Cloud, DevOps, infrastructure — field notes from 8+ years in the trenches.https://edouardtopin.comen-UShttps://edouardtopin.com/en/blog/finops-multicloud-vcf-cost-modelshttps://edouardtopin.com/en/blog/finops-multicloud-vcf-cost-modelsAn EKS cluster-hour, an AKS tier, a GKE Pod request and depreciated VCF hardware are not four values of one variable. What each platform bills, and what VCF calculates instead.Mon, 17 Aug 2026 00:00:00 GMTfinops-cloud-nativefinopskubernetesmulticloudvcfcost-modelcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/k8s-network-policies-ciliumhttps://edouardtopin.com/en/blog/k8s-network-policies-ciliumThe NetworkPolicy API ships with Kubernetes; enforcing it is the CNI's job. What Cilium adds, what stays standard, and how to reach default-deny by watching real flows before blocking any.Mon, 17 Aug 2026 00:00:00 GMTk8s-security-prodkubernetessecuritynetwork-policiesciliumcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/k8s-rbac-foundations-pitfallshttps://edouardtopin.com/en/blog/k8s-rbac-foundations-pitfallsEvery one of these pitfalls is published on kubernetes.io. What is missing is the ordering — and the path that leads from a vSphere Namespace straight to cluster-admin.Mon, 17 Aug 2026 00:00:00 GMTk8s-security-prodkubernetessecurityrbaccontact@edouardtopin.comhttps://edouardtopin.com/en/blog/k8s-runtime-falco-tetragonhttps://edouardtopin.com/en/blog/k8s-runtime-falco-tetragonFalco and Tetragon both collect through eBPF. What separates them lies elsewhere: event scope, rule model, and above all what each one can actually prevent.Mon, 17 Aug 2026 00:00:00 GMTk8s-security-prodkubernetessecurityruntimefalcotetragoncontact@edouardtopin.comhttps://edouardtopin.com/en/blog/k8s-supply-chain-sigstore-sbomhttps://edouardtopin.com/en/blog/k8s-supply-chain-sigstore-sbomKubernetes verifies no image signature on its own. Signing with Sigstore, inventorying with an SBOM, refusing at admission — and what each of those verbs actually covers.Mon, 17 Aug 2026 00:00:00 GMTk8s-security-prodkubernetessecuritysupply-chainsigstoresbomcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/nsx-fwaas-zero-trust-workloadhttps://edouardtopin.com/en/blog/nsx-fwaas-zero-trust-workloadLeast-privilege policy per vNIC, built on dynamic groups and tags rather than IP addresses — and the honest boundary where federated identity stops and the firewall starts.Mon, 17 Aug 2026 00:00:00 GMTvcf-identity-zero-trustvcf-9broadcomsecuritynsxfirewallzero-trustcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/opencost-see-before-acthttps://edouardtopin.com/en/blog/opencost-see-before-actOpenCost makes cluster spend readable per namespace. We look at its allocation model, what its default pricing really is, and where the open source ends.Mon, 17 Aug 2026 00:00:00 GMTfinops-cloud-nativefinopskubernetesopencostcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/rightsizing-k8s-vpa-krrhttps://edouardtopin.com/en/blog/rightsizing-k8s-vpa-krrVPA recommends and applies, KRR recommends and explains. VPA's six update modes, and what each one actually does to a Pod now that in-place resize is stable.Mon, 17 Aug 2026 00:00:00 GMTfinops-cloud-nativefinopskubernetesvpakrrrightsizingcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-identity-broker-ssohttps://edouardtopin.com/en/blog/vcf-identity-broker-ssoVCF Identity Broker federates login across the VCF consoles, but the documented perimeter is narrower than the pitch. We map what it covers, what stays local, and the break-glass path.Mon, 17 Aug 2026 00:00:00 GMTvcf-identity-zero-trustvcf-9broadcomsecurityssoidentitycontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-identity-federation-okta-entrahttps://edouardtopin.com/en/blog/vcf-identity-federation-okta-entraFour identity providers are documented by name, each with its own protocol path. Everything else goes through generic SAML 2.0 — a route that works without being a support statement.Mon, 17 Aug 2026 00:00:00 GMTvcf-identity-zero-trustvcf-9broadcomsecurityfederationoktaentracontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vsan-capacity-planning-esa-vs-osahttps://edouardtopin.com/en/blog/vsan-capacity-planning-esa-vs-osaSwitching from OSA to ESA changes how you size a vSAN cluster. We compare the two models side by side: usable capacity, headroom, and the new rules.Wed, 12 Aug 2026 00:00:00 GMTvsan-esa-memory-tieringvcf-9broadcomvsancapacity-planningosacontact@edouardtopin.comhttps://edouardtopin.com/en/blog/memory-tiering-nvme-densityhttps://edouardtopin.com/en/blog/memory-tiering-nvme-densityAt the recommended 1:1 ratio, Broadcom reports 2x VM density with a 5–10% HammerDB performance loss; this guide defines the eligibility conditions.Mon, 10 Aug 2026 00:00:00 GMTvsan-esa-memory-tieringvcf-9broadcommemory-tieringnvmedensitycontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-ad-abonnements-event-brokerhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-ad-abonnements-event-brokerDesign three idempotent Event Broker subscriptions to synchronize AD computer accounts and CMDB CIs without blocking VM provisioning.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1event-brokerorchestratoractive-directorycmdbcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-custom-resource-cmdbhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-custom-resource-cmdbModel a CMDB CI with Create, Read, Destroy, on-demand reconciliation, and a controlled cutover from the temporary Event Broker subscription.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1custom-resourcescmdborchestratorlifecyclecontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-day-2-gouvernancehttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-day-2-gouvernanceGovern Day-2 actions by role, avoid Blueprint drift, and add an Orchestrator action to resynchronize the CMDB.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1day-2governancepolicy-as-codeorchestratorcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-fondations-labhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-fondations-labPrepare the organization, project, namespace, VPC, classes, image, and storage required by your first All Apps IaaS Blueprint.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1all-appsplatform-engineeringnamespacevpccontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-premier-blueprint-iaashttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-premier-blueprint-iaasBuild a formatVersion 2 Blueprint that targets an existing namespace and deploys a Linux VM through VM Service in VCF Automation 9.1.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1blueprintsvm-serviceinfrastructure-as-codeiaascontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-recette-exploitationhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-recette-exploitationTurn WebShop into a repeatable acceptance test covering provisioning, networking, integrations, Day-2, failure, rollback, and cleanup.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1testingoperationsrunbookreliabilityiaascontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-reseau-ipam-cloud-inithttps://edouardtopin.com/en/blog/vcfa-9-1-all-apps-reseau-ipam-cloud-initAttach the WebShop VM to a governed subnet, prove IP allocation and release, then use cloud-init to expose an observable /healthz endpoint.Mon, 10 Aug 2026 00:00:00 GMTvcfa-all-apps-iaasvcf-automationvcf-9-1networkingipamcloud-initvm-serviceinfobloxcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-app-stack-formation-capture-namespacehttps://edouardtopin.com/en/blog/vcfa-9-1-app-stack-formation-capture-namespaceValidate the Namespace, VM Group, and Content Library before performing a controlled, traceable App Stack capture.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationapp-stack-formationnamespacecontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-app-stack-formation-cataloguehttps://edouardtopin.com/en/blog/vcfa-9-1-app-stack-formation-catalogueTest the clone, externalize identities and data, then promote a versioned App Stack into the catalog.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationapp-stack-formationservice-catalogcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-apres-upgrade-organisation-vm-appshttps://edouardtopin.com/en/blog/vcfa-9-1-apres-upgrade-organisation-vm-appsEstablish a post-upgrade baseline, validate identity, Orchestrator, and Day-2, then separate upgrade debt from migration debt.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationupgradessoorchestratorcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-inventaire-eligibilite-vm-apps-all-appshttps://edouardtopin.com/en/blog/vcfa-9-1-inventaire-eligibilite-vm-apps-all-appsMap services and dependencies, apply eligibility gates, and build verifiable migration waves.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationdiscoverymigration-wavescontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-migration-webshop-blue-green-vm-apps-all-appshttps://edouardtopin.com/en/blog/vcfa-9-1-migration-webshop-blue-green-vm-apps-all-appsPrepare parity, data, DNS/LB cutover, and the reverse path to migrate WebShop without an irreversible move.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationblue-greencutoverrollbackcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-migrer-cloud-templates-custom-forms-extensionshttps://edouardtopin.com/en/blog/vcfa-9-1-migrer-cloud-templates-custom-forms-extensionsRewrite the service contract and reconnect forms, workflows, events, policies, and custom resources.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationcloud-templatescustom-formscustom-resourcescontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-mixed-tenancy-vm-apps-all-appshttps://edouardtopin.com/en/blog/vcfa-9-1-mixed-tenancy-vm-apps-all-appsCompare shared-cluster, separate-cluster, and dedicated-infrastructure designs for controlled transitional coexistence.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationmixed-tenancynsxcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-sortie-vm-apps-exploitation-audithttps://edouardtopin.com/en/blog/vcfa-9-1-sortie-vm-apps-exploitation-auditMigrate identity and operations, drain the legacy estate, and prove that no unaccepted dependency remains before deletion.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationidentity-migrationdecommissioningauditcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcfa-9-1-vm-apps-all-apps-etude-migrationhttps://edouardtopin.com/en/blog/vcfa-9-1-vm-apps-all-apps-etude-migrationCompare topologies, application strategies, artifact portability, and rollback constraints before choosing a migration path.Mon, 10 Aug 2026 00:00:00 GMTvcfa-brownfield-migrationvcf-automationvcf-9-1vm-appsall-appsbrownfield-migrationarchitecturerollbackcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vsan-esa-raid5-6-performancehttps://edouardtopin.com/en/blog/vsan-esa-raid5-6-performanceESA replaces read-modify-write with a durable log and aligned full-stripe writes, while vSAN 9.1 still documents a possible RAID-1 advantage.Mon, 03 Aug 2026 00:00:00 GMTvsan-esa-memory-tieringvcf-9broadcomvsanraidperformancecontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-lcm-workflows-troubleshootinghttps://edouardtopin.com/en/blog/vcf-lcm-workflows-troubleshootingWhen a VCF 9.1 lifecycle batch fails, read real state before retrying. Map fleet, instance and domain recovery, prechecks and resource locks.Mon, 27 Jul 2026 00:00:00 GMTlive-patching-lcmvcf-9broadcomlcmoperationstroubleshootingcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vsan-upgrade-non-disruptivehttps://edouardtopin.com/en/blog/vsan-upgrade-non-disruptiveRoll ESX upgrades through vSAN ESA one host at a time: choose an evacuation mode, control resync, and stop safely when capacity or policy blocks progress.Mon, 20 Jul 2026 00:00:00 GMTlive-patching-lcmvcf-9broadcomvsanvsan-esaoperationscontact@edouardtopin.comhttps://edouardtopin.com/en/blog/live-patching-esxi-no-reboothttps://edouardtopin.com/en/blog/live-patching-esxi-no-rebootESXi live patching lets you ship CVE fixes without evacuating hosts. We dig into how it works, what it does NOT cover, and where it changes your patch SLA.Mon, 13 Jul 2026 00:00:00 GMTlive-patching-lcmvcf-9broadcomesxioperationscontact@edouardtopin.comhttps://edouardtopin.com/en/blog/private-ai-vcf-rag-prodhttps://edouardtopin.com/en/blog/private-ai-vcf-rag-prodMost RAG POCs die between demo and production. We walk through the gap — chunking, freshness, evals, observability — on VCF and VKS.Mon, 06 Jul 2026 00:00:00 GMTprivate-ai-vcfvcf-9broadcomprivate-cloudragvksaicontact@edouardtopin.comhttps://edouardtopin.com/en/blog/private-ai-vcf-vector-dbhttps://edouardtopin.com/en/blog/private-ai-vcf-vector-dbRAG needs a vector store. We compare pgvector, Milvus and Weaviate on VKS — index quality, ops surface, and which one actually fits your team.Mon, 29 Jun 2026 00:00:00 GMTprivate-ai-vcfvcf-9broadcomprivate-cloudvector-dbvksaicontact@edouardtopin.comhttps://edouardtopin.com/en/blog/private-ai-vcf-gpu-poolinghttps://edouardtopin.com/en/blog/private-ai-vcf-gpu-poolingSharing GPUs across tenants is the only way private AI math works. We walk through vGPU profiles, MIG slicing, and the pitfalls of mixed-workload scheduling.Mon, 22 Jun 2026 00:00:00 GMTprivate-ai-vcfvcf-9broadcomprivate-cloudgpunvidiaaicontact@edouardtopin.comhttps://edouardtopin.com/en/blog/private-ai-vcf-architecturehttps://edouardtopin.com/en/blog/private-ai-vcf-architectureVCF Private AI Foundation is the stack Broadcom proposes for hosting LLMs and inference in your own DC. We dissect it, layer by layer, seams visible.Mon, 15 Jun 2026 00:00:00 GMTprivate-ai-vcfvcf-9broadcomprivate-cloudaiarchitecturecontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-9-1-securite-resiliencehttps://edouardtopin.com/en/blog/vcf-9-1-securite-resilienceLive Patching for ESX with no maintenance window, continuous compliance, and on-prem anti-ransomware recovery. What changes for your recovery plan.Tue, 09 Jun 2026 00:00:00 GMTvcf-9-1securityransomwareresiliencebroadcomcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-9-1-kubernetes-self-servicehttps://edouardtopin.com/en/blog/vcf-9-1-kubernetes-self-serviceVKS linked clones, 500 clusters per Supervisor, simplified Container-as-a-Service and Tech Preview object storage: how VCF 9.1 closes the self-service gap.Tue, 02 Jun 2026 00:00:00 GMTvcf-9-1vkskubernetesplatform-engineeringbroadcomcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-9-1-networking-scalehttps://edouardtopin.com/en/blog/vcf-9-1-networking-scaleEVPN-VXLAN with the physical fabric, L4 Load Balancer and IPSec VPN on VPC, SDDC Manager sync, bare-metal edge import, multi-NIC VKS and network observability.Tue, 26 May 2026 00:00:00 GMTvcf-9-1nsxnetworkingvpcbroadcomcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/aria-operations-open-source-vcfhttps://edouardtopin.com/en/blog/aria-operations-open-source-vcfConnect VMware Aria Operations to Prometheus via remote_write, enrich Grafana with vSphere infrastructure metrics, and build unified dashboards that correlate VCF infra with Kubernetes workloads.Sun, 24 May 2026 00:00:00 GMTobservability-vcf-k8saria-operationsprometheusgrafanavcf-9vmwarecontact@edouardtopin.comhttps://edouardtopin.com/en/blog/logging-loki-fluentbit-vcfhttps://edouardtopin.com/en/blog/logging-loki-fluentbit-vcfBuild the PLG logging stack on VCF and VKS: deploy Fluent Bit as a DaemonSet, configure its pipeline stages, ship logs to Loki, and query them with LogQL.Sun, 24 May 2026 00:00:00 GMTobservability-vcf-k8slokifluent-bitloggingkubernetesvcf-9contact@edouardtopin.comhttps://edouardtopin.com/en/blog/observability-foundations-vcfhttps://edouardtopin.com/en/blog/observability-foundations-vcfThe three pillars of observability defined by the OpenTelemetry specification, why they matter for VCF and VKS, and how to choose the right tool for each.Sun, 24 May 2026 00:00:00 GMTobservability-vcf-k8sobservabilityopentelemetryvcf-9kubernetescontact@edouardtopin.comhttps://edouardtopin.com/en/blog/opentelemetry-kubernetes-tracinghttps://edouardtopin.com/en/blog/opentelemetry-kubernetes-tracingConfigure the OTel Collector pipeline on VKS, instrument applications with auto-instrumentation agents, export traces to Tempo or Jaeger, and correlate traces with Prometheus exemplars.Sun, 24 May 2026 00:00:00 GMTobservability-vcf-k8sopentelemetrytracingkubernetesvksjaegercontact@edouardtopin.comhttps://edouardtopin.com/en/blog/prometheus-grafana-vks-productionhttps://edouardtopin.com/en/blog/prometheus-grafana-vks-productionDeploy kube-prometheus-stack on VKS, configure ServiceMonitors and PodMonitors, set up alerting, and integrate with Grafana dashboards — an annotated production guide.Sun, 24 May 2026 00:00:00 GMTobservability-vcf-k8sprometheusgrafanakubernetesvksvcf-9contact@edouardtopin.comhttps://edouardtopin.com/en/blog/vcf-9-1-efficience-infra-tcohttps://edouardtopin.com/en/blog/vcf-9-1-efficience-infra-tcoNVMe memory tiering, global vSAN dedup, vSphere ZTP, 5000-host scale: what actually changes in VCF 9.1 on the infrastructure cost side, decoded for architects.Tue, 19 May 2026 00:00:00 GMTvcf-9-1vspherevsantcobroadcomcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/gitops-vks-argocd-bootstrap-multitenanthttps://edouardtopin.com/en/blog/gitops-vks-argocd-bootstrap-multitenantTurn a VKS cluster into a self-service platform. Argo CD bootstrap, multi-cluster ApplicationSets, external secrets, and multi-tenant patterns — the practical guide.Mon, 11 May 2026 00:00:00 GMTgitopsargocdvkskubernetesplatform-engineeringcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/day-2-ops-vks-lifecycle-upgradeshttps://edouardtopin.com/en/blog/day-2-ops-vks-lifecycle-upgradesFrom creation to upgrade through backup and observability — operating a VKS cluster on VCF 9 without surprises. CAPI, VKr, Prom/Graf/Loki, and VCF Operations.Mon, 04 May 2026 00:00:00 GMTvksvcf-9kubernetesday-2observabilityplatform-engineeringcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/reseau-nsx-vcf-9-du-vds-au-podhttps://edouardtopin.com/en/blog/reseau-nsx-vcf-9-du-vds-au-podHow a packet travels from the virtual switch to a VKS pod — vDS, NSX segments, T0/T1, NSX ALB and their trade-offs. The architect's networking guide.Mon, 27 Apr 2026 00:00:00 GMTvcf-9nsxkubernetesvksnetworkingcontact@edouardtopin.comhttps://edouardtopin.com/en/blog/architecture-vcf-9-expliquee-architecteshttps://edouardtopin.com/en/blog/architecture-vcf-9-expliquee-architectesVCF 9 is not a minor upgrade: it's a complete overhaul of the operational model. What a cloud architect must understand before any adoption project.Wed, 22 Apr 2026 00:00:00 GMTvcf-9architecturebroadcomprivate-cloudvmwarecontact@edouardtopin.comhttps://edouardtopin.com/en/blog/premier-cluster-vks-vcf-9https://edouardtopin.com/en/blog/premier-cluster-vks-vcf-9VKS is not TKG renamed. Architecture, consumption paths, annotated YAML, day-2 ops, and real limitations — the architect's guide to VCF 9.Wed, 22 Apr 2026 00:00:00 GMTvkskubernetesvcf-9platform-engineeringvmwarecontact@edouardtopin.com