VMware vSphere Kubernetes Service (VKS) 3.8 cuts operational overhead, hardens the security baseline, and accelerates AI and modern application adoption for platform teams running Kubernetes on private cloud. Automated multi-version upgrades, granular workload placement, enterprise secrets integration, and Kubernetes-native CI/CD tooling give platform engineers the controls they need, while giving CIOs and CTOs the cost predictability and governance their organizations demand.
Enterprise IT leaders must balance three competing priorities: keeping operational overhead in check, maintaining a hardened security posture, and accelerate developer velocity and AI adoption. These three priorities are not isolated goals. They are interdependent pillars of a successful cloud-native strategy. Fast application delivery without embedded security creates enterprise risk, while heavy manual operations stall business innovation and increase the hidden cost in the total cost of ownership.
VMware vSphere Kubernetes Service, a CNCF-certified Kubernetes runtime natively built in VMware Cloud Foundation, addresses these three imperatives in VKS 3.8. The release aligns rapid application delivery directly with automated security governance and zero-friction operations.
Reducing Operational Burden
In VKS 3.8, organizations can reduce operational overhead and reduce the risk of failure with automated chained upgrades. Granular resource management maximizes return on investment by preventing system workloads, such as the control plane workloads, from consuming high-cost, specialized hardware like the GPU resources. Flexibility in placement policies help optimize utilization of high-cost hardware assets and ensure business continuity for mission-critical applications. Together, these operational advances deliver a predictable, cost-effective infrastructure foundation that scales effortlessly alongside growing business demands.
Automated Chained Upgrades
VKS 3.8 orchestrates multi-version vSphere Kubernetes release upgrades automatically with built-in dependency checks and flag deprecation issues. This helps reduce the time spent in Day 2 operations and minimizes business disruption by reducing the maintenance window.
Platform teams no longer face complex multi-hop upgrade scripting and manual dependency checks across incremental versions. Automated upgrades cordon and drain pods from worker nodes just once during the entire process rather than at each intermediate step, significantly accelerating execution and minimizing scheduling risks.
Granular Workload Placement Control
VMware Cloud Foundation (VCF) 9.1 users can now leverage the new node placement enhancements in VKS 3.8 for granular infrastructure controls to address cost, capacity constraints, sovereignty, performance, and resiliency requirements. VKS now enables platform teams to programmatically pin a workload to a resource based on infrastructure policy.
For example, an enterprise with an active-active stretched cluster can now explicitly assign distinct VKS node pools to a specific site. In the figure below, node pools within the cluster are pinned to specific sites for resiliency across control plane and worker nodes to manage stateful applications.
New control plane placement filtering allows platform teams to specify infrastructure policies to exclude high-cost compute clusters (such as dedicated GPU hardware) from control plane node scheduling. This approach prevents non-GPU control workloads from landing on expensive hosts while maintaining automated spreading across the remaining clusters.
Embedding Security and Compliance into Delivery Pipelines
By embedding automated security and governance directly into the platform lifecycle, VKS 3.8 helps organizations elevate their infrastructure security, protect intellectual property, and safeguard customer trust without sacrificing application velocity. Business leaders gain easier, faster audit readiness for stringent regulatory frameworks. Simultaneously, the enterprise significantly reduces its cyber risk surface — shielding critical infrastructure against unauthorized access, lateral threat movement, and credential leaks — helping ensure that rapid application delivery remains fully aligned with rigorous corporate governance.
Automated Admission Guardrails
VKS 3.8 builds on pre-configured policy sets to validate workloads at deployment using two add-ons delivered in prior releases: the VKS Policy Bundle add-on and the declarative Policy-as-Code using Open Policy Agent (OPA) Gatekeeper add-on. These policy sets align with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) Kubernetes hardening guidance, and the Center for Internet Security (CIS) benchmark.
VKS 3.8 safeguards enterprise reputation and maintains audit readiness without slowing down application releases. Platform teams can automatically block non-compliant container configurations before they reach production.
Platform Hardening
VKS 3.8 programmatically disables SSH access across all Kubernetes control plane and worker nodes. This elevates the security baseline and eliminates ad-hoc operating system (OS)-level changes. The result is a hardened platform that reduces exposure to brute-force attacks and prevents lateral attacker movement across cluster infrastructure.
Advanced Intrusion Detection Environment
Using Advanced Intrusion Detection Environment (AIDE), VKS 3.8 performs periodic integrity checks across critical system directories to detect unauthorized file changes. This gives infrastructure admins an automated mechanism to catch tampering without manual monitoring.
Centralized Credential Governance
VKS 3.8 synchronizes credentials dynamically from enterprise vaults including HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Cloud Platform (GCP) Secret Manager using the External Secrets Operator (ESO) add-on. This eliminates static credentials stored in code repositories and simplifies compliance audits for SOC2, PCI DSS, and HIPAA requirements.
Platform teams can reduce exposure to data-at-rest vulnerabilities by removing plain-text secrets from Git repositories and YAML manifests while automating multi-cloud secret rotation.
Accelerating Developer Velocity and AI Adoption
VKS 3.8 brings fine-grained resource management to high-cost GPU hardware assets, enabling organizations to significantly boost infrastructure ROI while eliminating expensive idle capacity. Accelerated development workflows dramatically shorten product release cycles, allowing businesses to launch new capabilities faster while safeguarding the infrastructure through automated release integrity.
Full-stack operational visibility protects ongoing revenue and the developer experience by enabling teams to resolve service disruptions rapidly. Together, these outcomes empower enterprises to achieve faster overall time-to-value for modern application initiatives and AI investments.
Native CI/CD Pipelines with Tekton
VKS 3.8 introduces Tekton for in-cluster continuous integration (CI) pipelines that automate code builds and testing. The pipelines sync natively with ArgoCD for continuous global fleet delivery, and they run inside the cluster using standard Kubernetes Custom Resource Definitions (CRDs).
Platform teams get a resource-efficient build environment without exposing clusters to external networks. The business impact shows up in shorter product release cycles and protect brand integrity through automated image signing and provenance.
Dynamic NVIDIA GPU Allocation1
Dynamic Resource Allocation (DRA) for NVIDIA GPUs will use the native Kubernetes DRA framework to dynamically assign and hot-attach physical or fractional GPUs on demand. Dynamic allocation will let teams share expensive GPU hardware across projects instead of leaving it idle.
The business case is straightforward: maximize return on investment (ROI) on costly AI infrastructure by eliminating idle hardware and sharing GPUs across teams. For platform teams, it removes manual GPU provisioning friction while maintaining secure tenant isolation on shared GPU cards.
Full-Stack Observability with OpenTelemetry1
Open Telemetry (OTel) unifies traces, metrics, and logs across widely used applications like Java, Python, .NET, and Go into a single streaming framework. With consolidated visibility, OTel will help developers and platform teams reduce Mean Time to Resolution (MTTR) and protect revenue and customer experience when issues arise.
Instead of toggling between disparate monitoring tools, teams will get a unified view of application health across the full stack using observability tools like VCF Operations, Datadog, Splunk, or New Relic, among others.
VKS Quick Start1
VKS Quick Start accelerates time to value by deploying production-ready VKS Cluster, so developers can start building on Day 1. Platform teams can quickly enable the vSphere Supervisor with guided workflow and start running Kubernetes workloads. Teams can easily deploy essential add-ons and use the intuitive GUI to visualize clusters and resources for rapid workload testing.
Release Cadence and Support
By decoupling its release cadence from core platform upgrades, VKS 3.8 delivers Kubernetes 1.37 support within 60 days of CNCF upstream releases, backed by Broadcom’s 24-month extended support policy. When it is time for an upgrade the newly introduced automated chained upgrade helps enterprises capture the latest innovation in open source without skipping a beat.
This predictability establishes a cohesive operational continuum for both business leaders and platform teams. Streamlined operations free platform teams from routine maintenance, allowing them to focus on onboarding new AI capabilities and accelerating business outcomes.
Plan for Success with VKS 3.8
By significantly reducing the day-2 operational burden, accelerating time-to-value, and elevating the security baseline, VKS 3.8 helps enterprise organizations scale their private cloud infrastructure with confidence. This release continues to strengthen VMware vSphere Kubernetes Service as the proven enterprise Kubernetes platform for AI and modern workloads in private cloud environments.
Resources
VKS 3.8 Release Notes: Tech Docs
Blog: Elevating Enterprise Kubernetes with Automated Security, Scale, and Seamless Add-ons with VKS 3.7
Blog: Deploy Modern Apps Faster, Scale Smarter, and Lower TCO with VKS in VCF 9.1
1 Will be delivered in a future release.
Discover more from VMware Cloud Foundation (VCF) Blog
Subscribe to get the latest posts sent to your email.
