This new approach provides three critical advantages:

Universal Language Parity

Generating SDKs directly from the API contract, we provide functional symmetry. A method invoked in Python behaves exactly as it does in Java or PowerShell, eliminating the “feature gap” typically found in manual library builds.

Predictable Automation Experience

Automation is now dictated by the API contract itself. This provides a predictable developer experience where your scripts and integrations remain stable, even as the underlying platform evolves.

Secure Distribution Channel

We have streamlined the delivery pipeline to ensure that all SDKs and tools, including PowerCLI are delivered through the secure Broadcom Developer Portal or standardized package distribution channels such as PyPi for Python and Maven Central for Java. This simplifies lifecycle management and helps ensure that every tool in your environment meets the high security and compliance standards.

What is Programmable Infrastructure?

The idea of a programmable infrastructure actually boils down to one key aspect: the pivoting away from managing cloud resources to the ability to write code that defines those resources using the same programming language constructs an application is written in. It is the realization that a virtual network, storage or a VKS cluster instance should be treated no differently than a class or a function in a developer’s IDE.

Example: Terraform Resource to Configure vSphere Supervisor

resource "vsphere_virtual_machine_class" "vm_class" {
  name   = "custom-class"
  cpus   = 4
  memory = 4096
}

resource "vsphere_supervisor" "supervisor" {
  cluster         = "&lt;compute_cluster_id&gt;"
  storage_policy  = "&lt;storage_policy_name&gt;"
  content_library = "&lt;content_library_id&gt;"
  main_dns        = "10.0.0.250"
  worker_dns      = "10.0.0.250"
  edge_cluster    = "&lt;edge_cluster_id&gt;"
  dvs_uuid        = "&lt;distributed_switch_uuid&gt;"
  sizing_hint     = "MEDIUM"

  management_network {
    network          = "&lt;portgroup_id&gt;"
    subnet_mask      = "255.255.255.0"
    starting_address = "10.0.0.150"
    gateway          = "10.0.0.250"
    address_count    = 5
  }

  ingress_cidr {
    address = "10.10.10.0"
    prefix  = 24
  }

  egress_cidr {
    address = "10.10.11.0"
    prefix  = 24
  }

  pod_cidr {
    address = "10.244.10.0"
    prefix  = 23
  }

  service_cidr {
    address = "10.10.12.0"
    prefix  = 24
  }

  search_domains = &#91;"vsphere.local"]

  namespace {
    name              = "custom-namespace"
    content_libraries = &#91;]
    vm_classes        = &#91;"${vsphere_virtual_machine_class.vm_class.id}"]
  }
}

resource "vsphere_virtual_machine_class" "vm_class" {

name = "custom-class"

cpus = 4

memory = 4096

}

resource "vsphere_supervisor" "supervisor" {

cluster = "<compute_cluster_id>"

storage_policy = "<storage_policy_name>"

content_library = "<content_library_id>"

main_dns = "10.0.0.250"

worker_dns = "10.0.0.250"

edge_cluster = "<edge_cluster_id>"

dvs_uuid = "<distributed_switch_uuid>"

sizing_hint = "MEDIUM"

management_network {

network = "<portgroup_id>"

subnet_mask = "255.255.255.0"

starting_address = "10.0.0.150"

gateway = "10.0.0.250"

address_count = 5

}

ingress_cidr {

address = "10.10.10.0"

prefix = 24

}

egress_cidr {

address = "10.10.11.0"

prefix = 24

}

pod_cidr {

address = "10.244.10.0"

prefix = 23

}

service_cidr {

address = "10.10.12.0"

prefix = 24

}

search_domains = ["vsphere.local"]

namespace {

name = "custom-namespace"

content_libraries = []

vm_classes = ["${vsphere_virtual_machine_class.vm_class.id}"]

}

The Role of API Standard and Validation

This seamless cycle between cloud and application workload depends entirely on the cloud environment’s ability to provide deep extensibility. Having API coverage is only one piece of the puzzle; the true value lies in having that coverage abstracted to a level where the API exhibits the required schema and validations. These guardrails protect the integrity of the system, so as developers define infrastructure through code, the API servers remain resilient against “bad requests” or DoS attacks. In the era of agentic AI and vibe coding, the built-in guardrails within the APIs are more important than ever. A series of bad requests can have far-reaching consequences and we should always protect the server against it.

This is even more critical for a platform like VMware Cloud Foundation, which is delivering mission-critical workloads in all the critical sectors.

Fortunately for VCF customers and partners, these necessary guardrails are built into the platform by design. All of our APIs undergo rigorous model testing to validate crucial aspects, including:

Strictly Typed Data Types / Enums: Helping ensure only predefined, valid inputs are accepted.
Null Pointer Validation: Preventing system crashes caused by missing data variables.
Consistent Pagination, Filtering, and Sorting Patterns: Standardizing data delivery across all endpoints.
Build-Time Linting Validations: Catching syntax and structural issues early in the pipeline.
Fault and Error Classification: Delivering predictable, actionable error responses.
Security Vulnerability Scans: Proactively identifying and mitigating edge-case vulnerabilities.

By embedding these design choices directly into the APIs, we deliver a fundamentally more predictable, secure, and seamless developer experience for our customers and partners.

What’s New with VCF 9.1?

We built on the momentum of VCF 9.0, which introduced OpenAPI specifications, a Unified VCF SDK for Python and Java, and enhancements to the VCF Terraform provider and PowerCLI SDK. VCF 9.1 further expands these capabilities by including new services and components in our Unified VCF SDK and OpenAPI Specification coverage. Along with that, we continue to evolve our automation toolings such as terraform and PowerCLI.

1. VCF APIs

There are a number of APIs which are newly introduced, updated, deprecated, or deleted. You can find all the details here in the API change log. Here in this blog post I am outlining a few API enhancements in detail.

Real-Time Metrics APIs

VCF 9.1 introduces real-time metrics APIs. These Prometheus-compatible Edge APIs allow users to query real-time, high-granularity (up to 2-second) metrics across the unified SDDC platform, including ESX, vCenter, vSAN, and NSX.

With native PromQL support, these APIs function as a direct data source for Grafana. Furthermore, configuration is simplified to a single API call utilizing built-in collection profiles (Essentials, Standard, and Verbose), replacing the complex legacy vStats API.

API: https://developer.broadcom.com/xapis/realtime-metrics-api/latest/

vCenter Utilization API

This new API monitors vCenter capacity and usage metrics in real time, tracking the number of active connections compared to maximum allowed limits, connection endpoints, and service request volumes. New UI alarms have been added to flag instances when active connections or request volumes surpass defined thresholds, which remain fully configurable via Advanced Settings.

API: https://developer.broadcom.com/xapis/vsphere-automation-api/9.1/api/vcenter/utilization/connections/get/

vCenter Group Federated API (VGFA)

VGFA introduces a single, unified API endpoint for managing all vCenter instances within a vCenter group. It allows automated clients to view and manage inventory across multiple vCenter instances as if they were a single entity, without changing existing API integrations. Enabled directly via the VCF Operations UI after SSO configuration, it delivers a consolidated management experience consistent with linked mode in the UI.

The vCenter Server Query API

Built as an extension of the existing Search Index API, the Query API provides a fast, flexible, and scalable way to retrieve vSphere inventory data (such as VMs and clusters). It features powerful server-side filtering, property selection/projections, and pagination, running lightweight, stateless queries that return entity counts and filtered results without retrieving full datasets.

This is a SOAP-based API and offers SQL-like semantics which makes it easier for developers to consume. Check out the sample code below.

//Query API Example

// List VM Moref, Name, PowerState, and Runtime Host details of all the VMs which has a PowerState as PoweredOff

print_query_result(QueryBuilder(si).Select(

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"@moRef", "name", "summary.runtime.powerState",
 &nbsp; &nbsp; &nbsp; "summary.runtime.host").From(ResourceType.VirtualMachine).Where(
 &nbsp; &nbsp; &nbsp; &nbsp; QueryPredicateBuilder("summary.runtime.host").Equal(
 &nbsp; &nbsp; &nbsp; vim.HostSystem(args.query_host_id))).Where(
 &nbsp; &nbsp; &nbsp; &nbsp; QueryPredicateBuilder("summary.runtime.powerState").Equal(
 &nbsp; &nbsp; &nbsp; &nbsp; "poweredOff")).Execute(), args.print_as_table)

//Query API Example

// List VM Moref, Name, PowerState, and Runtime Host details of all the VMs which has a PowerState as PoweredOff

print_query_result(QueryBuilder(si).Select(

      "@moRef", "name", "summary.runtime.powerState",

      "summary.runtime.host").From(ResourceType.VirtualMachine).Where(

        QueryPredicateBuilder("summary.runtime.host").Equal(

      vim.HostSystem(args.query_host_id))).Where(

        QueryPredicateBuilder("summary.runtime.powerState").Equal(

        "poweredOff")).Execute(), args.print_as_table)

2. Expanded Java and Python SDKs

Historically, VCF required developers to manage separate dependencies and client libraries for each VCF component. This created significant overhead and a fragmented developer experience. VCF 9.0 began the consolidation process by packaging vSphere, vSAN, VCF Installer, and SDDC manager API bindings into a single Unified SDK. With the release of VCF 9.1, we have achieved comprehensive SDK coverage for the VCF platform by expanding the SDK coverage to:

VMware NSX
VMware Cloud Foundation Operations
Log Management
VMware Cloud Foundation Operations for Network
Fleet Lifecycle and SDDC Lifecycle Management

3. VCF PowerCLI 9.1

VCF PowerCLI 9.1 brings plenty of enhancements and new cmdlets to our core infrastructure platform. The complete list of updates can be found at PowerCLI Change Log. Here is a summary of a few enhancements.

Core Infrastructure & vSAN Enhancements

CPU Topology Management: Added support for Assigned at PowerOn, providing exact control over virtual machine CPU layouts through the CoresPerNumaNode and CoresPerSocket parameters in the New-VM and Set-VM cmdlets.

NVMe over TCP: Added support for enabling NVMe over TCP for VMkernel adapters via New-VMHostNetworkAdapter and Set-VMHostNetworkAdapter.

vSAN Optimization: Introduces the Get-VsanEffectiveCapacity cmdlet for deep visibility into usable storage.

Introduced New cmdlets New-VsanRemoteDatastore and Remove-VsanRemoteDatastore allow for the seamless management of cross-vCenter remote datastores using both desired-state and incremental methods.

Advanced VPC Networking

The VMware.VimAutomation.Vpc module receives a massive expansion to orchestrate virtual private cloud (VPCs).

IP & Service Management: New cmdlets like New-VpcIpBlock allow teams to define the IP blocks that back subnets, edge services, or external IPs. The AssignExternalIp parameter has also been added to network adapters to expose VMs on private networks.

Transit Gateways & Spans: Engineers can now manage Transit Gateway lifecycles (New-VpcTransitGateway) and VPC spans (New-VpcSpan) to seamlessly bridge separate VPCs to each other and external data center connections.

Connectivity Policies: VCF 9.1 introduces the ability to organize VPCs into logical groups (New-VpcGroup) and assign strict communication policies (New-VpcConnectivityPolicy) bound to a Transit Gateway:

community: Enables standard inter-VPC communication within the group.
private: Completely isolates the VPC from other networks.
promiscuous: Allows wide communication across all VPCs on the gateway.

Secure Authentication & Compliance

Modernized SSO Authentication: The VMware.Vcf.Sso module introduces New-VcfOAuthSecurityContext. Users can now pass a VcfOAuthSecurityContext or a direct VcfApiToken parameter to server connection cmdlets (Connect-VIServer, Connect-NsxServer, Connect-VcfOpsServer). VCF PowerCLI automatically discovers the integrated VCF SSO instance, streamlining automated CI/CD pipeline authentication.

Proxy-Backed Active Directory Identity: Added a Proxy parameter to Set-VMHostAuthentication, allowing an ESXi host to join an Active Directory domain securely using its managing vCenter server as a proxy.

4. vSphere Terraform Provider Is Now Officially Supported

The vSphere Terraform Provider is now incorporated into the VMware Terraform registry. The project remains open source on GitHub and developers can continue to raise issues and enhancement requests there. Alternatively, our customers can raise a formal technical support request through Broadcom Global Support Services (GSS).

The new vSphere Terraform Provider v2.16.0 is released now. This release focuses on deeper networking integration, enhanced VM customization, and better cluster scalability. Here are the key highlights:

Networking & Architecture

Added support for project VPCs in the network data source and introduced support for vSphere Zones.

Enhanced Virtual Machine Controls

You can now manage video card settings, assign CPU Topology at power-on, and leverage the new external_id attribute in the VM’s network interface object.

Advanced Resource Management

Introducing support for Alarms, Cluster/VM Enhanced vMotion Compatibility (EVC), and a brand-new Supervisor resource (r/supervisor_v2) built on the latest vSphere APIs.

Scalability Enhancements

Increased the maximum number of ESXi hosts allowed per cluster, added ID-based lookups for tags/categories, and ensured the VM data source now returns tags and custom attributes.

For the complete list of changes and pull requests, check out the Official GitHub Release Notes.

Summary

The release of VMware Cloud Foundation (VCF) 9.1 delivers a unified, API-first private cloud platform designed to fulfill the promise of programmable infrastructure. By replacing a historically siloed platform with a consistent, OpenAPI-based consumption interface, VCF 9.1 ensures universal language parity and predictable developer experience across Python, Java, PowerCLI, and Terraform.

In the coming days and weeks, we will continue to publish feature-specific deep dives, technical guides, and live demos. Stay tuned for more updates!