Everything here was written from a nested VCF 9 lab while the work was being done: real commands, real output, the failure first and then the fix. Most posts belong to a series, but you rarely need a whole series to get going. Pick the path closest to what you are doing. Each one is in reading order, and new posts join their path on the day they are published.

New to VCF Automation All Apps

You run VCF 9 and want to know what the supervisor-native side of VCF Automation is, and how a catalog item is put together.

  1. VM Apps vs All Apps: a field comparison of VCF Automation's two provisioning modelsVCF Automation 9.1 has two provisioning models, as two kinds of organisation. I ran the same use cases through both, from Windows VMs to nested ESXi. …
  2. What's a VPC? Let Pac-Man explainPart 0 of the Pod Papers: an NSX VPC explained with a running game of Pac-Man. Private by default, one deliberate door out, and a self-inflicted …
  3. One VKS cluster, two ways: kubectl vs VCF Automation All AppsThe same VKS cluster built twice: once with kubectl, once as a VCF Automation request. The Cluster object is identical. Everything around it isn't, …
  4. Seven demo apps, one request: deploying a showcase stack via VCF AutomationSeven demo apps, Pac-Man and KubeDoom among them, on a VKS cluster that VCF Automation built in a tenant VPC, each with its own NSX virtual IP. The …
  5. Blueprinting the supervisor: seven CCI blueprint gotchasSeven ways the nested-ESXi pod blueprint failed validation before it worked, from ${input} inside flow mappings to an image-sync race. Short, …
  6. Every resource in the VCF Automation 9.1 blueprint designer: the complete guideA complete guide to the VCF Automation 9.1 blueprint designer: every palette item, the YAML behind it, every field the platform accepts, recipes and …

Nested VCF labs in NSX VPCs

You want isolated nested ESXi and VCF labs on a VCF platform, one per person or per class, and the networking that makes them work.

  1. Nested ESXi inside an NSX VPC: the trunk-subnet designPlain VPC subnets silently blackhole a nested ESXi host. Why, and the trunk subnet and binding map design that makes nested labs work as an ordinary …
  2. The load balancer that must exist before the namespaceAddresses pending for ever, a retryable error that never stops retrying, and an ordering rule the docs don't tell you: in a self-service NSX VPC, the …
  3. Three datacenters, one IP plan: identical isolated pods with NSX VPCsThree nested-ESXi pods with byte-identical addressing, down to the MACs, and no route between them. How overlapping VPC address ranges turn …
  4. Shared services for isolated tenants: PrivateTGW subnetsThree pods with identical addressing all need the same repo, WSUS and AD. One shared-services VPC serves them all through the transit gateway, and …
  5. A datacenter in a catalog tile: nested ESXi pods via VCF Automation All AppsThe whole isolated pod, nested ESXi hosts and all, as one VCF Automation blueprint in the catalog. How the blueprint is built, the order it enforces, …
  6. Dual-NIC nested hosts: what redundancy means when the fabric is virtualA second vNIC on a nested host adds no physical redundancy, so why add it? We expected bringup to want one, and pulling vmnic0 mid-SSH proved the …
  7. Our VPC subnets have no DHCP — and that's fineThe nested ESXi appliance sat at 'waiting for DHCP' for ever. VPC subnets don't hand out addresses: the VM Service does, through cloud-init, sysprep …

Catalog items and automation pipelines

You turn scripts and runbooks into catalog items, from a whole VCF instance to a Windows build, and want them to fail safely.

  1. One catalog item, one VCF instance: building a lab factoryHow an interactive PowerShell script grew into a catalog item that builds complete nested VCF 9.1 instances from one request form. The design rules …
  2. validateOnly everywhere: plan mode for infrastructureTerraform has plan. Kubernetes has --dry-run. Your vRO workflows have nothing, unless you give them a validateOnly input and pass it down. The most …
  3. Porting a PowerShell deploy script to a catalog item: the mapping table is the postA 400-line menu-driven PowerShell script became a cloud template, two vRO actions and two subscriptions. Where each behaviour belongs, four …
  4. Driving the VCF Installer API from vRO: generate, validate, start, walk awayStage 2 of the lab factory: a vRO workflow turns an environment number into a VCF 9.1 deployment spec, validates it and starts bringup, because the …
  5. Windows Server 2025 via Aria Automation, part 1: the pipelineOne catalog request, one fully built, domain-joined Windows Server 2025 with its agents, a validation report, and no trace of the tooling that built …
  6. Windows Server 2025 via Aria Automation, part 2: a state machine that survives four rebootsOne script runs at every startup until the build is done. Flag files make each step run once, a state file keeps true timings across reboots, and at …
  7. Windows Server 2025 via Aria Automation, part 3: validation as a product, and the details that hurtA self-contained HTML build report, down to a Gantt chart that spots the reboots. Plus the Session 0 traps, like mangled vmtoolsd arguments and …

Observability on VCF

You want logs and metrics from VKS clusters, Windows servers and things without an adapter in VCF Operations and Operations for Logs.

  1. fluent-bit two ways: VKS add-on and Windows agent, one log endpointOne log pipeline, two very different worlds: fluent-bit as a VKS package and as a Windows Server 2025 service, both shipping to the same VCF …
  2. Telegraf on Windows Server 2025: unsupported, works anywayThe VCF Operations agent matrix doesn't list Windows Server 2025. Add one missing Windows component, WMIC, and the normal install just works. What …
  3. Telegraf on VKS: the dependency that isn't in the READMEOn VCF 9.1, the supported route installs Telegraf in new VKS clusters for you. Underneath sits a dependency the README never mentions, two secrets …
  4. vLLM metrics into VCF Operations, part 1: don't ship the histogramvLLM exposes about 200 Prometheus series per model, and pushing them raw into VCF Operations is a cardinality bomb. A pipeline that computes the …

Other ways in

Browse by VCF product or by series, see every post by month in the archive, or search. Each product and series page has its own RSS feed, beside its title; this one carries every post.