The blueprint designer's palette, Supervisor Namespace, VPC and Workload groups, unfolding into five YAML types and the Kubernetes kinds behind each item

Every resource in the VCF Automation 9.1 blueprint designer: the complete guide

A complete guide to the VCF Automation 9.1 blueprint designer: every palette item, the YAML behind it, every field the platform accepts, recipes and traps. Every snippet validated, dry-run or deployed.

1 October 2026 · Adam Stretton
Pac-Man inside a VPC boundary; a LoadBalancer VIP is the one door out

What's a VPC? Let Pac-Man explain

Part 0 of the Pod Papers: an NSX VPC explained with a running game of Pac-Man. Private by default, one deliberate door out, and a self-inflicted outage where five green layers hid one wrong integer.

16 September 2026 · Updated 1 October 2026 · 6 min · Adam Stretton
The trunk-subnet design: one trunk vNIC, binding maps demux VLANs 1610/1611/1612 into VPC subnets

Nested ESXi inside an NSX VPC: the trunk-subnet design

Plain VPC subnets silently blackhole a nested ESXi host. Why, and the trunk subnet and binding map design that makes nested labs work as an ordinary NSX VPC tenant.

16 September 2026 · Updated 1 October 2026 · 7 min · Adam Stretton
The ordering rule: VPC, VPCAttachment, LoadBalancer, then the namespace - swap steps 3 and 4 and VIPs pend forever

The load balancer that must exist before the namespace

Addresses pending for ever, a retryable error that never stops retrying, and an ordering rule the docs don’t tell you: in a self-service NSX VPC, the load balancer must exist before the namespace that uses it.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton
Three VPC pods with byte-identical addressing and no route between them

Three datacenters, one IP plan: identical isolated pods with NSX VPCs

Three nested-ESXi pods with byte-identical addressing, down to the MACs, and no route between them. How overlapping VPC address ranges turn cookie-cutter environments into a feature.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton
Hub-and-spoke: three private pods reach one shared-services VPC over the transit gateway; the service cannot reach back

Shared services for isolated tenants: PrivateTGW subnets

Three pods with identical addressing all need the same repo, WSUS and AD. One shared-services VPC serves them all through the transit gateway, and can’t reach back into any of them.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton
One blueprint: namespace, trunk topology, two nested hosts, two VIPs — requested as a catalog item

A datacenter in a catalog tile: nested ESXi pods via VCF Automation All Apps

The whole isolated pod, nested ESXi hosts and all, as one VCF Automation blueprint in the catalog. How the blueprint is built, the order it enforces, and the three things it can’t express.

16 September 2026 · Updated 1 October 2026 · 7 min · Adam Stretton
Fail a NIC. Nothing blinks.

Dual-NIC nested hosts: what redundancy means when the fabric is virtual

A second vNIC on a nested host adds no physical redundancy, so why add it? We expected bringup to want one, and pulling vmnic0 mid-SSH proved the trunk copes: 0% loss, session intact.

16 September 2026 · Updated 1 October 2026 · 6 min · Adam Stretton
Three bootstrap paths into a VPC subnet: cloud-init, sysprep, vAppConfig

Our VPC subnets have no DHCP — and that's fine

The nested ESXi appliance sat at ‘waiting for DHCP’ for ever. VPC subnets don’t hand out addresses: the VM Service does, through cloud-init, sysprep or OVF guestinfo, depending on the guest.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton