Managing modern applications at scale requires a delicate balancing act. To deploy these workloads successfully, platform teams must constantly juggle competing priorities: accelerating developer velocity, hardening security, and adopting leading edge ecosystem tools—all while operating within strict compliance guardrails. The release of VMware vSphere Kubernetes Service (VKS) 3.7 will directly address these priorities.

VKS is the CNCF certified Kubernetes runtime built into VMware Cloud Foundation (VCF), the unified private cloud platform that enables enterprises to run modern applications alongside traditional workloads. VKS enables platform teams to deploy, manage, and scale Kubernetes clusters while leveraging a comprehensive set of cloud services included in VCF, as well as all conformant third-party services.

By focusing heavily on automated compliance, critical-sector scale, operational efficiency, and an entirely reimagined Add-on framework, this release of VKS drives definitive business advantages while vastly simplifying daily life for the Platform Engineering team. VKS 3.7 will add support for Kubernetes version 1.36, continuing Broadcom’s commitment to delivering CNCF-certified Kubernetes that is designed for modern enterprise use. 

VKS 3.7 delivers value across four key pillars.

1. Hardening platform security and compliance

For organizations operating under regulatory frameworks, security posture is only as strong as its consistency. Compliance configurations that hold at cluster creation but drift over time create audit exposure and remediation cycles that consume platform team capacity. VKS 3.7 will close this gap with automation that enforces security controls from initial setup through every subsequent lifecycle operation.

• Targeted filesystem lock-down: Tightens security by blocking unauthorized access to targeted OS directories (/usr). This new capability introduces an extra layer of protection building upon the OS-layer security hardening verified by Secure Boot. This prevents workloads and unauthorized processes from modifying critical operating system directories, reducing the risk of node compromise and helping customers maintain a consistent security posture across their Kubernetes fleet.
• Customizable TLS profile: Enforce minimum TLS version and select custom ciphers to meet common compliance standards across VKS cluster components. The platform automatically maintains these configurations across cluster lifecycle operations including scaling, eliminating manual drift and ongoing remediation.
• Rapid CVE mitigation: Traditionally, OS security patches have been tied to Kubernetes patch versions, requiring extensive planning and disruptive maintenance windows. VKS 3.7 will decouple these cadences. Using the integrated Image Baker tool, organizations can now bring their own OS images, apply critical security patches, and roll them out across all clusters seamlessly – without impacting running workloads.

The result is a security posture that accelerates audit readiness and reduces operational pressure. Compliance and business leaders gain automated consistency across common compliance standards while closing the window between vulnerability detection and remediation. Platform teams gain the controls and flexibility to manage patching on their own schedule, with every configuration enforced by the platform rather than depend on manual verification.

Securing the infrastructure is the necessary foundation. But for organizations in critical sectors like telecommunications, government, healthcare, and energy, security alone is not sufficient. These industries require infrastructure that can absorb the scale and network demands of their most critical workloads. VKS 3.7 will help address these requirements.

2. Accelerating workload deployments in critical sectors 

Mission-critical applications leave no room for infrastructure that cannot match their availability and performance requirements. Telco 5G core deployments, large-scale data processing pipelines, and government workloads each place distinct demands on Kubernetes infrastructure: high node counts, fault tolerance against localized failures, and the ability to route high-bandwidth traffic over isolated, high-performance network interfaces. To help address these challenges VKS 3.7 will deliver the following three key capabilities:

• Enhanced Fault Tolerance for VKS control plane: Control plane expansion to 5 nodes ensures VKS API servers remain highly available and resilient.
• Scale increase for Telco and Mission-Critical Applications: Substantial increase in the number of nodes per cluster accommodates the rigorous requirements of Telco 5G core applications.
• High Performance Networking Enablement: VKS 3.7 will enable latency-sensitive and high-bandwidth workloads to utilize dedicated secondary networks and high-performance network interfaces. Support for Multus CNI and Whereabouts allows organizations to build advanced networking architectures that can leverage technologies such as SR-IOV and DPDK-accelerated NIC virtual functions for mission-critical applications.

These capabilities translate directly to production-readiness for industries where downtime or degraded performance carries real consequences. Business stakeholders gain infrastructure capable of running 5G core, government, healthcare, and energy workloads with superior quality of experience and lower latency those applications demand. 

Platform teams gain API server resiliency and high performance networking capabilities, with Multus and Whereabouts integration removing the manual complexity of configuring secondary networks from scratch. 

Reaching the scale these sectors require solves one dimension of the problem. The other is reducing the operational burden of keeping infrastructure at that scale healthy over time. That is the focus of the next area of investment – operational efficiency.

3. Increasing operational efficiency

Day-2 operations are where the hidden costs of Kubernetes lie. VKS 3.7 will focus on reducing the manual toil and anxiety around cluster deployments and upgrades.

• Advanced Helm Package Management: Building on the Helm Controller introduced in VKS 3.6.2, VKS 3.7 will combine declarative, industry-standard application lifecycles with a new Add-on framework (Add-on API) to simplify the management of service installs across the fleet of VKS clusters.

For business stakeholders, the payoff is measurable: faster time-to-value with accelerated application delivery through templatized configurations and smoother deployments leveraging the latest open-source innovations. For platform teams, it means automated rollback on detected failures, simplified desired-state management across the fleet, and the freedom to focus on deployment rather than manual remediation. 

These gains build on two commitments that remain core to the VKS operating model: VKS upgrades stay decoupled from the control plane, so the Supervisor can continue running on an older version without blocking team progress, and Broadcom’s 24-month extended support per Kubernetes version at no additional cost and with overlapping version coverage gives large organizations the room to move forward on their own timelines without forcing fleet-wide upgrades or compressed maintenance windows.

Operational efficiency gains compound when platform teams also have the right ecosystem tooling to work with. That is why the fourth area of investment in VKS 3.7 is a complete rethinking of how Add-ons are delivered, supported, and expanded.

4. Simplifying adoption of third-party services

The breadth of tools a platform team needs changes constantly as applications evolve and new open-source capabilities emerge. A rigid packaging model limits how quickly teams can adopt those tools and creates ambiguity about what level of support applies to each. 

VKS 3.7 will replace the previous core and standard package structure with a four-tier Add-on Management Framework that accelerates ecosystem expansion and provides clarity on Broadcom’s support commitment to customers. 

• Product Add-ons: Broadcom-curated Add-ons that are deeply integrated in VKS and the underlying infrastructure. This tier replaces previous VKS “core” packages, maintaining the same level of Broadcom lifecycle and runtime support.

• Partner Add-ons: Add-ons validated by the ISV partner and Broadcom through the Broadcom Technology Alliance Program (TAP). Partner-tier Add-ons are jointly supported by Broadcom (lifecycle) and the ISV partner (runtime). 
• Ecosystem Add-ons: Open-Source Software (OSS) Add-ons curated by Broadcom for VKS. This tier replaces “Standard” packages maintaining the same level of lifecycle support from Broadcom while enabling customers to leverage the expert-led power of the global community for runtime support.
• Community Add-ons: Customers get the flexibility to build or bring their own application packages. Lifecycle and runtime support are customer-led or backed by a global network of experts in the community.

Product, Partner, and Ecosystem Add-ons include orchestrated lifecycle with automated install, upgrade, and VKr alignment. With Community Add-ons, customers gain the flexibility to manage installs and upgrades, or orchestrate the entire lifecycle using the Add-on Manager.

For business stakeholders, the four-tier framework future-proofs investments by accelerating ecosystem expansion and improving deployment readiness across a broader range of integration tools. For platform teams, transparent support tiers mean faster issue resolution and a predictable operational experience as the fleet grows.

New Add-ons being introduced in VKS 3.7

• Headlamp (Ecosystem tier): Community standard UI with application centric view for visualizing cluster resources and application health using integrated logs and metrics, and leveraging a powerful plugin architecture. Empowers App and Platform Teams to manage cluster resources and accelerate troubleshooting without the deep Kubernetes expertise

• NFS-Client (Product tier): Enables dynamic provisioning of persistent storage using existing NFS servers, allowing multiple containers to read and write to the same volume simultaneously. Simplifies provisioning for Platform Teams with automatic storage creation and increases workload portability, de-coupling container state from local node storage

• Multus and Whereabouts (Product tier): Multus CNI enables multi-homed pods in Telco deployments by acting as a meta-plugin that calls multiple underlying CNI plugins like Calico to attach secondary network interfaces. Whereabouts is a cluster-wide IP Address Management (IPAM) plugin that dynamically assigns IPv4/IPv6 addresses. It pairs with Multus to assign and track IP addresses across secondary interfaces without conflicts.

Platform teams in highly regulated sectors like Telco and 5G can easily isolate control plane traffic from heavy data plane workloads with Multus. This architecture leverages VMXNET3 or SR-IOV to satisfy ultra-low latency requirements, while utilizing Whereabouts to eliminate the complexity of advanced networking with critical cluster-wide IP Address Management (IPAM).

New Add-ons introduced in VKS 3.6.x

• OPA Gatekeeper (Product tier): A specialized Kubernetes admission controller that enforces custom, declarative policies to ensure workloads comply with security and governance standards. Enables Platform Teams to define policy-as-code with real-time enforcement, preventing non-compliant resources from being deployed.
• Helm Controller (Product tier): Declaratively manages Helm chart releases using standard cluster manifests. Significantly reduces manual toil for Platform Teams managing multi-cluster workload deployments through automated lifecycle management, rollbacks, drift detection, and reconciliation.

Conclusion: The VKS 3.7 Advantage

VKS 3.7 will bridge the gap between maximum operational control and rapid developer execution. Decoupled zero-impact OS patching removes the forced trade-off between security velocity and workload stability. Telco-grade scalability accelerates critical-sector workload deployments eliminating the need for purpose-built infrastructure. Declarative lifecycle management through the Helm Controller and Add-on API eliminates the manual toil that slows platform teams down. And the four-tier Add-on Management Framework gives platform teams a predictable, extensible toolkit to manage their fleets with confidence as requirements evolve.

By addressing automated compliance, critical-sector scale, operational efficiency, and ecosystem integration together, this release ensures that as infrastructure grows, operational overhead does not grow with it.

Resources: 

• VKS web page: Learn more about VKS
• Blog: Deploy Modern Apps Faster, Scale Smarter, and Lower TCO with VKS in VCF 9.1
• Blog: VCF 9.1 brings Multi-Network Supports to VKS