In our recent webinar, Activating VKS Supervisor to Support Kubernetes, our primary goal was to demonstrate how VMware Cloud Foundation (VCF) 9.1 integrates a native Kubernetes control plane directly into vSphere. Between architectural overviews and live technical demonstrations, the session generated an engaging Q&A.
Attendees asked about everything from VMware NSX Virtual Private Cloud (VPC) network design and third-party load balancer integration to storage persistence and multi-tenant permission models. To help teams evaluating or deploying VCF 9.1, we have compiled the top 10 questions asked and answered during the live event.
1. Networking Evolution: Is VMware NSX VPC Mandatory in VCF 9.1?
Question: If we enable VMware vSphere Kubernetes Service (VKS) with VMware Avi Load Balancer and without NSX, can we have a VPC? Why didn’t the vSphere Supervisor creation UI show the option for classic NSX without VPC?
Answer: NSX VPCs are fully integrated into VCF 9.1 to simplify multi-tenant networking and eliminate IP exhaustion conflicts. You cannot run NSX VPCs without the NSX Manager. While VLAN-based VPCs exist without overlay networks, NSX Manager remains required. Furthermore, starting in VCF 9.1, deploying a VKS Supervisor with classic NSX Segment networking has been shifted to an API-only option; the vSphere Client UI defaults directly to the streamlined NSX VPC workflow.
2. Load Balancing Strategies: Avi Load Balancer, NSX, and Third-Party (Citrix/NetScaler)
Question: Can we use third-party load balancers like Citrix ADC/NetScaler for container workloads, or is Avi Load Balancer required for Layer 7?
Answer: Yes, third-party load balancers are supported. You can run third-party ingress controllers or load balancers (e.g., Citrix ADC) by deploying the vendor’s Kubernetes operator directly on the VKS workload cluster.
For native VCF networking, Avi Load Balancer provides complete L4 and L7 capabilities. Alternatively, you can leverage native NSX load balancing for L4 traffic combined with in-cluster ingress solutions like Contour or Istio for L7 routing. (Note: VKS is included with VCF, but Avi Load Balancer Enterprise requires separate licensing.)
3. What Happened to VMware Tanzu Mission Control?
Question: Is Tanzu Mission Control still available to manage VKS clusters, or have those capabilities moved elsewhere?
Answer: Key multi-cluster management and governance capabilities originally found in Tanzu Mission Control have been natively integrated directly into VMware Cloud Foundation Automation in VCF 9.1. Platform teams can now govern, provision, and maintain lifecycle management across multiple VKS clusters directly from the VCF Automation platform. If the goal is an out-of-the-box, enterprise GUI experience for policy and fleet management in VCF 9, VCF Automation is where that lives. But if you prefer declarative GitOps or pure CLI pipelines, the underlying vSphere Supervisor API allows you to provision and lifecycle-manage multiple clusters.
4. Storage Lifecycle: Storage vMotion for Persistent Volumes
Question: Can we perform Storage vMotion on persistent volumes if we need to migrate workloads across SAN datastores?
Answer: Storage vMotion is not supported for active VKS persistent volumes today. To migrate stateful volumes across storage backends, we recommend taking volume snapshots or performing a backup and restore operation using Velero. Native Cloud Native Storage (CNS) in vCenter automates First Class Disk (FCD) allocation based on assigned storage policies.
5. Custom OS Images vs. Helm Charts for Security Agents
Question: How can we build custom OS images if we need to bake in security scanning agents like Qualys or Wazuh?
Answer: You can build custom OS images using the Image Baker tool provided for vSphere Kubernetes Runtime (VKR) releases. However, our recommended architectural practice is to deploy security and monitoring agents via Helm charts or DaemonSets inside the cluster, noting that these pods are usually privileged and have all required permissions to scan the worker node. This avoids the operational overhead of rebuilding and re-validating custom OS images whenever a new VKR patch or version is released.
6. Managing Air-Gapped Environments and Harbor Registries
Question: In an air-gapped environment without internet access, how do we upgrade the Harbor Supervisor Service, and do we need to maintain multiple Harbor instances?
Answer: In air-gapped deployments, a bootstrap Bitnami Harbor OVA is initially used to seed the environment. To upgrade the Harbor Supervisor Service:
- Download the updated image package offline using imgpkg.
- Import the package into your bootstrap Harbor instance.
- Update the image paths in the Harbor deployment YAML and execute the standard upgrade workflow.
Note: The bootstrap Harbor OVA serves purely to seed the system, whereas the Supervisor Harbor operates as the primary enterprise registry consumed by application teams.
7. Ingress Routing: Supervisor Services vs. VKS Workload Clusters
Question: If Contour is deployed as a Supervisor Service, do VKS workload clusters automatically inherit it for application ingress?
Answer: The Contour Supervisor Service provides ingress capabilities specifically for vSphere Pods running at the VKS Supervisor level. VKS workload clusters do not inherit this instance. Each VKS cluster requires its own dedicated Contour instance, which can be deployed seamlessly as a standard package.
In this scenario, Kubernetes fleet manager (VMware Cloud Foundation Operations fleet management) is a must-have capability, as many organizations end up having dozens of clusters that need to be managed centrally.
8. Multi-Tenant Governance: RBAC and Authentication
Question: Do permissions support enterprise domain/LDAP users, and can RBAC policies inherit from parent VKS Supervisors down to namespaces?
Answer: Yes, permission structures fully integrate with LDAP and Active Directory domain accounts. Developers use kubectl vsphere login (or vcf login) with their corporate credentials to obtain access. Because a vSphere Namespace represents a strict multi-tenant boundary, permissions are explicitly assigned and managed per namespace rather than inherited globally from the parent VKS Supervisor.
9. Day-2 Observability: VCF Operations and Open Source Tooling
Question: What is the recommended approach for monitoring VKS Supervisor VMs and VKS clusters? Is VCF Operations sufficient or should we use Grafana/Prometheus?
Answer: Both are ideal. VCF Operations provides deep, native integration for monitoring VKS Supervisor VMs, control plane services, and cluster health for Infrastructure Admins. For many Developers and projects in the CNCF ecosystem, Prometheus is implicitly assumed therefore, it’s common to install the Prometheus package within VKS clusters.
10. Service Placement: VKS Supervisor Services vs. Cluster Packages
Question: Are components like Argo CD and Harbor enabled at the VKS Supervisor level or the workload cluster level?
Answer: Argo CD is enabled at the VKS Supervisor level as a managed Supervisor Service to drive GitOps delivery across the platform. Harbor, while available at the VKS Supervisor level for core image management, can also be deployed as an independent package directly inside individual VKS workload clusters to satisfy distinct multi-tenant requirements.
Key Takeaways and Next Steps
The vSphere Supervisor in VCF 9.1 eliminates operational friction by transforming vSphere into a native Kubernetes platform without complex management overlays. It delivers structured multi-tenant governance through a three-layer hierarchy: Governance, Resources, and Workloads, seamlessly integrated with NSX Enterprise VPCs for strict network isolation and zero IP conflicts. Stateful workloads are backed by flexible Zonal, Cross-Zone, and Multi-Zone storage topologies via automated CNS-CSI persistent volume provisioning, while Day-2 operations are streamlined through automated control-plane injection of Telegraf and Prometheus monitoring pods directly into guest cluster namespaces.
Watch the full webinar now.
Ready to Get Hands-On?
- Hands-on Labs: Try our Hands-on Lab with Kubernetes.
- Official Documentation: Check out these resources.
- Learning Courses: login to Learning@Broadcom via the Broadcom Support Portal, under the “Education Portal” to access the following VKS courses.
Get assistance with your VKS projects. Contact your Broadcom Account Manager to learn how VCF Professional Services and Partners like TeraSky can help advance your initiatives.
Discover more from VMware Cloud Foundation (VCF) Blog
Subscribe to get the latest posts sent to your email.
