site-f06.yaml feeds gen_lab_blueprint.py, which writes eight blueprints and two property groups; each request builds a lab in its own VPC with a jump host, dc01, four nested hosts, vCenter, VCF Operations and AD, routed by the VPC gateway with no router VM

Nested labs in VCF Automation 9.1, built from code instead of captured

A VCF Automation 9.1 catalog that builds a complete nested VCF lab per request, each in its own VPC. How it differs from capturing a hand-built lab, and what building from code buys you.

28 October 2026 · 10 min · Adam Stretton
The blueprint designer's palette, Supervisor Namespace, VPC and Workload groups, unfolding into five YAML types and the Kubernetes kinds behind each item

Every resource in the VCF Automation 9.1 blueprint designer: the complete guide

A complete guide to the VCF Automation 9.1 blueprint designer: every palette item, the YAML behind it, every field the platform accepts, recipes and traps. Every snippet validated, dry-run or deployed.

1 October 2026 · Adam Stretton
Pac-Man inside a VPC boundary; a LoadBalancer VIP is the one door out

What's a VPC? Let Pac-Man explain

Part 0 of the Pod Papers: an NSX VPC explained with a running game of Pac-Man. Private by default, one deliberate door out, and a self-inflicted outage where five green layers hid one wrong integer.

16 September 2026 · Updated 1 October 2026 · 6 min · Adam Stretton
The trunk-subnet design: one trunk vNIC, binding maps demux VLANs 1610/1611/1612 into VPC subnets

Nested ESXi inside an NSX VPC: the trunk-subnet design

Plain VPC subnets silently blackhole a nested ESXi host. Why, and the trunk subnet and binding map design that makes nested labs work as an ordinary NSX VPC tenant.

16 September 2026 · Updated 1 October 2026 · 7 min · Adam Stretton
The ordering rule: VPC, VPCAttachment, LoadBalancer, then the namespace - swap steps 3 and 4 and VIPs pend forever

The load balancer that must exist before the namespace

Addresses pending for ever, a retryable error that never stops retrying, and an ordering rule the docs don’t tell you: in a self-service NSX VPC, the load balancer must exist before the namespace that uses it.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton
Three VPC pods with byte-identical addressing and no route between them

Three datacenters, one IP plan: identical isolated pods with NSX VPCs

Three nested-ESXi pods with byte-identical addressing, down to the MACs, and no route between them. How overlapping VPC address ranges turn cookie-cutter environments into a feature.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton
Hub-and-spoke: three private pods reach one shared-services VPC over the transit gateway; the service cannot reach back

Shared services for isolated tenants: PrivateTGW subnets

Three pods with identical addressing all need the same repo, WSUS and AD. One shared-services VPC serves them all through the transit gateway, and can’t reach back into any of them.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton
Fail a NIC. Nothing blinks.

Dual-NIC nested hosts: what redundancy means when the fabric is virtual

A second vNIC on a nested host adds no physical redundancy, so why add it? We expected bringup to want one, and pulling vmnic0 mid-SSH proved the trunk copes: 0% loss, session intact.

16 September 2026 · Updated 1 October 2026 · 6 min · Adam Stretton
Three bootstrap paths into a VPC subnet: cloud-init, sysprep, vAppConfig

Our VPC subnets have no DHCP — and that's fine

The nested ESXi appliance sat at ‘waiting for DHCP’ for ever. VPC subnets don’t hand out addresses: the VM Service does, through cloud-init, sysprep or OVF guestinfo, depending on the guest.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton