Developer Ready Infrastructure for VMware Cloud Foundation

VCF 5.2architectvcdxautomationPages 139-169

Design, implementation, and operational guidance for a VI workload domain that runs vSphere with Tanzu workloads. Activates a Supervisor on the shared edge and workload vSphere cluster, uses the Tanzu Kubernetes Grid Service to deploy Tanzu Kubernetes clusters, and provides guidance for capacity, scalability, backup, and disaster recovery support. Enables Kubernetes natively on vSphere.

Key Components: NSX, SDDC Manager, vCenter, ESXi, Tanzu

External dependencies: None (vSphere with Tanzu and Tanzu Kubernetes Grid Service are part of VCF)

Design Decisions

Implementation

Operations

VCDX Defense

Quiz (15)

Flashcards (15)

8 design decisions

DD-ID	Decision	Quality
DRI-TZU-NET-001	Add a /24 overlay-backed NSX segment for Supervisor control plane nodes.	Manageability
Decision: Add a /24 overlay-backed NSX segment for Supervisor control plane nodes. Rationale: Supports Supervisor control plane nodes. Implication: Must create overlay-backed NSX segment. Component: TZU
DRI-TZU-NET-002	Use a dedicated /20 subnet for pod networking.	Recoverability
Decision: Use a dedicated /20 subnet for pod networking. Rationale: A /20 supports design requirement of 2000 pods. Implication: Private IP space behind NAT; can be reused in multiple Supervisors. Component: TZU
DRI-TZU-NET-003	Use a dedicated /22 subnet for services.	Recoverability
Decision: Use a dedicated /22 subnet for services. Rationale: A /22 supports design requirement of 2000 pods. Implication: Private IP space behind NAT; can be reused. Component: TZU
DRI-TZU-NET-004	Use a dedicated /24 or larger subnet on corporate network for ingress endpoints.Sufficient for 2000	RecoverabilitySecurity
Decision: Use a dedicated /24 or larger subnet on corporate network for ingress endpoints.Sufficient for 2000 pods in most cases.Must be routable to corporate network; evaluate your ingress needs. Rationale: DRI-TZU-NET-005Use a dedicated /24 or larger subnet on corporate network for egress endpoints.Sufficient for 2000 pods in most cases.Must be routable; evaluate egress needs. Implication: Information Security Component: TZU
DRI-TZU-SEC-001	Create an AD security group for DevOps administrators; add users needing edit permissions within a n	ManageabilitySecurity
Decision: Create an AD security group for DevOps administrators; add users needing edit permissions within a namespace; grant Can Edit permissions to the namespace for that group. Create additional groups for d. Rationale: Mapping namespace edit permissions to an AD security group centralizes access control and gives per-user auditability instead of shared or local accounts. Implication: The AD group must be created and its membership maintained outside the SDDC stack, and namespace permissions re-validated as DevOps staff join or leave. Component: TZU
DRI-TZU-SEC-002	JustificationImplication	ManageabilitySecurity
Decision: JustificationImplication Rationale: See source document for rationale Implication: DRI-TZU-SEC-003Replace default self-signed cert for Supervisor mgmt interface with PEM-encoded CA-signed cert.Encrypted trusted communication.Operational overhead (not automated by SDDC Manager). Component: TZU
DRI-TZU-LCM-001	Lifecycle management of Supervisor performed using vSphere Client native workflows.	ManageabilityPerformance
Decision: Lifecycle management of Supervisor performed using vSphere Client native workflows. Rationale: Not integrated into SDDC Manager. Implication: Deployment, patching, updates, upgrades performed without SDDC Manager automation. Component: TZU
DRI-TZU-LCM-002	Lifecycle management of Tanzu Kubernetes cluster using kubectl.	ManageabilityPerformance
Decision: Lifecycle management of Tanzu Kubernetes cluster using kubectl. Rationale: Not integrated into SDDC Manager. Implication: Performed without SDDC Manager automation. Component: TZU

Prerequisites

VCF version listed in Support Matrix (5.1.0-5.2.1)
Environment configured per Before You Apply This Guidance
Developer Ready Infrastructure tab completed in VCF Planning and Preparation Workbook
VCF instance healthy and fully operational
If using stretched vSAN: all vSAN datastores healthy including witness hosts
DNS forward/reverse records
AD DCs available; service accounts and security groups created
Microsoft CA available with PowerShell Module installed
OpenSSL 3.0+ on PowerShell host
PowerShell 7.2+ installed
NSX Edge cluster deployed with LARGE-sized nodes (required for Supervisor)
Workload domain NSX preparation complete
PowerShell Automation
Workflow

Implementation Procedure

Implementation

Install modules (VMware.PowerCLI 13.2.1+, vSphere.SsoAdmin 1.3.9+, ImportExcel 7.8.5+, PowerVCF 2.4.0+, PowerValidatedSolutions 2.11.0+)
Create folder structure and place completed P&P Workbook

Start-ValidatedSolutionMenu

Main menu 05. (DRI) Developer Ready Infrastructure

Generate JSON Specification File
Verify Prerequisites
End-to-End Deployment

UI Implementation Steps

Add K8s-specific content library to management domain vCenter (subscribed to Tanzu content source)
Configure Storage Policies (vSphere Storage Policy for Tanzu) — vSAN or tagged

Deploy large-sized NSX Edge cluster via SDDC Manager

Activate Supervisor on shared edge/workload cluster using vSphere Client (Menu > Workload Management > Add Cluster)

Configure Supervisor control plane size (Tiny/Small/Medium/Large per desired pod scale)

Configure Supervisor networking: mgmt network, pod/service/ingress/egress CIDRs

Create vSphere namespaces; assign storage policies, CPU/memory limits, permissions to AD groups

Install Supervisor Services: Harbor (Registry), Contour (Ingress)

Replace Supervisor Kubernetes API endpoint certificate with CA-signed cert
Deploy Tanzu Kubernetes Clusters via kubectl + TKC YAML manifests (using TanzuKubernetesCluster CRD or ClusterClass)

License Supervisor (Tanzu Supervisor license)

Add additional VM Classes for TKC (e.g., GPU-enabled classes)
External Services / Integration Points
Active Directory (LDAP)
DNS
NTP
Certificate Authority
Implementation Options
MethodDesc
PowerShell automationPowerValidatedSolutions menu 05. (DRI) Developer Ready Infrastructure
UI / component interfacesvSphere Client Supervisor deployment workflow + kubectl for TKC

Day-2 Operations Tasks

Operations

As needed

Personas

As needed

Persona: vSphere Administrator

As needed

PersonavSphere Administrator

As needed

ResponsibilityFull admin access — configure and activate Supervisors and vSphere namespaces

As needed

Mapping

As needed

vCenterAdministrator

As needed

Persona: DevOps Engineer

As needed

PersonaDevOps Engineer

As needed

ResponsibilityDeploy vSphere Pods, VMs, TKCs on existing namespaces within a Supervisor

As needed

Monitoring Points

After replacement, kubectl vsphere login works without --insecure-skip-tls-verify on TCP/443 and TCP/6443
MonitoringVCF Operations 8.16.1+ native integration monitors Supervisor and TKCs

Likely Panelist Questions

Q: Why did you choose this architecture?

See design decisions for rationale

Failure Scenarios

Deploying NSX Edge cluster with small/medium nodes — Supervisor enablement fails

Impact:

Mitigation:

Ignoring SHA-1 deprecation — cert replacement fails with SHA-1 CAs (DRI-TZU-SEC-004)

Impact:

Mitigation:

Manual TKC deployment without storage class — PVCs fail

Impact:

Mitigation:

Skipping Velero install — no K8s-level backup when disaster strikes (only VM-level via vSphere)

Impact:

Mitigation:

NSX Edge cluster sized too small — Supervisor enablement fails

Impact:

Mitigation:

Trade-off Analysis

Trade-Offs Analysis

Chosen:

Justification:

Quiz — Developer Ready Infrastructure

0/15

What NSX Edge node size is required for Supervisor deployment?

Small
Medium
Large
Extra Large

NSX Edge cluster MUST use large-sized Edge nodes — smaller nodes are incompatible with Supervisor deployment.

What is the required network scope for the Supervisor control plane network in this design?

/28 overlay-backed NSX segment
/24 overlay-backed NSX segment, routable
/20 NAT subnet
/16 VLAN-backed

DRI-TZU-NET-001: /24 overlay-backed NSX segment for Supervisor control plane nodes.

How many pods can a Small Supervisor control plane support?

1000
2000
4000
8000

Small (4 vCPU, 16 GB per node) = 2000 pods. Tiny=1000, Medium=4000, Large=8000.

Which service is deployed as a Supervisor Service in this solution?

Jenkins
Harbor (image registry)
Prometheus
Grafana

Harbor registry is deployed as a Supervisor Service (Registry Service). Contour is also available as a Supervisor Service for Ingress.

Which tool does the design use for K8s-native backup?

vSphere Data Protection
Velero + Velero plug-in for vSphere + Velero Data Manager
Veeam
Commvault

Velero provides K8s object backup/restore; plug-in integrates with vSphere; Data Manager handles data movement.

Which component handles Supervisor lifecycle management in this solution?

SDDC Manager
vCenter Server (vSphere Client native workflows)
VCF Operations
Tanzu Mission Control

DRI-TZU-LCM-001: Supervisor LCM via vSphere Client native workflows; NOT integrated with SDDC Manager.

Which NSX construct is instantiated when a Tanzu Kubernetes Cluster is created?

Tier-0 Gateway
Tier-1 Gateway with /28 overlay segment and IP pool
New VLAN
Additional NSX Edge node

Each TKC creates a Tier-1 Gateway with /28 overlay-backed NSX segment and IP pool.

What is the default design subnet size for pod networking?

DRI-TZU-NET-002: dedicated /20 for pod networking; sufficient for 2000 pods.

Which persona uses Can Edit permissions on a vSphere namespace?

vSphere Administrator
DevOps Engineer
Auditor
Cloud Admin

DevOps Engineer deploys vSphere Pods, VMs, TKCs using Can Edit on namespaces. Auditor uses Can View.

Q10

What is a valid use case for a Namespace /28 overlay segment in the design?

Manage ESXi hosts
Service incoming pod traffic; instantiate additional /28 if IP space exhausts
Connect to external corporate DNS
Host NSX Manager

Each namespace gets a /28 NSX segment + IP pool for pods; additional /28 added when exhausted.

Q11

Which certificate algorithm is mandated for Supervisor certificate signing?

SHA-1
SHA-2 or higher
MD5
RIPEMD-160

DRI-TZU-SEC-004: SHA-2 or higher (SHA-1 is deprecated).

Q12

What makes kubectl vsphere login succeed without --insecure-skip-tls-verify?

Adjusting Supervisor size
Replacing default self-signed cert with CA-signed cert on Supervisor K8s API endpoint
Setting VM Class to large
Installing Contour

After certificate replacement (DRI-TZU-SEC-003), kubectl honors trust chain; no --insecure-skip-tls-verify needed on TCP/443 and TCP/6443.

Q13

What is the PowerValidatedSolutions menu number for DRI?

Main menu 05. (DRI) Developer Ready Infrastructure.

Q14

Which sample application blueprint uses raw YAML (no Helm)?

Bitnami Kubeapps
Wordpress on TKC
PHP Guestbook with MongoDB
Grafana

Blueprint 3 (PHP Guestbook + MongoDB) uses raw YAML for Deployment/Service; targets experienced DevOps.

Q15

When must you add an additional NSX Edge cluster during scale-out?

Never
When adding an additional vSphere cluster as a new Supervisor
Only in stretched deployments
When upgrading ESXi

Each additional Supervisor requires its own SDN components — new NSX Edge cluster (with Tier-0 or attached Tier-1 to existing Tier-0).

Flashcards — Developer Ready Infrastructure

Card 1 of 15

Supervisor

Specialized K8s cluster using ESXi hosts as worker nodes via Spherelet. 3 control plane VMs sized Tiny/Small/Medium/Large.

Labs

Lab 1: Enable a Supervisor on a VI Workload Domain

Configure prerequisites and activate a Small Supervisor (2000 pods) on the shared edge/workload cluster of a VI workload domain.

Starting State: VCF 5.2 with a VI workload domain; large-sized NSX Edge cluster deployed; AD over LDAP configured in vCenter; Microsoft CA available; DNS/NTP configured; subnets allocated (/24 mgmt, /20 pods, /22 services, /24 ingress, /24 egress).

Lab 2: Deploy a Tanzu Kubernetes Cluster and Deploy Sample Application

Deploy a TKC in a vSphere namespace using the TKG Service and deploy the Wordpress blueprint via Helm.

Starting State: Supervisor from Lab 1 is Ready; AD security group gg-devops-engineers created and granted Can Edit on the namespace; kubectl context set to Supervisor.

Lab 3: Configure Velero Backup and Restore for a TKC

Install Velero in a TKC, schedule daily backup to an S3-compatible object store, restore after simulated failure.

Starting State: TKC from Lab 2 deployed; MinIO or similar S3-compatible bucket available; Velero CLI on admin workstation.

Mark complete