VMware 3V0-21.25 - Advanced VMware Cloud Foundation 9.0 Automation

To create a new VM Apps organization with minimal operational overhead in a VCF fleet that already hosts an All Apps organization, select the following three actions:

Answers List

Enable the Classic Tenant Creation feature flag.

Deploy a new VCF Instance.

Create a new VCF workload domain (non-shared NSX).

In VMware Cloud Foundation (VCF) 9.0, the platform defaults to the modern AllApps (AIIApps) architectural model, which centers on Virtual Private Clouds (VPCs) and Supervisor-integrated networking. To introduce a VMApps Organization—the "classic" tenant model for traditional virtual machines—into this environment while maintaining minimal overhead, the administrator must first Enable the Classic Tenant Creation feature flag. This toggle exposes the legacy workflows necessary to provision organizations that do not rely on the VPC framework.

Furthermore, VMApps organizations typically require their own isolated networking and compute boundaries to avoid conflict with the modern VPC Transit Gateway architecture. Consequently, the administrator should Create a new VCF workload domain (non-shared NSX). Using a non-shared NSX manager ensures that the traditional segments and load-balancing services used by VM-centric workloads are logically and technically segregated from the container-optimized fabric of the AllApps organization. Finally, for a "fleet" approach, Deploying a new VCF Instance (or management block) provides the clean, dedicated infrastructure needed to host these legacy-style organizations with the highest degree of administrative isolation, ensuring that new VM-centric tenants do not consume resources or cause configuration drift within the existing AllApps environment.

VCF 9.0 Automation natively supports GitOps methodologies by providing version synchronization with Git-based repositories (such as GitHub, GitLab, or Bitbucket). This integration allows administrators and developers to treat infrastructure as code (IaC) by storing blueprints (Cloud Templates) as YAML files in a version-controlled environment. The platform can be configured to periodically sync with the repository, ensuring that the latest "released" versions in Git are automatically available in the VCF Automation service catalog. This enables a declarative management model where changes to infrastructure are proposed via Pull Requests, peer-reviewed, and then synchronized to the private cloud environment. While it facilitates the lifecycle of the templates, it is primarily a synchronization engine (Option A) rather than a full-scale CD tool like ArgoCD or a real-time "auto-apply" engine for running instances, providing the necessary balance between developer flexibility and operational governance.

To enable the Orchestrator integration, the administrator must navigate to:

Infrastructure (tab)

In VMware Cloud Foundation (VCF) 9.0, the VCF Operations Orchestrator (formerly vRealize Orchestrator) is a separate functional engine that must be explicitly integrated into the automation framework. When an administrator selects the Orchestrator tab and encounters the warning message "No VCF Operations Orchestrator integration available," it indicates that the logical link between the Automation service and the Orchestrator appliance has not yet been established for that specific organization.

The standard administrative workflow to resolve this and enable extensibility is to move from the consumption/design view into the foundational infrastructure configuration. By clicking on the Infrastructure tab, the administrator gains access to global settings. From there, the administrator must navigate to Connections and then Integrations. Within the Integrations menu, the administrator can select "Add Integration" and specifically choose VCF Operations Orchestrator. This process requires providing the FQDN of the orchestrator server and appropriate service account credentials. Once the integration is finalized and a successful data collection occurs, the portal's Orchestrator interface becomes functional, allowing users to build, run, and manage multi-cloud automation workflows across the VCF 9.0 fleet.

To support an AllApps Organization, which is inherently designed for both Kubernetes and VM workloads, the underlying infrastructure must be "modernized" via the vSphere Supervisor. Activating the Supervisor within the specific Workload Domain is the primary prerequisite, as it transforms the standard vSphere clusters into a Kubernetes-native control plane. Once the hardware/vSphere layer is ready, the next mandatory step takes place within the VCF Automation Provider Management Portal, where the administrator must define a Region. The Region acts as the "bridge" between the physical workload domain and the logical Organization; it discovers the Supervisor clusters and makes their compute, memory, and storage classes available for tenant assignment. Without a defined Region, the AllApps Organization has no source of resources to consume, and without an active Supervisor, the AllApps networking (VPC) and container services (VKS) cannot function.

To meet the requirement for self-service networking that supports both VMs and Kubernetes (K8s) within a VPC framework, the administrator must deploy an AllApps Organization. In VCF 9.0, the VMApps model is restricted to traditional vSphere-backed networking and does not support the native VPC construct required by the team. By choosing AllApps, the administrator can utilize the Default VPC provided during the Region-to-Organization mapping. This VPC is governed by VPC Connectivity Profiles, which allow the administrator to define how the organization handles traffic—for instance, allowing the development team to manage their own SNAT/DNAT rules and load balancers for ingress control while maintaining the security guardrails set by the provider. This specific combination of the AllApps Organization type and VPC-centric networking is the only way to provide the requested level of flexibility for "modern" developers who need to manage their own application networking stack alongside their containerized and virtualized services.

To meet the comprehensive requirements of monitoring, anomaly detection, and policy enforcement in VCF 9.0, a combination of integrated networking and security tools is used. NSX Traceflows provide the deep visibility needed to monitor IP space utilization and troubleshoot connectivity at the packet level, allowing administrators to visualize the path traffic takes through the virtual and physical fabric. Integrated Security with VCF Operations (formerly part of the Aria suite) provides the management dashboard for detecting network anomalies by correlating flow data and identifying traffic patterns that deviate from established baselines. Finally, vDefend (the integrated NSX security stack) is essential for enforcing consistent network policies through distributed firewalls (DFW), gateway firewalls, and IDS/IPS capabilities. Together, these three capabilities ensure that the VCF environment remains secure, transparent, and compliant with corporate governance standards, providing the "closed-loop" operational model required for modern private clouds.

Velero is the industry-standard and VMware-supported service integrated into VCF 9.0 for the backup and restoration of Kubernetes-based workloads, specifically vSphere Pods and persistent volumes. Within the VCF Automation framework, Velero is often deployed as part of the Supervisor services or within TKG clusters to provide data protection for stateful applications. It captures the state of the Kubernetes API objects (such as Pod specs and Secrets) and triggers snapshots of the underlying vSphere storage (via the Cloud Native Storage/CNS driver) to ensure that workloads can be recovered in the event of a cluster failure or accidental deletion. While other services like ArgoCD handle continuous delivery and VKS handles cluster lifecycle, only Velero is dedicated to the operational task of disaster recovery and migration of containerized resources within the vSphere Supervisor environment.

To configure tenant branding in VMware Cloud Foundation (VCF) 9.0 so that it only appears after a user has authenticated, the following three steps are required:

Ordered Steps:

Log into the Organization Portal.

Navigate to Branding.

Disable the Enable Login and Logout Page Branding setting.

In VMware Cloud Foundation (VCF) 9.0, branding is a tenant-specific configuration managed directly within the Organization Portal. This allows for a "white-labeled" experience where each organization can maintain its own visual identity. To satisfy the requirement that branding only appears after login, the administrator must first navigate to the Branding section of the portal settings.

The critical setting for this specific use case is "Enable Login and Logout Page Branding". By default, if this setting is enabled, the custom logo and background are displayed on the public-facing login screen. By disabling this setting, the portal will present the generic VCF login page to unauthenticated users, ensuring that sensitive tenant identity information is not visible to the public. Once the user successfully logs in, the platform identifies their organization context and loads the custom branding theme into the active session. This approach is standard for service providers who wish to maintain a unified entry point while providing customized environments for authorized users.

In the VCF 9.0 multi-tenant networking model, Virtual Private Clouds (VPCs) communicate with each other through a regional backbone. The Private-Transit Gateway IP Blocks field is specifically designated for the internal IP ranges used to facilitate this inter-VPC connectivity. When an administrator configures a Connectivity Profile for an organization, they must define these blocks to ensure that traffic routed between different departments or projects within the same region has a valid, non-conflicting address space to traverse the NSX Transit Gateway. Unlike External IP Blocks, which are used for SNAT/DNAT to the public internet or corporate WAN, the Private-Transit blocks are strictly for the "east-west" transit layer within the VCF Automation framework. Proper allocation in this field is essential for enabling seamless microservices communication across VPC boundaries while maintaining the logical isolation provided by the Supervisor.