vcfa-all-apps-iaas
Build a Governed IaaS Service with VCF Automation 9.1 All Apps
A practical journey for building, integrating, governing, and testing a VM service with Blueprints, VM Service, Event Broker, and Orchestrator.
Open seriesField notes by series
Cloud, DevOps and infrastructure topics organized as guided article paths.
All series
Each series groups related articles into a reading path.
vcfa-brownfield-migration
From Legacy VM Apps to All Apps with VCF Automation 9.1
A nine-part brownfield series covering post-upgrade stabilization, All Apps construction, wave-based migration, App Stack Formation, and legacy retirement.
Open series
finops-cloud-native
Cloud native FinOps
Cost visibility, rightsizing and multi-cloud cost models for Kubernetes and VCF platforms.
Open series
k8s-security-prod
Kubernetes security in production
The production security baseline for Kubernetes: RBAC, network policies, supply chain controls and runtime detection.
Open series
vcf-identity-zero-trust
VCF identity and zero trust
Identity federation, SSO and workload firewalling patterns for a zero-trust VCF platform.
Open series
vsan-esa-memory-tiering
vSAN ESA and memory tiering
What ESA changes for performance, density and capacity planning in modern VCF environments.
Open series
live-patching-lcm
Live patching and VCF lifecycle
Operational patterns for ESXi live patching, non-disruptive vSAN upgrades and VCF lifecycle workflows.
Open series
private-ai-vcf
Private AI on VCF
A practical path for running private AI on VCF, from architecture to GPU pooling, vector databases and production RAG.
Open series
vcf-9-1
What's new in VCF 9.1
A four-part series decoding VMware Cloud Foundation 9.1: infrastructure efficiency, networking, Kubernetes self-service, security and resilience.
Open series
observability-vcf-k8s
Observability as Code on VCF & Kubernetes
Metrics, logs and traces for VCF and VKS: Prometheus, Grafana, Loki, OpenTelemetry and Aria Operations to instrument your platform end-to-end.
Open series
vks
VKS on VCF 9
Architecture, networking, first cluster, day-2 operations and GitOps for VMware Kubernetes Service on VCF 9.
Open seriesEvery article
The full back catalogue, newest first — including standalone pieces that belong to no series.
2026
FinOps cost models: what AWS, Azure and GCP bill — and what VCF calculates
An EKS cluster-hour, an AKS tier, a GKE Pod request and depreciated VCF hardware are not four values of one variable. What each platform bills, and what VCF calculates instead.
Network policies and Cilium: building a defensible default-deny
The NetworkPolicy API ships with Kubernetes; enforcing it is the CNI's job. What Cilium adds, what stays standard, and how to reach default-deny by watching real flows before blocking any.
Kubernetes RBAC: the foundations, and the pitfalls that survive an audit
Every one of these pitfalls is published on kubernetes.io. What is missing is the ordering — and the path that leads from a vSphere Namespace straight to cluster-admin.
Runtime security: Falco and Tetragon, and how to actually choose
Falco and Tetragon both collect through eBPF. What separates them lies elsewhere: event scope, rule model, and above all what each one can actually prevent.
Supply chain security: Sigstore, SBOM, admission control
Kubernetes verifies no image signature on its own. Signing with Sigstore, inventorying with an SBOM, refusing at admission — and what each of those verbs actually covers.
vDefend Distributed Firewall: zero trust at the workload level
Least-privilege policy per vNIC, built on dynamic groups and tags rather than IP addresses — and the honest boundary where federated identity stops and the firewall starts.
