Modernizing Infrastructure: VMware Cloud Foundation 5.2.x to 9.1 Upgrade Guide

With the recent launch of VMware Cloud Foundation (VCF) 9.1, we’ve reached a milestone in private cloud maturity. If you haven’t already, we highly recommend checking out our VCF 9.1 Announcement Blog for a deep dive into the new features and licensing model.

For those running VCF 5.2.x, the move to 9.1 is more than a version change; it’s a transition to a unified Management Services layer. This post focuses on the practical “how to,” anchored by our step-by-step upgrade demonstration.

Visualizing the 9.1 Upgrade

The most effective way to understand this transition is to see it in action. The video below covers the full 8-step orchestration, from the initial Aria-to-VCF Operations shift to the final data plane finalization.

Watch: 

• Upgrading VCF 5.2.x to 9.1 – Part 1 (Upgrade Aria OPS, SDDC, deploy VCF Management Services) – video link
• Upgrading VCF 5.2.x to 9.1 – Part 2 (NSX, vCenter Server, and ESXi) – video link

Scope of the Environment

This guide covers the orchestrated transition for:

• Aria Operations (transitioning to VCF Operations)
• SDDC Manager
• vRSLCM (Aria Suite lifecycle)
• NSX Manager and Edge Clusters
• vCenter Server
• ESXi Hosts

The table below details the Bill of Materials (BOM) for both the pre-upgrade state (VCF 5.2.x) and the post-upgrade state (VCF 9.1) from the demo.

Does your environment have a different BOM? Use the Upgrade Planner to generate a custom plan and ensure you validate your path against the Interoperability Matrix before proceeding.

Refer to the article Upgrade Sequence and Related Issues for VMware Cloud Foundation and vSphere Foundation 9.1.

The Evolution of the Management Domain

In previous versions, fleet management and lifecycle operations were distributed across various standalone appliances. VCF 9.1 centralizes these functions. The primary shift involves:

• Transitioning VMware Aria components into VCF Operations
• Introducing the VCF Management Services, which hosts critical services like the License Server, Software Depot, and Salt RaaS in a consolidated cluster

Architectural Guardrails: Planning for Success

VCF 9.1 introduces programmatic rigor that is less forgiving of environment “drift.” Before staging your payloads, verify these four critical criteria:

1. Security and Password Complexity

VCF 9.1 enforces a new standard for vCenter root passwords. They must now be between 15 and 20 characters. Shorter legacy passwords that were valid in 5.2.x will cause the VCF Installer validation to fail during the switchover phase.

2. DNS and Case Sensitivity

One of the most common hurdles in the field is DNS hygiene. VCF 9.1 requires strictly lower-case FQDNs. Discrepancies between DNS records and SDDC Manager inputs are the leading cause of certificate handshake failures during VMSP deployment.

3. Log Infrastructure (Port 1514)

Security hardening in 9.1 blocks unencrypted vCenter syslog traffic on Port 514. Administrators must transition to TLS-encrypted Port 1514 prior to the upgrade to ensure logging continuity.

4. vCLS Deactivation

VMware Cluster Services (vCLS) is now deactivated by default. The management of these services has moved from the UI to the backend, streamlining the look of your clusters while maintaining operational integrity.

For additional information, read Prerequisites for Upgrading the VCF Core Components.

Solving Field Realities: A Practitioner’s FAQ

Even with the best planning, technical nuances can arise. Here is what we are seeing in the field:

• The “50% vCenter hang”: During a Reduced Downtime Upgrade (RDU), the vCenter switchover may appear to pause at 50%. This is often a procedural wait for NSX manager conditions. Monitor the domainmanager.log for background task status.
• VCF Management Services reachability: If “VCF Management Services”deployment fails with a “Node Unreachable” error, revisit your DNS. Even a single upper-case letter in the VCF Operations record can break the integration.
• Licensing alarms: Post-upgrade, you may see a “License assignment failed” alarm. Due to the new 9.1 license format, this is often a UI false positive. If the host shows as licensed in the settings, simply acknowledge and clear the alarm.

Conclusion: Bringing it All Together

The move to VCF 9.1 is a strategic step toward a programmatic, scalable private cloud. By following the 8-step orchestrated sequence and accounting for the new architectural guardrails—like the VCF Management Services layer and refined password standards—customers can transition from 5.2.x with confidence.

Ready to start your transition? Consult the VCF 9.1 Release Notes and verify your hardware against the latest HCL to ensure a future-ready foundation.

Additional resources:

What’s New with vSphere in VMware Cloud Foundation 9.1?

VCF 9.1: The Secure, Cost-Effective Private Cloud Platform for Production AI 

How to license your environment 

Acknowledgements

Special thanks to Emad Younis, Product Management team.