vCF (VMware Cloud Foundation)

VMware Cloud Foundation guides for architecture, deployment, upgrades, operations, NSX, vSAN, automation, security, migration, and recovery.

Decision diagram illustrating Decision Path at a Glance for VCF Private AI Services Networking: VDS + Foundation Load Balancer vs VPC Networking.

VCF Private AI Services Networking: VDS + Foundation Load Balancer vs VPC Networking

Published by

VCF Private AI Services networking looks like an installer choice until you follow the consequences downstream. At first glance, the decision appears simple: deploy the vSphere Supervisor with traditional VDS networking and Foundation Load Balancer, or deploy it with VCF Networking using VPCs. Both can support Private AI Services. Both can get a Supervisor online. … Explore: VCF Private AI Services Networking: VDS + Foundation…

Conceptual diagram illustrating Agent Control-Plane Model at a Glance for AI Agents Are the New Control Plane.

AI Agents Are the New Control Plane: Governing Identity, Tool Access, and Observability Across Azure, AWS, Google Cloud, and VCF

Published by

Introduction The first article in this series focused on multicloud control-plane sprawl. Azure, AWS, Google Cloud, and VMware Cloud Foundation each bring their own identity model, policy engine, network architecture, observability stack, automation surface, and lifecycle model. That is already enough to create governance fragmentation. AI agents add another layer. An agent is not just … Explore: AI Agents Are the New Control Plane: Governing…

Conceptual diagram illustrating Placement Model at a Glance for Azure AI, Azure Local, and vCF Private AI: A Practical Placement Comparison.

Azure AI, Azure Local, and vCF Private AI: A Practical Placement Comparison

Published by

TL;DR Compare Azure AI, Azure Local, and VCF Private AI against the workload’s data boundaries, latency, connectivity, governance, and operating model. Use the criteria and comparison tables to choose placement for each workload. Get new guides by email · Related reading: Private AI Is Not Model Hosting: A Reference Architecture for Sovereignty, Identity, GPUs, and … Explore: Azure AI, Azure Local, and vCF Private AI:…

Diagram illustrating Control-Plane Sprawl at a Glance for Multi-Cloud Is Becoming Multi-Control-Plane.

Multi-Cloud Is Becoming Multi-Control-Plane: How to Avoid Governance Fragmentation Across Azure, AWS, Google Cloud, and VCF

Published by

TL;DR Multicloud is no longer just a workload placement problem. The harder problem is control-plane sprawl. Azure, AWS, Google Cloud, and VMware Cloud Foundation each bring their own identity model, policy engine, hierarchy, observability stack, network control plane, automation surface, and operational lifecycle. Those native control planes are useful. They become dangerous when each platform … Explore: Multi-Cloud Is Becoming Multi-Control-Plane: How to Avoid Governance…

Workflow diagram illustrating Runbook Workflow at a Glance for Finding VM File Locks on ESXi: A Production-Safe Runbook Before You Kill Processes.

VMware .lck Files and ESXi VM Locks: Find the Owner Safely

Published by

Quick answer: On ESXi, identify the locked file, datastore type and lock owner before changing a VMware .lck file or stopping a process. VMFS uses metadata locks rather than .lck files; NFS requires a different workflow. A lock can belong to a running VM or a backup proxy. Use the VMFS vmfsfilelockinfo workflow or the … Explore: VMware .lck Files and ESXi VM Locks: Find…

Workflow diagram illustrating The Workflow at a Glance for Command-Line ESXi Patching: A Controlled Workflow for Hosts Outside the Happy Path.

Command-Line ESXi Patching: A Controlled Workflow for Hosts Outside the Happy Path

Published by

There are times when the normal ESXi patching path is exactly what you should use: SDDC Manager, vSphere Lifecycle Manager, a tested cluster image, prechecks, staged remediation, and a maintenance workflow that keeps inventory and compliance aligned. Then there are the other days. A host might be standalone. A lab host might not be attached … Explore: Command-Line ESXi Patching: A Controlled Workflow for Hosts…

Workflow diagram illustrating PSOD Triage Workflow for ESXi PSOD Triage: Turning a Purple Screen into an Evidence-Driven Escalation.

ESXi PSOD Triage: Turning a Purple Screen into an Evidence-Driven Escalation

Published by

A purple screen on an ESXi host creates an immediate operational problem, but the bigger risk is what happens next. The first reaction is usually to get the host back online. That is understandable, especially when workloads are down, HA is recovering virtual machines, or a cluster is running hot after losing capacity. But if … Explore: ESXi PSOD Triage: Turning a Purple Screen into…

Workflow diagram illustrating The Runbook at a Glance for The vCenter Log Partition Runbook: Find Growth, Preserve Evidence, Restore Headroom.

The vCenter Log Partition Runbook: Find Growth, Preserve Evidence, Restore Headroom

Published by

A full /storage/log partition on a vCenter Server Appliance is not just a housekeeping problem. It is a management-plane risk. In a standalone vSphere environment, it can interrupt administration, log collection, patching, and service stability. In VMware Cloud Foundation, the blast radius is larger because vCenter is tied into SDDC Manager workflows, workload domain lifecycle … Explore: The vCenter Log Partition Runbook: Find Growth, Preserve…

Workflow diagram illustrating EAM Trust Flow at a Glance for EAM Certificate Trust Failures: Why vSphere Extensions Break After Certificate Changes.

EAM Certificate Trust Failures: Why vSphere Extensions Break After Certificate Changes

Published by

Certificate changes in vSphere environments rarely fail in only one place. The obvious place to look is the browser warning, the expired certificate alarm, or the service that recently had its Machine SSL certificate replaced. But in production VMware Cloud Foundation and vSphere environments, certificate changes can also break something less visible: the extension and … Explore: EAM Certificate Trust Failures: Why vSphere Extensions Break…

Diagram showing the dependency that matters during vVol migrations.

vVol Migration Failures and VASA Provider Pressure: How to Diagnose the Control Plane

Published by

vVol migrations are easy to misread. When a VM migration fails, the first instinct is usually to look at host load, vMotion networking, datastore latency, DRS behavior, or the backend array. Those checks still matter, but vVols introduce another dependency that can become the bottleneck before the data path is the real problem: the VASA … Explore: vVol Migration Failures and VASA Provider Pressure: How…

Workflow diagram illustrating Migration Flow at a Glance for Converting RDMs to VMDKs: A Practical Migration Pattern for Legacy Workloads.

Converting RDMs to VMDKs: A Practical Migration Pattern for Legacy Workloads

Published by

Raw Device Mappings tend to show up in the places where infrastructure history is still attached to the workload. A database server was moved from physical hardware years ago. A file server needed a very large LUN before VMDK limits improved. A clustered application depended on shared storage. A storage team wanted array-level tooling to … Explore: Converting RDMs to VMDKs: A Practical Migration Pattern…

Conceptual diagram illustrating The Mental Model: vCLS Is Cluster Plumbing, Not Workload for vCLS Retreat Mode: When to Use It, What It Breaks, and How to Exit Cleanly.

vCLS Retreat Mode: When to Use It, What It Breaks, and How to Exit Cleanly

Published by

Disable vCLS on a Cluster via Retreat Mode KB 316514 vSphere Cluster Services usually stay in the background until they get in the way of something operational. Most teams first notice vCLS when a cluster task is blocked, a warning appears after maintenance, or a handful of small system VMs show up and someone asks … Explore: vCLS Retreat Mode: When to Use It, What…

Decision diagram illustrating Decision Workflow: Do Not Start With the Reset for When Fibre Channel Paths Lie: A Safe Fabric Login Reset Runbook for ESXi.

When Fibre Channel Paths Lie: A Safe Fabric Login Reset Runbook for ESXi

Published by

There are storage incidents where the host looks half-recovered. The fabric switch is back online. The link light is good. The array port is healthy. Some paths may even show up again. But inside ESXi, the storage view still does not match reality. A datastore has fewer paths than expected. An RDM-backed workload is not … Explore: When Fibre Channel Paths Lie: A Safe Fabric…

Conceptual diagram illustrating The VLAN Tagging Model at a Glance for VLAN Design Translation for VMware: Physical Trunks, Port Groups, and Guest Tagging.

VLAN Design Translation for VMware: Physical Trunks, Port Groups, and Guest Tagging

Published by

VLAN issues in VMware environments are rarely caused by one mysterious setting. More often, they come from a translation problem. The network team thinks in terms of access ports, trunks, allowed VLAN lists, native VLANs, port channels, and upstream gateways. The virtualization team thinks in terms of vSwitches, distributed port groups, VMkernel adapters, VM network … Explore: VLAN Design Translation for VMware: Physical Trunks, Port…

Workflow diagram illustrating DVS Upgrade Flow at a Glance for DVS Upgrade Guardrails: What Can Break When Old Distributed Switches Move Forward.

DVS Upgrade Guardrails: What Can Break When Old Distributed Switches Move Forward

Published by

A vSphere Distributed Switch upgrade can look deceptively simple in the vCenter UI. Select the switch, choose the target version, confirm the warning, and move on. That is not how it should be treated in a brownfield environment. The risk is not that a DVS upgrade is always dangerous. The risk is that old distributed … Explore: DVS Upgrade Guardrails: What Can Break When Old…

Diagram illustrating Scenario for VM Network Troubleshooting from Guest OS to Uplink: A Layer by Layer VMware Runbook.

VM Network Troubleshooting from Guest OS to Uplink: A Layer by Layer VMware Runbook

Published by

Virtual machine network problems rarely arrive with a clean label. The ticket usually says something like “the VM is unreachable,” “the application cannot connect,” “ping fails,” “internet access is down,” or “VMs on different hosts cannot talk.” The underlying cause might be inside the guest OS, on the VM’s virtual NIC, in the port group, … Explore: VM Network Troubleshooting from Guest OS to Uplink:…

Diagram illustrating Objective for Patching vCenter Through VAMI Without Turning It Into a Recovery Event.

Patching vCenter Through VAMI Without Turning It Into a Recovery Event

Published by

Patching vCenter should not feel dramatic. The workflow in the Appliance Management Interface is straightforward: log in to VAMI, check for updates, stage, install, validate. Broadcom KB 316584 documents that basic path for vCenter Server 7.x and 8.x, including two patching options: using a URL-based repository or mounting a patch ISO as a local CD-ROM … Explore: Patching vCenter Through VAMI Without Turning It Into…

Workflow diagram illustrating Triage Flow at a Glance for “No Healthy Upstream” Is Often a Certificate Problem.

vCenter No Healthy Upstream: Troubleshooting and Recovery

Published by

Quick answer: vCenter No Healthy Upstream means the vSphere Client cannot reach a healthy backend service. It can follow a reboot, but the message alone does not identify the cause. Start with service status, free disk space, time and logs. Replace certificates only when those checks confirm a certificate or trust problem. Where to start: … Explore: vCenter No Healthy Upstream: Troubleshooting and Recovery

Diagram illustrating PDL and APD at a Glance for PDL vs APD: The Storage Failure Model Every vSphere Operator Needs.

PDL vs APD: The Storage Failure Model Every vSphere Operator Needs

Published by

Storage failures in vSphere are rarely just “storage is down.” That phrase may be accurate from the application owner’s point of view, but it is not precise enough for the operator who has to decide what happens next. A host that has lost all paths to a datastore behaves differently from a host that has … Explore: PDL vs APD: The Storage Failure Model Every…

Workflow diagram illustrating Workflow at a Glance for Why Large VM vMotion and Clone Tasks Fail.

Why Large VM vMotion and Clone Tasks Fail: Device Limits, Config Hygiene, and PowerCLI Prechecks

Published by

Large VM migrations usually fail at the worst possible time: late in the change window, after the task has already consumed hours of storage, network, and operator attention. When the error is something like “Invalid configuration for device ‘##’,” the first instinct is to look for a broken virtual NIC, a missing port group, an … Explore: Why Large VM vMotion and Clone Tasks Fail:…