Every article
The full back catalogue, newest first — including standalone pieces that belong to no series.
2026
FinOps cost models: what AWS, Azure and GCP bill — and what VCF calculates
An EKS cluster-hour, an AKS tier, a GKE Pod request and depreciated VCF hardware are not four values of one variable. What each platform bills, and what VCF calculates instead.
Network policies and Cilium: building a defensible default-deny
The NetworkPolicy API ships with Kubernetes; enforcing it is the CNI's job. What Cilium adds, what stays standard, and how to reach default-deny by watching real flows before blocking any.
Kubernetes RBAC: the foundations, and the pitfalls that survive an audit
Every one of these pitfalls is published on kubernetes.io. What is missing is the ordering — and the path that leads from a vSphere Namespace straight to cluster-admin.
Runtime security: Falco and Tetragon, and how to actually choose
Falco and Tetragon both collect through eBPF. What separates them lies elsewhere: event scope, rule model, and above all what each one can actually prevent.
Supply chain security: Sigstore, SBOM, admission control
Kubernetes verifies no image signature on its own. Signing with Sigstore, inventorying with an SBOM, refusing at admission — and what each of those verbs actually covers.
vDefend Distributed Firewall: zero trust at the workload level
Least-privilege policy per vNIC, built on dynamic groups and tags rather than IP addresses — and the honest boundary where federated identity stops and the firewall starts.
OpenCost: seeing before acting on Kubernetes spend
OpenCost makes cluster spend readable per namespace. We look at its allocation model, what its default pricing really is, and where the open source ends.
Rightsizing Kubernetes workloads with VPA and KRR
VPA recommends and applies, KRR recommends and explains. VPA's six update modes, and what each one actually does to a Pod now that in-place resize is stable.
VCF Identity Broker: where VCF 9.1 single sign-on actually stops
VCF Identity Broker federates login across the VCF consoles, but the documented perimeter is narrower than the pitch. We map what it covers, what stays local, and the break-glass path.
Federating VCF identity: Okta, Entra ID, and the generic path
Four identity providers are documented by name, each with its own protocol path. Everything else goes through generic SAML 2.0 — a route that works without being a support statement.
Capacity planning: ESA vs OSA, what really changes
Switching from OSA to ESA changes how you size a vSAN cluster. We compare the two models side by side: usable capacity, headroom, and the new rules.
NVMe memory tiering: 2x VM density, and what it costs
At the recommended 1:1 ratio, Broadcom reports 2x VM density with a 5–10% HammerDB performance loss; this guide defines the eligibility conditions.
VCF Automation 9.1 All Apps: Integrate Active Directory and a CMDB with Event Broker
Design three idempotent Event Broker subscriptions to synchronize AD computer accounts and CMDB CIs without blocking VM provisioning.
VCF Automation 9.1 All Apps: Manage a CMDB CI as a Custom Resource
Model a CMDB CI with Create, Read, Destroy, on-demand reconciliation, and a controlled cutover from the temporary Event Broker subscription.
VCF Automation 9.1 All Apps: Govern Day-2 Actions
Govern Day-2 actions by role, avoid Blueprint drift, and add an Orchestrator action to resynchronize the CMDB.
VCF Automation 9.1 All Apps: Prepare the WebShop Lab Foundation
Prepare the organization, project, namespace, VPC, classes, image, and storage required by your first All Apps IaaS Blueprint.
VCF Automation 9.1 All Apps: Deploy Your First VM with a Blueprint
Build a formatVersion 2 Blueprint that targets an existing namespace and deploys a Linux VM through VM Service in VCF Automation 9.1.
VCF Automation 9.1 All Apps: Test and Operate the IaaS Service
Turn WebShop into a repeatable acceptance test covering provisioning, networking, integrations, Day-2, failure, rollback, and cleanup.
VCF Automation 9.1 All Apps: End-to-End Networking, IPAM, and cloud-init
Attach the WebShop VM to a governed subnet, prove IP allocation and release, then use cloud-init to expose an observable /healthz endpoint.
App Stack Formation: Capture the WebShop Namespace Without Capturing Its Flaws
Validate the Namespace, VM Group, and Content Library before performing a controlled, traceable App Stack capture.
From Captured Namespace to Catalog Product: Customize and Version the App Stack
Test the clone, externalize identities and data, then promote a versioned App Stack into the catalog.
After the Upgrade: What the VM Apps Organization Really Preserves
Establish a post-upgrade baseline, validate identity, Orchestrator, and Day-2, then separate upgrade debt from migration debt.
Inventorying the Legacy Estate: Decide What to Migrate, Retain, or Retire
Map services and dependencies, apply eligibility gates, and build verifiable migration waves.
Migrating WebShop Without a Big Bang: Blue-Green Cutover, Data, and Rollback
Prepare parity, data, DNS/LB cutover, and the reverse path to migrate WebShop without an irreversible move.
Cloud Templates, Custom Forms, and Extensibility: Rebuilding the All Apps Service
Rewrite the service contract and reconnect forms, workflows, events, policies, and custom resources.
Mixed Tenancy 9.1: Designing the Bridge Between VM Apps and All Apps
Compare shared-cluster, separate-cluster, and dedicated-infrastructure designs for controlled transitional coexistence.
Finishing the Migration: Identity, Operations, Audit, and VM Apps Retirement
Migrate identity and operations, drain the legacy estate, and prove that no unaccepted dependency remains before deletion.
VM Apps to All Apps: The Decision Framework Before Migration
Compare topologies, application strategies, artifact portability, and rollback constraints before choosing a migration path.
RAID-5/6 on vSAN ESA: what replaces the write penalty
ESA replaces read-modify-write with a durable log and aligned full-stripe writes, while vSAN 9.1 still documents a possible RAID-1 advantage.
VCF LCM: end-to-end workflows and failure recovery
When a VCF 9.1 lifecycle batch fails, read real state before retrying. Map fleet, instance and domain recovery, prechecks and resource locks.
vSAN upgrades without downtime: ESA rolling patterns
Roll ESX upgrades through vSAN ESA one host at a time: choose an evacuation mode, control resync, and stop safely when capacity or policy blocks progress.
ESXi live patching: kernel updates without reboot
ESXi live patching lets you ship CVE fixes without evacuating hosts. We dig into how it works, what it does NOT cover, and where it changes your patch SLA.
RAG in production: from POC to scale on VCF
Most RAG POCs die between demo and production. We walk through the gap — chunking, freshness, evals, observability — on VCF and VKS.
Vector databases on VKS: pgvector, Milvus, Weaviate
RAG needs a vector store. We compare pgvector, Milvus and Weaviate on VKS — index quality, ops surface, and which one actually fits your team.
GPU pooling on VCF: NVIDIA vGPU + MIG in practice
Sharing GPUs across tenants is the only way private AI math works. We walk through vGPU profiles, MIG slicing, and the pitfalls of mixed-workload scheduling.
Private AI on VCF: the architecture that fits in your DC
VCF Private AI Foundation is the stack Broadcom proposes for hosting LLMs and inference in your own DC. We dissect it, layer by layer, seams visible.
VCF 9.1: security & resilience — live patching and anti-ransomware
Live Patching for ESX with no maintenance window, continuous compliance, and on-prem anti-ransomware recovery. What changes for your recovery plan.
VCF 9.1: Kubernetes & self-service, the platform takes over
VKS linked clones, 500 clusters per Supervisor, simplified Container-as-a-Service and Tech Preview object storage: how VCF 9.1 closes the self-service gap.
VCF 9.1 — Networking & scale: EVPN, VPC L4 and observability
EVPN-VXLAN with the physical fabric, L4 Load Balancer and IPSec VPN on VPC, SDDC Manager sync, bare-metal edge import, multi-NIC VKS and network observability.
Aria Operations meets open source: unified observability for VCF
Connect VMware Aria Operations to Prometheus via remote_write, enrich Grafana with vSphere infrastructure metrics, and build unified dashboards that correlate VCF infra with Kubernetes workloads.
Centralised logging with Loki and Fluent Bit on VCF
Build the PLG logging stack on VCF and VKS: deploy Fluent Bit as a DaemonSet, configure its pipeline stages, ship logs to Loki, and query them with LogQL.
Observability foundations for VCF: metrics, logs and traces
The three pillars of observability defined by the OpenTelemetry specification, why they matter for VCF and VKS, and how to choose the right tool for each.
OpenTelemetry on Kubernetes: distributed tracing for cloud-native apps
Configure the OTel Collector pipeline on VKS, instrument applications with auto-instrumentation agents, export traces to Tempo or Jaeger, and correlate traces with Prometheus exemplars.
Prometheus & Grafana on VKS: the production monitoring stack
Deploy kube-prometheus-stack on VKS, configure ServiceMonitors and PodMonitors, set up alerting, and integrate with Grafana dashboards — an annotated production guide.
VCF 9.1: the infrastructure efficiency that justifies -40% TCO
NVMe memory tiering, global vSAN dedup, vSphere ZTP, 5000-host scale: what actually changes in VCF 9.1 on the infrastructure cost side, decoded for architects.
GitOps on VKS with Argo CD: from bootstrap to multi-tenant
Turn a VKS cluster into a self-service platform. Argo CD bootstrap, multi-cluster ApplicationSets, external secrets, and multi-tenant patterns — the practical guide.
Day-2 ops on VKS: lifecycle, upgrades, observability
From creation to upgrade through backup and observability — operating a VKS cluster on VCF 9 without surprises. CAPI, VKr, Prom/Graf/Loki, and VCF Operations.
Networking in VCF 9: from vDS to pod, the packet path explained
How a packet travels from the virtual switch to a VKS pod — vDS, NSX segments, T0/T1, NSX ALB and their trade-offs. The architect's networking guide.
The new VCF 9 architecture explained to architects
VCF 9 is not a minor upgrade: it's a complete overhaul of the operational model. What a cloud architect must understand before any adoption project.
Deploying your first VKS cluster on VCF 9: An architect's guide
VKS is not TKG renamed. Architecture, consumption paths, annotated YAML, day-2 ops, and real limitations — the architect's guide to VCF 9.
