VMware 3V0-24.25 - Advanced VMware Cloud Foundation 9.0 vSphere Kubernetes Service

VCF 9.0 documentation explicitly indicates thatvCenter upgrades and the Supervisor/cluster (Workload Management) upgrade are distinct, noting that “if you have only upgraded vCenter and not the cluster” then DevOps engineers have reduced permissions until the cluster is upgraded. This supports the stated standard that VKS/Workload Management lifecycle can be treated separately from vCenter. For the private registry requirement, VCF 9.0 provides an operational mechanism to authenticate and pull artifacts from private registries: “Registry secrets allow package and repository consumers to authenticate to and pull images from private registries,” implemented via a standard Kubernetes Secret of type kubernetes.io/dockerconfigjson.

Taken together, the standard implies (1)asynchronoushandling (separate lifecycle from vCenter) and (2)privatesourcing (images pulled from an internal registry with registry secrets). Therefore, selectingAsynchronous Privatebest matches both requirements in a single configuration choice, aligning with the documented separation of upgrades and the documented need to use authenticated access to private registries.

A ReplicaSet is a core Kubernetes workload controller used in VKS clusters to maintainavailability and steady-state capacityfor stateless applications. Its primary purpose is to ensure that adesired number of identical pod replicasare running continuously. If a pod is deleted, crashes, or is evicted because a node fails, the ReplicaSet detects that the current number of matching pods has dropped below the target and immediately creates replacement pods to restore the requested replica count. Conversely, if too many matching pods exist (for example, due to manual creation or a transient surge), it scales down by deleting excess pods to return to the desired state.

This behavior makes ReplicaSets foundational to reliable, self-healing application operation in Kubernetes and therefore in VKS. In practice, administrators and DevOps teams usually interact with ReplicaSets indirectly through higher-level controllers likeDeployments, which manage rolling updates and revisions while using ReplicaSets underneath to enforce the replica count for each version of an application. Options A, B, and D map to other Kubernetes objects (Service, StatefulSet, and DaemonSet respectively), not ReplicaSet.

VCF 9.0 describes VKS as providing self-service, declarative lifecycle management for Kubernetes clusters and explicitly identifiesCluster APIas the mechanism that enables Kubernetes-style lifecycle automation. The documentation states that “The Cluster API provides declarative, Kubernetes-style APIs for cluster creation, configuration, and management,” and that its inputs include resources describing “the virtual machines that make up the cluster” plus “cluster add-ons.” This directly maps to automated lifecycle management: a desired-state YAML is reconciled by controllers that create, update, and maintain the control plane and worker node resources without manual, imperative procedures.

The same VCF 9.0 content also notes VKS exposes “three layers of controllers” for lifecycle management and lists Cluster API as one of those layers, reinforcing that Cluster API is foundational for ongoing cluster operations (create, scale, upgrade, reconcile). Contour is an ingress controller (traffic routing), kubeadm is a Kubernetes bootstrap tool (not the VKS lifecycle controller framework), and Grafana is observability/visualization (not cluster lifecycle).

VCF 9.0 explicitly documents thatVKS supports two CNI options: Antrea and Calico, and that thesystem-defined default CNI is Antrea. This directly eliminates Flannel and Cilium as default supported options for VKS clusters on Supervisor in this context. VCF 9.0 also describes how a vSphere administrator can view or change this setting in the vSphere Client underSupervisor Management → Configure → Kubernetes Service → Default CNI, further reinforcing that Antrea is the baseline/default choice.

From a policy perspective in the question, the requirement is Kubernetes-layer observability and control of pod communications “without additional licensing or overlay complexity.” Antrea is presented in VCF 9.0 as the default CNI and is implemented usingOpen vSwitch, with networking and network policy capabilities provided at the Kubernetes layer for pods and services. Because it is the documented default (and supported) option for new VKS clusters, selectingAntreabest aligns with the “default supported option” requirement.

Harbor is used as aprivate registry serviceto store and distribute container artifacts for Kubernetes consumption, which is exactly what’s needed for a multi-tenant platform where multiple teams require isolated repositories. The VMware documentation treats Harbor as aVMware Tanzu Harbor Registry service, including governance around who can operate it and how teams are separated intoprojects(a key multi-tenancy boundary). For example, vSphere privileges explicitly cover the ability tocreate or delete a Harbor registryand tocreate, delete, or purge Harbor registry projects, reinforcing that Harbor is operated as a managed registry with project-scoped administration and access control.

In practice for regulated environments, the registry role is not just storage—Harbor is commonly used to enforce enterprise controls likepolicy-driven access (RBAC), and it supports security capabilities such asimage vulnerability scanningandimage trust/signing, which directly address the requirement to prevent unsafe images from being promoted or deployed.

VCF 9.0 describesCloud Native Storage (CNS) on vCenteras the component that implements “provisioning and lifecycle operations for persistent volumes.” When provisioning persistent volumes, CNS “interacts with the vSphere First Class Disk functionality to create virtual disks that back the volumes,” and it “communicates with Storage Policy Based Management to guarantee a required level of service to the disks.” This is exactly the storage-policy-to-backed-virtual-disk relationship the question is testing: storage policies (via policy-based management) define requirements, and CNS is the vCenter-side service that applies those requirements while creating and managing the backing storage objects.

In contrast,CSI(including Supervisor CNS-CSI and VKS pvCSI) is the Kubernetes-facing interface/driver used to request and consume storage, but it does not “provide” the vSphere storage policy system; rather, it relies on CNS/CNS-CSI and vCenter services to fulfill provisioning requests. Therefore,vSphere Cloud Native Storage (CNS)is the correct choice.

VCF 9.0 defines VKS as an upstream Kubernetes offering that isbuilt for vSphereand delivered with “well-thought-out defaults” to reduce operational burden. It states VKS provides an“opinionated installation of Kubernetes”with defaults “optimized for vSphere,” which “reduce[s] the amount of time and effort” typically spent deploying and running an enterprise Kubernetes cluster—this directly supportssimplified management and operations (A).

VCF 9.0 also emphasizes VKS is“integrated with the vSphere infrastructure”(storage, networking, authentication) and is built on a Supervisor that maps to vSphere clusters, creating a “unified product experience.” This supportsconsistent Kubernetes deployment on vSphere (B)because clusters are provisioned and operated in a standardized, vSphere-native way.

Finally, VCF 9.0 states VKS clusters “use open source Linux-based” components from VMware by Broadcom and notes key integrations (for example, CNI options) are open source—supportingleveraging open-source technologies (D).

OptionsCandEare not VKS benefits as stated: VKS targets VKS-provisioned upstream Kubernetes clusters (not “any distribution”), and “pods directly on ESXi” is described asvSphere Pods(Workload Management), not a defining benefit of VKS clusters.

VCF 9.0 distinguishes betweenbacking up the Supervisor control planeandbacking up workloadsthat run on the Supervisor, includingvSphere Pods. In the “Considerations for Backing Up and Restoring Workload Management” table, the scenario “Backup and restore vSphere Pods” explicitly lists the required tool as“Velero Plugin for vSphere”, with the guidance to “Install and configure the plug-in on the Supervisor.”

The same document is explicit thatstandalone Velero with Restic is not valid for vSphere Pods, stating: “You cannot use Velero standalone with Restic to backup and restore vSphere Pods. You must use the Velero Plugin for vSphere installed on the Supervisor.”

vCenter file-based backup is documented for restoring theSupervisor control plane state, not for backing up and restoring vSphere Pod workloads themselves. Therefore, to meet the requirement to protect third-party applications running asvSphere Pods, the architect should propose theVelero Plugin for vSphere.

Amulti-zone Supervisorin VCF 9.0 is designed to deliverplatform resiliency and high availability at the vSphere cluster (zone) failure-domain level. The VCF 9.0 documentation states that a multi-zone Supervisor “leverages three vSphere clusters” (each mapped to a vSphere Zone) and that these zones are used by both “workloads and Supervisor management components to deliver high availability,” exposing “each cluster as an independent, consumable availability zone,” resulting in a “resilient, HA-capable platform.”

This is reinforced in the vSphere Zones guidance: deploying the Supervisor onthree vSphere Zones spreads the control plane VMs across three zones, providing “cluster-level high availability” that protects the Supervisor control plane against asingle cluster-level failure(one control plane VM per management zone).

Because VKS (vSphere Kubernetes Service) runs on Supervisor, distributing Supervisor control plane and workload placement across zones improves overall availability of Supervisor services and Kubernetes consumption in that Supervisor instance.