VCF 9 Deployment Planning and Operations

A field guide to the VMware Cloud Foundation 9.1 Planning and Preparation Workbook for anyone planning a from-scratch VCF 9 fleet deployment.

The official workbook (vcf-9.1-planning-and-preparation-workbook.xlsx, downloaded from Broadcom) has ~9 deeply-technical sheets that ask hundreds of questions in a single flat layout. Opened cold, it tends to produce gaps, wrong VLANs, missing DNS entries, and weeks of back-and-forth.

This repo flips the order:

1. Lock the network / DNS / NTP / AD plan first — one page, one conversation. Most workbook errors trace back to this layer.
2. Use a role-based intake doc — questions grouped by who owns the answer (Network team, AD/PKI team, Platform team, Architect). Each question maps back to a specific workbook cell.
3. Transfer answers into the workbook last — by then it's mechanical.

Contents

Planning docs, in order

Path	Purpose
docs/prerequisites.md	Environment prerequisites (gate before any inputs)
docs/01-network-dns-plan.md	Step 1 — one-page network / DNS / NTP / AD plan
docs/02-intake.md	Step 2 — role-based intake questionnaire
docs/03-multi-az-prep.md	Extra prep for stretched / multi-AZ builds (if A13=Yes)
docs/04-sizing.md	Step 3 — management-domain sizing (VCF + VVF profile, licensing count) + link to the fit-check calculator
docs/05-day2-deployments.md	Day-N — fleet components added after bring-up (VCF Automation, Log Management, Operations for Networks, network placement)
docs/06-deployment-plan.md	Agile work breakdown (epics/stories/tasks); build a scope (stretch, Day-2, workload domains) and export it

Reference — per-component build guides

Grouped by the part of the platform they build. The docs/NN- file numbers are stable identifiers (linked from across the repo), not a reading order — within a band the guides are listed roughly in the order you would tackle them. The site sidebar mirrors these bands.

Foundation services — built once, close to bring-up:

Path	Purpose
docs/08-backup-target.md	Build guide for the SFTP backup target (building, verifying, field-notes gotchas)
docs/09-binary-depot.md	Build guide for the offline depot / VCF Download Tool (feed the depot, connect VCF, the fleet proxy)
docs/11-esx-coredump.md	Build guide for the ESXi network Dump Collector (enable on vCenter, point every host at it, verify), plus the local default: PSOD behaviour and finding the dump after a reboot
docs/12-sso-configuration.md	Build guide for configuring fleet SSO via the VCF Identity Broker (identity provider, per-product federation, role mapping, verification)

Build & expand — adding domains, clusters, hosts and a second AZ:

Path	Purpose
docs/40-host-commissioning.md	Host commissioning — network pool first, host prep (DNS, hostname, certificate CN = FQDN, clean disks), the storage type per host (vSAN OSA vs ESA is your choice), who can commission (SDDCAdmins), the vSphere Client wizard, the SDDC Manager API (POST /v1/hosts/validations → POST /v1/hosts), VCFHostPreparation, decommission/recommission and common failures. TechDocs/KB-sourced (#454)
docs/23-workload-domain-creation.md	Workload domain creation runbook — manual prep (network pool, commissioned hosts, DNS) vs the creation wizard, page by page, plus the DomainCreationSpec API path for LACP or no-cluster domains
docs/24-cluster-creation.md	Cluster creation runbook — adding a cluster to an existing workload domain: network pool + commissioned hosts, then the vSphere Client Create SDDC Cluster wizard, page by page (or the API), including the 9.1.1+ vDS-reuse rules
docs/25-cluster-expansion.md	Cluster expansion runbook — adding hosts to an existing cluster via the vSphere Client Add Unassigned Hosts wizard, and what it does (and doesn't) automate per storage type
docs/22-stretch-execution.md	Stretch execution runbook — manual steps (AZ2 hosts, witness, AZ2 network pool) vs what the single stretch API call does for you, for management domain and workload domain
docs/28-memory-tiering.md	Build guide for Memory Tiering over NVMe — fit check, NVMe device selection and sizing, keeping the device out of vSAN, enabling per cluster (Configuration Profiles) or host (esxcli memtier), mirroring, encryption, monitoring, failure behaviour
docs/30-ops-logs-sizing.md	Reference — VCF Operations / Cloud Proxy / Log Management / Real-Time Metrics sizing: which size and how many nodes or replicas for your object, host and log-volume numbers (Configuration Maximums 9.1, KB 397782, Log Management Detailed Design), with the source conflicts and storage assumptions; backs the interactive Ops & Logs Planning Sizer, a companion to Broadcom's official estimator (services-runtime footprint, Real-Time Metrics, Cloud Proxies per site)
docs/31-log-management.md	Build guide — getting logs into Log Management on VCF and VVF 9.1: whether your platform can run it (VVF needs VCF Management Services first), the deploy, which sources send on their own and which need an agent (SDDC Manager, Linux VMs), agent secrets and enforcement, the Cloud Proxy Log Forwarder, the in/out firewall flows, and forwarding logs out to a SIEM / syslog server. vCenter/ESX section pending #228
docs/32-gpu-hosts.md	Build guide — NVIDIA GPU hosts on VCF 9.1: passthrough vs vGPU time-slicing vs MIG, the licence layers (VCF, Private AI Foundation add-on, NVAIE), checking the card on both the Broadcom Compatibility Guide and NVIDIA's vGPU matrix, downloads, SR-IOV, the host driver in the vLCM image (imported via VCF Operations), Shared Direct / DirectPath, MIG, vGPU vMotion, NVIDIA guest licensing
docs/33-private-ai-foundation.md	Setup guide — VMware Private AI Foundation with NVIDIA on VCF 9.1 above the GPU hosts, connected or dark site: scope decisions, NVIDIA licensing (cloud service vs on-site DLS), VM classes and GPU reservations, bastion/admin hosts, the dark-site artifact table (source → staging → method), Ubuntu mirror and driver web server, content libraries, the VCF Automation org, the platform Harbor, the Quickstart, Private AI Services 2.1 / 3.0
docs/36-paif-dark-site-walkthrough.md	Step-by-step companion to 33 for a disconnected build: bastion/admin hosts, KB 388470 mirroring script (config.env, bom.json, pull/push), Harbor project + robot account, Ubuntu mirror + custom-repo.list (oras push), driver web server + index file, Ubuntu VKr library, Private AI Services 3.0 artifact mirroring tool (vcf pais amt pull/push), verify checklist (#441)
docs/37-paif-connected-runbook.md	Step-by-step companion to 33 for a connected build, with a flow picture by role/console: tokens/keys, licence service, VM classes (+ MMIO sizing), VCFA region/quota rules, content library, namespace class (vcf/kubectl + YAML), Quickstart (every page, 9.1.1 image swap), installing and activating Private AI Services (shared with the dark site), troubleshooting (#441)
docs/38-hcx-migration.md	Build guide — VCF Operations HCX 9.x to migrate a legacy vSphere / VCF environment into VCF 9.1: HCX 9.x on both sides (4.x breaks vCenter 9.1 and can't pair with 9.x), destination deploy from VCF Operations vs legacy OVA, licence inheritance, network profiles + sizing + firewall, site pair + service mesh, network extension (vDS / default-project NSX / VPC), migration types, waves, decommission, KB gotchas. TechDocs-sourced (#443)
docs/39-protection-and-recovery.md	Build guide — VCF Protection and Recovery 9.1 for DR between two VCF 9.1 sites: licence decision (replication included; Site Recovery Manager included with a VCF/VVF subscription since 2 Nov 2026, KB 461219; Advanced Cyber Compliance for RPO under 5 min), old vs new names, topology + extension IDs, replication type (vSphere Replication / vSAN replication needs vSAN ESA target / array SRA), appliance sizing + DNS + firewall (ESX-to-ESX 32032), OVA deploy on both sites, site + cluster pairing, mappings, recovery plans, test / planned migration / DR / reprotect, monitoring, Fleet DR boundary, 9.0.x convergence, configmax + caveats. TechDocs-sourced (#444)
docs/34-internal-cidrs.md	Reference — every internal, non-routed CIDR in a VCF 9.1 deployment in one table: services runtime and VCF Automation, License Hub 2.0, vDefend SSP pods, Cloud Proxy Docker subnet, Supervisor / VKS, NSX transit ranges; default, alternatives, where it's set (UI vs API per version), whether it can change later, and the overlaps to watch
docs/35-bringup-json.md	Build guide — the VCF Installer JSON specification before bring-up (story 3.2): three routes (wizard download, VCF.JSONGenerator, hand-built from the API schema), which blocks each scenario needs, the Installer validation and the API dry run (untested), a review checklist against the plan, and handling the file (it holds every bring-up password) as a secret. TechDocs / OpenAPI sourced (#381)
docs/29-single-pnic-build.md	Build guide for single-pNIC builds (e.g. a fabric-redundant UCS management vNIC) — three worked layouts (management-only on one pNIC with vSAN or NFS, whole host on one pNIC) with their bring-up JSON, the conflicting Broadcom sources, host/fabric prep, validation snags, the HA warning (and when it applies), a fabric failover test, and the API fragments for later workload domains, clusters and expansions

Network & security services — License Hub first, it licenses both Avi and vDefend:

Path	Purpose
docs/15-license-hub.md	Build guide for deploying License Hub (2.0 standalone OVA and 5.1.2 SSP Installer flows, post-deploy registration/licensing chain)
docs/14-avi-load-balancer.md	Build guide for deploying Avi Load Balancer (VCF Operations wizard, controller first-login setup, the licensing chain)
docs/18-vdefend-ssp.md	Build guide for deploying + first-time config of the vDefend Security Services Platform (SSP Installer wizard, form factors, onboard NSX Manager, activate Security Intelligence / NDR / Malware Prevention)

Supervisor & VKS:

Path	Purpose
docs/10-supervisor-enablement.md	Build guide for enabling a vSphere Supervisor on a workload domain (end-to-end walkthrough, Centralized Transit Gateway + Avi, vDS + Foundation Load Balancer walkthrough for VVF / no NSX, VKS planning, validation, field notes; combined 9.0/9.1 prep template)
docs/20-supervisor-image-registry.md	Supervisor / VKS runtime container image connectivity — direct, the proxy walkthrough (Supervisor + TkgServiceConfiguration + the no-proxy list), and the fully air-gapped walkthrough (the VCF Software Depot OCI registry, imgpkg relocation, the depot image proxy, Harbor for user images)

VCF Automation:

Path	Purpose
docs/17-vcfa-tenant-config.md	Build guide for first-time VCF Automation tenant/org config (Login Provider Manual setup — region, external IP block, external connections, organization + Avi)
docs/19-securing-vcf-automation.md	Hardening for an external-facing (Pattern 3) VCF Automation instance — the Transit Gateway firewall, the DFW exclusion-list sequence, IP-based portal locking, the Avi WAF policy, and the Avi management-plane Tier-1 firewall (walkthroughs for Broadcom's Securing VCF Automation Deployment design page)

Day-2 operations — runbooks and reverse-direction tooling:

Path	Purpose
docs/13-shutdown-startup.md	The ordered fleet shutdown / startup runbook (the 11-step management sequence, the fleet-level VCF Operations rule, shared NSX, infrastructure VMs last)
docs/21-config-artifacts.md	Reverse direction — capture re-submittable spec JSON from a built VCF 9.1 instance (bring-up spec, Fleet LCM component specs, Supervisor export, NSX policy hierarchy), sanitise / parameterise / validate into reusable templates
docs/16-remove-components.md	Cleanly remove and reinstall optional Day-N fleet components (Log Management, Real-time Metrics, VON, Depot Service, Identity Broker, VCF Automation) via cleanup_component.py

VVF / Standalone — VCF Operations without Fleet LCM:

Path	Purpose
docs/27-vcf-operations-ha-cloud-proxy-vvf.md	Build guide — deploying VCF Operations itself in VVF/standalone: node OVA deploy, setup wizard, enabling HA (inline or Day-N), and deploying/registering a Cloud Proxy and a License Server. Precedes docs/26
docs/26-vcf-operations-vvf-vcenter.md	Build guide — VCF Operations in VVF/standalone post-deployment config: vCenter adapter (role, service account, permission), renaming a node hostname, service-account password expiry, and AD/LDAP authentication sources

Reference data:

Path	Purpose
docs/07-firewall-ports.md	Deployment-critical firewall flows by zone + links to the Ports & Protocols tools
docs/workbook-cell-mapping.md	Intake answers mapped to workbook cells

Dutch translations (pilot): a small part of the docs is also available in Dutch under docs/nl/, and on the site through the language toggle in the header. English remains the canonical text.

Interactive tools (on the site)

Path	Purpose
web/src/pages/tools/mgmt-sizing.astro	Interactive sizing & cluster fit-check tool, VCF / VVF, with core + vSAN TiB licensing panel (client-side)
web/src/pages/tools/ops-logs-sizing.astro	Interactive Ops & Logs Planning Sizer (client-side): services-runtime footprint of Log Management + Real-Time Metrics, Cloud Proxies, quick VCF Operations estimate
web/src/pages/tools/deployment-plan.astro	Interactive deployment-plan export tool — scope + deployment choices (connectivity, storage, stretch, per-WLD Supervisor, VCF Automation model, Day-2 components) + Markdown/CSV backlog export
web/src/pages/tools/plan-tracker.astro	Interactive deployment tracker — the plan as a checklist (story checkboxes, per-epic progress, save/load progress file); follows the scope set in the export tool
web/src/pages/tools/test-plan.astro	Interactive test plan — scope-driven verification cases in phases TP-0…TP-6 with P/F1/F2/NA tracking, actual-result capture, "How to run this" instructions, and Excel/report/CSV/runbook export; follows the scope set in the export tool
web/src/pages/version-overview.astro	Auto-updating VCF 9.1 Version Overview — latest version + build per component, one section per supported maintenance version (9.1.1, 9.1.0) plus shared add-ons; data refreshed daily from Broadcom

Reference data + templates

Path	Purpose
reference/vcf-9.1-planning-and-preparation-workbook.xlsx	Pinned copy of the Broadcom workbook (v1.9.1.001) — the revision this repo's cell mapping targets
reference/vcf-9.1.1-planning-and-preparation-workbook.xlsx	Broadcom workbook for VCF 9.1.1 (v1.9.1.102) — the revision the sizing tool reproduces
web/public/templates/	Blank fillable CSV planning templates (IP/DNS, VLAN, NTP/AD/CA, BGP, firewall request, vSphere Supervisor prep 9.0/9.1) — downloadable from the site; feed the workbook / Coscia planner
samples/	Worked examples (Rainpole-style) — e.g. a filled Step 1 network/DNS plan
research/	Scratch research notes (not published on the site) — e.g. IPv6 support on the VPC model + VCF Automation

PowerShell tools (tools/)

Path	Purpose
tools/Get-VCFCredentials.ps1	Read-only, takes a -Credential in both modes. -SDDCManager: the passwords SDDC Manager stores/rotates for managed components (ESXi, vCenter, NSX, PSC, backup) via GET /v1/credentials, masked by default (-ShowPasswords, -ExportCsv). -VCFOps: the VCF Management account inventory (component/username/expiry, no secrets — that side has no reveal) via the internal Ops password-management API (Ops token + unsupported-API flag)
tools/Get-VCFBackupConfig.ps1	Read-only check of the VCF 9.1 VCF Management backup configuration via the Fleet LCM API — shows the target / username / schedule / retention the platform actually stored
tools/Set-VCFBackupConfig.ps1	Sets that backup location through the API (-WhatIf, -ShowThumbprint) — for when the wizard fails without a usable error
tools/Get-VCFProxyConfig.ps1	Read-only check of the proxy (peerProxy) stored on the VCF services runtime (VSP) via the Fleet LCM API
tools/Set-VCFProxyConfig.ps1	Sets that proxy through the API (-WhatIf, authenticating / TLS proxy, exclude lists) — or clears it (-Remove) — so the fleet can download bundles without direct internet
tools/Set-ESXCoredump.ps1	Points every ESX host (or a chosen subset) at a Dump Collector via esxcli / PowerCLI (-WhatIf, firewall ruleset check). Assumes the Dump Collector service is already enabled on vCenter — see docs/11-esx-coredump.md
tools/Get-VCFDeploymentArtifacts.ps1	Read-only capture of re-submittable spec JSON from a built instance — bring-up spec, every Fleet LCM VSP component + config, domain / cluster specs, a curated set of NSX policy scopes, Supervisor, vCenter config profiles. Sanitises on write (secrets redacted, licence keys masked, NSX realised-state stripped); -Tokenize (FQDN/IP/CIDR → placeholders + token-map.json), -Raw, -Include, -WhatIf. See docs/21-config-artifacts.md
tools/third-party/	Not our work. Mirrored third-party scripts, each with its licence alongside. Currently fleet_lcm_deploy_vcf_automation_to_different_network.ps1 — © 2022 William Lam, BSD 2-Clause, unmodified mirror of his script for deploying VCF Automation to a non-management network, hosted for air-gapped use. Prefer upstream; see docs/05-day2-deployments.md section D. Copied to the site alongside tools/*.ps1 at build time

The site itself

Path	Purpose
web/	ITQ-branded Astro site (GitHub + GitLab Pages) rendering the docs/ in place
web/scripts/scrape-versions.mjs	Node scraper behind the Version Overview — walks the Broadcom TechDocs patch tree per maintenance version (with a Bill-of-Materials fallback for lines with no patch tree yet) + the add-on release-notes trees, emits web/src/data/vcf-versions.json; run daily by .github/workflows/scrape-versions.yml
web/src/lib/mgmt-sizing.ts	Sizing engine — appliance tables + formulas from the 9.1.1 workbook (v1.9.1.102)
web/src/lib/ops-logs-sizing.ts	Ops & Logs sizing engine — matched to Broadcom's VCF Operations Sizing Estimator, plus Configuration Maximums 9.1 / KB 397782 / Log Management design limits; checked by web/scripts/verify-ops-logs-sizer.mjs on every build against the estimator's reference results
web/scripts/verify-sizer.mjs, web/test/sizer-golden-*.json	Checks the sizing engine against the workbook's own Excel-computed results (157 scenarios; runs on every build)
web/scripts/sizer-golden/	Regenerates those golden results by driving Excel over a copy of the workbook (scenarios.py + Get-SizerGolden.ps1)
web/src/lib/deployment-plan.ts	Deployment-plan engine — structured epics/stories/tasks + Markdown/CSV exporters + progress tracking
web/src/lib/test-plan.ts	Test-plan engine — scope-driven verification cases in phases TP-0…TP-6, each mapped to the epic/story it proves; result tracking + exporters (customer report with a verdict and an exit-criteria self-audit, working CSV, full runbook)
web/src/lib/test-plan-xlsx.ts	Builds the test plan as an .xlsx laid out like a field verification workbook (Title/Summary/Version + one sheet per phase, live COUNTIF stats, Status dropdown, conditional formatting)
web/src/lib/xlsx.ts	Minimal dependency-free .xlsx writer (ZIP via CompressionStream + OOXML parts). Narrow by design — inline strings, formulas, styles, merges, frozen panes, autofilter, list validation, conditional formatting
web/src/styles/theme.css	Theme layer — semantic surface / text / border tokens defined once with light-dark(), giving the site its light and dark scheme; the toggle only flips color-scheme

Web version

The planning docs are published as an ITQ-branded site via GitHub Pages: https://vcf-planning.hollebollevsan.nl/

The site (web/, built with Astro) renders the same docs/*.md in place — the markdown stays the single source of truth, so editing a doc updates both the GitHub view and the site. To run it locally:

cd web
npm install
npm run dev      # http://localhost:4321/VCF9-DeploymentPlanning/

A GitHub Actions workflow (.github/workflows/deploy.yml) rebuilds and deploys on every push to main that touches web/ or docs/.

For internal visibility, the same site also publishes to GitLab Pages on the ITQ GitLab mirror via .gitlab-ci.yml. The Astro site / base are env-configurable (SITE_URL / SITE_BASE), so one codebase serves both: GitHub uses the defaults; the GitLab job derives them from the actual Pages URL (CI_PAGES_URL), so the base matches automatically — including GitLab's unique-domain path suffix (/<project>-<hash>). Once the pages job runs, the site + its URL appear under Deploy → Pages (newer GitLab; older versions had it under Settings → Pages). The ITQ runner is a shell executor, so the job also fetches a local Node build itself.

Workflow

Prereqs → Network/DNS plan → Intake → Fill the workbook → Generate JSON → VCF Installer
 (gate)    (1 page, 1 mtg)   (per team)  (raw .xlsx, or      (VCF.JSON-      (submit the
                                          Coscia's tool)      Generator)      JSON, UI/API)

The filled P&P workbook is the machine-readable handoff: Coscia's tool (or the raw .xlsx) fills it, then VCF.JSONGenerator reads it to produce the deployment JSON for the VCF Installer — see Related tools below.

Related tools

• vcfplanning.lcoscia.fr — Leonardo Coscia's browser-based reimplementation of the official workbook. 600+ fields across a five-phase form (Planning → Prerequisites → Sizing → Deploy → As-Built), with live sizing, VLAN/IP/CIDR conflict detection, and JSON/Markdown/CSV export. Complements this repo: run the intake here, enter the answers there instead of fighting the raw .xlsx. Client-side only — no data leaves the browser.
• VCF.JSONGenerator — Ken Gould's cross-platform PowerShell module, a companion to the P&P workbook: it reads a populated workbook (the same one this repo targets) and generates the JSON payloads for the VCF management components (VCF Installer / SDDC Manager). The "last mile" — plan → fill the workbook → generate the JSON → submit to the Installer. It does not configure prerequisites or submit the JSON; you do that. GitHub · PowerShell Gallery
• VCFHostPreparation — helper for quickly imaging and commissioning ESXi hosts before bring-up (management, workload-domain, and second-AZ hosts). Referenced from the deployment plan's host-prep stories (E5 bring-up / E7 mgmt stretch / E9 workload domains).
• VCFJsonSpecCreators — optional interactive PowerShell that builds, validates, and submits SDDC Manager API JSON for post-bring-up (Day-N) expansion: network pools, workload domains, added clusters, and vSAN cluster stretch. The step after VCFHostPreparation — commission the hosts there, feed their SDDC Manager UUIDs to these scripts; each spec is validated against the live /validations endpoint before submit. Distinct from VCF.JSONGenerator above, which builds the initial management-domain bring-up JSON from the workbook — this one drives the ongoing domain/cluster lifecycle. Referenced from the deployment plan's E7 (mgmt stretch) and E9 (workload domain) stories.

ITQ Consulting Services (professional services, not public tools):

• VCF9 Readiness Assessment — pre-cutover readiness scoring from RVTools / HST exports.
• VCF Health Check — post-cutover health checks of live VCF 9 environments.

Author

Paul van Dieen — https://hollebollevsan.nl

Changelog

See CHANGELOG.md.