The VPC Pod Papers

For anyone who has opened an NSX VPC and wondered where all the switches went. This series goes from what is a VPC? (explained with Pac-Man, sorry) to a whole nested ESXi pod you request from a catalog tile, with every trap we fell into on the way. Read it in order: each post leans on the one before. Start with What’s a VPC? Let Pac-Man explain.

Pac-Man inside a VPC boundary; a LoadBalancer VIP is the one door out

What's a VPC? Let Pac-Man explain

Part 0 of the Pod Papers: an NSX VPC explained with a running game of Pac-Man. Private by default, one deliberate door out, and a self-inflicted outage where five green layers hid one wrong integer.

The trunk-subnet design: one trunk vNIC, binding maps demux VLANs 1610/1611/1612 into VPC subnets

Nested ESXi inside an NSX VPC: the trunk-subnet design

Plain VPC subnets silently blackhole a nested ESXi host. Why, and the trunk subnet and binding map design that makes nested labs work as an ordinary NSX VPC tenant.

The ordering rule: VPC, VPCAttachment, LoadBalancer, then the namespace - swap steps 3 and 4 and VIPs pend forever

The load balancer that must exist before the namespace

Addresses pending for ever, a retryable error that never stops retrying, and an ordering rule the docs don’t tell you: in a self-service NSX VPC, the load balancer must exist before the namespace that uses it.

Three VPC pods with byte-identical addressing and no route between them

Three datacenters, one IP plan: identical isolated pods with NSX VPCs

Three nested-ESXi pods with byte-identical addressing, down to the MACs, and no route between them. How overlapping VPC address ranges turn cookie-cutter environments into a feature.

Hub-and-spoke: three private pods reach one shared-services VPC over the transit gateway; the service cannot reach back

Shared services for isolated tenants: PrivateTGW subnets

Three pods with identical addressing all need the same repo, WSUS and AD. One shared-services VPC serves them all through the transit gateway, and can’t reach back into any of them.

One blueprint: namespace, trunk topology, two nested hosts, two VIPs — requested as a catalog item

A datacenter in a catalog tile: nested ESXi pods via VCF Automation All Apps

The whole isolated pod, nested ESXi hosts and all, as one VCF Automation blueprint in the catalog. How the blueprint is built, the order it enforces, and the three things it can’t express.

Dual-NIC nested hosts: what redundancy means when the fabric is virtual

A second vNIC on a nested host adds no physical redundancy, so why add it? We expected bringup to want one, and pulling vmnic0 mid-SSH proved the trunk copes: 0% loss, session intact.

Three bootstrap paths into a VPC subnet: cloud-init, sysprep, vAppConfig

Our VPC subnets have no DHCP — and that's fine

The nested ESXi appliance sat at ‘waiting for DHCP’ for ever. VPC subnets don’t hand out addresses: the VM Service does, through cloud-init, sysprep or OVF guestinfo, depending on the guest.

ContentValid: False — and the seven reasons why

Blueprinting the supervisor: seven CCI blueprint gotchas

Seven ways the nested-ESXi pod blueprint failed validation before it worked, from ${input} inside flow mappings to an image-sync race. Short, specific, and each one cost me a cycle.