Short answer: In VCF 9.1 the VCF Download Tool (vcf-download-tool, VCFDT) is the only supported way to fetch binaries for environments without Internet access. The workflow is: generate a software depot ID, register it in the VCF Business Services console to get an activation code, save the code to a file, then run binaries list and binaries download with --sku, --vcf-version and --type filters into a --depot-store directory.

This is a command-first cheatsheet. Every command and option below is taken from the VCF 9.1 Download Tool command reference. If you are building the web server side, see the related post VCF 9.1 HTTP offline depot support.

Get the VCF Download Tool 9.1 and register it

Download the tool from the Broadcom Support Portal (My Downloads, VMware Cloud Foundation, Drivers & Tools). The archive contains a bin/ folder with vcf-download-tool (vcf-download-tool.bat on Windows) and lcm-bundle-transfer-util.

tar -xvzf vcf-download-tool-9.1.0.0.<build_number>.tar.gz
cd vcf-download-tool-9.1.0.0.<build_number>/bin

# 1. Generate a unique software depot ID for this VCFDT instance
./vcf-download-tool configuration generate --software-depot-id

# 2. In the VCF Business Services console: Software Depot Registrations >
#    New Registration, paste the ID, then save the activation code to a file
echo "<activation-code>" > /path/to/activation-code.txt

VCF Download Tool command groups

Each group has its own help: vcf-download-tool binaries -h, esx -h, and so on. -v prints the tool version and --ceip ENABLE|DISABLE sets CEIP participation.

vcf-download-tool binaries list and download commands

list and download require at least one filter. Always list first so you see component, version, size and type before pulling tens of gigabytes.

AC=/path/to/activation-code.txt
STORE=/path/to/binaries

# Install binaries used by the VCF Installer
./vcf-download-tool binaries list --sku VCF --vcf-version 9.1 \
  --depot-download-activation-code-file $AC --type INSTALL --automated-install

./vcf-download-tool binaries download --sku VCF --vcf-version 9.1 \
  --depot-download-activation-code-file $AC --type INSTALL --automated-install \
  --depot-store $STORE

# Upgrade binaries managed by SDDC Manager
./vcf-download-tool binaries download --sku VCF --vcf-version 9.1 \
  --depot-download-activation-code-file $AC --type UPGRADE \
  --lifecycle-managed-by SDDC_MANAGER_VCF --depot-store $STORE

# A single component (example: VCF Automation)
./vcf-download-tool binaries download --sku VCF --vcf-version 9.1 \
  --depot-download-activation-code-file $AC --component VRA --type INSTALL \
  --depot-store $STORE

For VMware vSphere Foundation replace --sku VCF with --sku VVF.

Filter options

ESX binaries, metadata and artifacts

# ESX binaries and metadata (progress in ./logs/esximage.log)
./vcf-download-tool esx download --depot-download-activation-code-file $AC \
  --depot-store $STORE

# ESX metadata only (8.x and 9.x upgrades and patches)
./vcf-download-tool esx metadata --depot-store=$STORE \
  --depot-download-activation-code-file=$AC

# Workload component artifacts (VCFDT 9.1.1+)
./vcf-download-tool artifacts download --sku VCF --vcf-version 9.1 \
  --depot-download-activation-code-file $AC --depot-store $STORE

Upload, download spec, export and cleanup

# Build a spec from planned upgrades of a workload domain
./vcf-download-tool binaries create-download-spec --domain-name <domain> \
  --download-spec-dir /path/to/spec ...

# Push downloaded content to SDDC Manager
./vcf-download-tool binaries upload --depot-store $STORE \
  -f sddc-manager.example.local -u administrator@vsphere.local \
  --sddc-manager-user-password-file /path/to/pw.txt

# Pack the depot store into a tar file for a transfer
./vcf-download-tool binaries export --depot-store $STORE --depot-file /path/to/depot.tar

# Remove obsolete binaries, keep what you still need
./vcf-download-tool binaries cleanup --depot-store $STORE ...

The ... means add the same filters you would use for list; check binaries -h for the exact combination your build accepts.

Proxy and practical tips

• Proxy: -s, --proxy-server fqdn:port, --proxy-https (add the proxy CA to the JRE trust store), -r, --proxy-user, --proxy-user-password-file. Kerberos and NTLMv2 proxies are not supported.
• Passwords and codes always go in files, never on the command line, so they do not end up in shell history.
• Downloads run for a long time. Enable TCP keepalive in your SSH client or run inside tmux/screen.
• If VCFDT and the web server are different machines, copy the depot store to the offline depot and then connect the software depot to it. A small lab walkthrough is in Deploying a minimal VCF 9.0 lab.

Further reading

• William Lam: VCF 9.1 – VCF Download Tool (VCFDT) Cheatsheet (original post)
• Broadcom TechDocs: VCF Download Tool General Options and Binaries Commands and Options
• Broadcom TechDocs: Download Binaries to an Offline Depot by Using the VCF Download Tool

Short answer: In VCF 9.1 you configure VCF Single Sign-On from VCF Operations. The wizard covers identity broker mode, the OIDC identity provider, vCenter and NSX, role assignment, and VCF Operations and Automation. Behind it are VCF Operations calls under /suite-api/internal/vidb/, and a script can replay them to finish the setup in about a minute. Those endpoints are internal, so treat this as lab or test automation. For production, use the wizard or the public APIs.

What changed for VCF SSO in 9.1

• Generic OIDC and generic SAML 2.0. Besides Okta, Ping, Entra ID, ADFS and Symantec, VCF 9.1 accepts any OIDC or SAML 2.0 identity provider, for example Keycloak (supported IdPs and protocols). You still get one identity provider per identity broker.
• Two identity broker modes. Embedded runs in the management domain vCenter. Instance is deployed as a VCF management services component (Deployment Modes of the Identity Broker).
• User and group provisioning through SCIM 2.0, JIT (with pre-provisioned or JIT-created groups) or AD/LDAP.
• API clients and tokens for non-interactive logins, plus a break-glass emergency access client.

If you’re setting up Keycloak by hand on VCF 9.0, the IdP-side configuration is in VCF 9.0 Single Sign-On (SSO) with Keycloak IdP. This article covers only the automation in 9.1.

Inputs you need before you script it

Configure the IdP to send these case-sensitive claims: preferred_username, email, family_name, given_name, groups and domain. If it can’t, map alternative claim names in VCF Operations under Identity & Access (Configure an Identity Provider using Generic OIDC).

The call sequence

The script follows the documented wizard steps in order. Every call goes to VCF Operations:

Authentication uses the public Suite API. The internal calls then need two extra headers:

curl -sk -X POST https://vcf-ops.example.com/suite-api/api/auth/token/acquire \
  -H 'Content-Type: application/json' -H 'Accept: application/json' \
  -d '{"username":"admin","password":"<password>","authSource":"local"}'

# every /suite-api/internal/vidb/* call afterwards:
#   Authorization: OpsToken <token>
#   X-Ops-API-use-unsupported: true

Supportability: read this first

The X-Ops-API-use-unsupported header is how VCF Operations marks internal endpoints. They aren’t a documented contract, and payloads can change in any patch. Use the script to rebuild labs and test environments quickly. In production, configure SSO with the wizard, or check whether the public Identity Broker API covers the step you want to automate. The script also has a reset option that deletes the SSO domain, so never point it at a shared environment by mistake.

After SSO: API clients and tokens for automation

Once VCF SSO is running, don’t let scripts log in as a human account. In VCF Operations go to Manage > Fleet Management Identity & Access > VCF SSO Overview > (identity broker) > API Access, create an API client, scope a role to it, and generate an API token (Create an API Client and Generate an API Token):

• API token TTL defaults to 30 days and access token TTL to 30 minutes. The maximums are set under Fleet Settings > IAM Setting.
• You see the token only once, when you generate it.
• The emergency access client gets the highest role. Its token defaults to 180 days, and only one exists at a time.

SSO touches certificates on every component. If logins break after the change, check vCenter STS signing certificate expiration first.

Further reading

• William Lam: VCF 9.1 – Automating VCF Single Sign-On (SSO) with OIDC-based Identity Provider (the original post) and his script configure_vcf_910_sso_with_oidc_idp.ps1
• Broadcom TechDocs: Configure a New VCF Single Sign-On for a VCF Instance
• Broadcom TechDocs: Create an Emergency Access Client

Short answer: VCF 9.1 Management Services (VCFMS) need a pool of at least 12 IP addresses on the VCF management network, and Broadcom recommends reserving 30 so you have room to scale. You can supply the pool as a CIDR block, a start–end range or a list of individual (even non-contiguous) addresses, and exclude reserved IPs. The UI covers the simple cases. The VCF Installer and SDDC Manager APIs cover the rest, including a custom network from 9.1.1.

What VCF Management Services are and why they need an IP pool

VCF management services are new in VCF 9.1. They bring fleet lifecycle, identity broker, log management, real-time metrics, Salt, SDDC lifecycle, the software depot and telemetry together on one platform. They run as containerized workloads in a VCF services runtime instance. The first VCF Instance hosts the fleet-level services, and every VCF Instance gets its own runtime for local tasks. Each runtime consumes addresses from a pool you define when you deploy or upgrade.

How many IP addresses VCFMS needs

Source: First VCF Instance FQDNs and IP addresses. Plan for 30 from the start. The extra addresses are used later when you add components such as log management or real-time metrics, and growing a pool inside a crowded management VLAN is harder than reserving it up front.

IP allocation formats: CIDR, range, list, exclusions

According to the upgrade deployment procedure, the UI accepts all these formats from VCF 9.1.0.400. On earlier 9.1 builds, the UI expects a contiguous range (new installs) or a CIDR (upgrades), and you need the API for anything else.

Where to set it: VCF Installer vs SDDC Manager

• New deployment (VCF Installer): the pool goes in the vspClusterSpec section of the deployment JSON (ipv4Pool). You can also enter it in the Installer UI.
• Upgrade to 9.1 (SDDC Manager): VCFMS and the license server are deployed as a separate step. Use the UI, or POST /v1/vcf-management-components with a VcfManagementComponentsSpec if you need non-contiguous IPs, exclusions or a custom network (xRegionNetwork, 9.1.1 and later).

API references: VCF Installer API and SDDC Manager API – vcf-management-components.

Common validation errors

1. “Not all addresses from the VCF Management Services IPv4 pool are part of the management network”: part of your range or CIDR falls outside the management subnet. Shrink the block, or on 9.1.1+ use the API with a custom network (KB 440223).
2. In-use IPs found in the pool: something already answers on an address in the pool. Exclude it, or move the pool. Also keep component FQDNs (vCenter, NSX, SDDC Manager, etc.) outside the runtime pool, while still on the management network.
3. Overlap with 198.18.0.0/15: if your network already uses that range, change the internal runtime CIDR before deployment.

For a small lab, see deploying a minimal VCF 9.0 lab. The same rule applies there: carve out the VCFMS block before you hand out IPs to anything else.

Further reading

• William Lam: VCF 9.1 – Additional IP allocation options for VCF Management Services (VCFMS) in VCF Installer and SDDC Manager
• Broadcom TechDocs: Deploy VCF Management Services and License Server as Part of VCF Upgrade to 9.1
• Broadcom KB 440223: IPv4 pool not part of the management network

VMware Advanced Memory Tiering Tips for Success | This document provides tips for successfully deploying VMware Advanced Memory Tiering with NVMe on VCF 9.0.

VMware Advanced Memory Tiering Tips for Success

Your Practical Guide to Doubling Memory Without Doubling Your Budget | This document provides tips for successfully deploying VMware Advanced Memory Tiering with NVMe on VCF 9.0.

Broadcom Social Media Advocacy

Automating VCF 9.0 Single Sign-On (SSO) with OIDC-based Identity Provider – William Lam

Automating VCF 9.0 Single Sign-On (SSO) with…

Configuring VMware Cloud Foundation (VCF) Single Sign-On (SSO), introduced in VCF 9.0, can be quite lengthy, especially when you go through the workflow for the first time. For my lab setup, I use Keycloak, a popular and free OIDC-based IdP, and have documented a step-by-step guide for using it [..]

Broadcom Social Media Advocacy

Short answer: Starting with VCF 9.1, an offline depot can be served over plain HTTP without authentication, in addition to HTTPS with or without basic authentication. In 9.0 the documented offline depot setup was HTTPS with basic authentication. You still populate the depot with the VCF Download Tool and publish the PROD tree from any web server. The VCF Installer UI in 9.1 only configures authenticated depots, so an unauthenticated HTTP or HTTPS depot is set through the API.

Supported offline depot protocols in VCF 9.0 vs 9.1

The three 9.1 combinations come from the Broadcom doc Set Up an Offline Depot Web Server for VMware Cloud Foundation (9.1). The UI-vs-API split is from William Lam’s testing. Broadcom still recommends HTTPS, so keep plain HTTP to isolated, trusted networks such as air-gapped sites and labs.

Offline depot web server requirements

• Linux (any distribution, for example Photon OS, RHEL or Ubuntu) or Windows VM with a static IP address. DNS records are recommended but not required.
• A dedicated disk for depot content; Broadcom recommends at least 1 TB.
• A dedicated non-root user with read/write access to the depot directory.
• For HTTPS: TLS 1.2 and 1.3, and a certificate whose SAN includes both the FQDN and IP address of the depot server.

Depot directory layout

The Broadcom Apache example uses /var/www/html as the document root with this structure:

/var/www/html/PROD/COMP          # product binaries
/var/www/html/PROD/metadata      # depot metadata
/var/www/html/PROD/vsan/hcl      # vSAN HCL data
/var/www/html/umds-patch-store   # ESX component data (UMDS)

You do not build this tree by hand. The VCF Download Tool writes binaries and metadata into it when you point --depot-store at the web root. The commands for install, upgrade and ESX downloads are in my VCF 9.1 VCF Download Tool (VCFDT) cheat sheet.

Serving the depot over HTTP with Apache

For an unauthenticated HTTP depot you only need Apache listening on port 80 with read access to the tree. In Broadcom’s HTTPS example, PROD/COMP and PROD/metadata are protected with AuthType Basic, while vsan/hcl and umds-patch-store are always Require all granted. For HTTP without authentication, grant all four:

<Directory /var/www/html/PROD>
  Require all granted
</Directory>
<Directory /var/www/html/umds-patch-store>
  Require all granted
</Directory>

Then apply the permissions from the Broadcom procedure and restart the web server:

chown apache -R /var/www/html/
find /var/www/html -type d -exec chmod 0500 {} \;
find /var/www/html -type f -exec chmod 0400 {} \;
chmod 755 /var/www/
chmod 755 /var/www/html/

Open TCP 80 (or your chosen port) on the host firewall. Before connecting VCF, check from another machine that http://depot.example.local/PROD/metadata/ returns content.

Connecting VCF Installer to the HTTP offline depot

In the VCF Installer UI (Depot Settings and Binary Management > Offline Depot > Configure) you enter the depot URL and credentials, as described in Connect VCF Installer to Broadcom or an Offline Depot. For a depot without authentication, use the VCF Installer API instead:

1. Get a token from POST /v1/tokens.
2. Send PUT /v1/system/settings/depot with a depotConfiguration that sets isOfflineDepot to true and uses your http:// depot URL, with no offlineAccount.
3. Check the result with GET /v1/system/settings/depot, then sync metadata and download binaries as usual.

William Lam’s post has a working PowerShell example for both the VCF Installer and the fleet depot service (/depot-service/api/depot/v1/connectivity with depotType: OFFLINE). A fleet deployed from an installer that used an HTTP depot inherits that configuration. The API reference is on the Broadcom developer portal: Depot Settings APIs.

HTTPS depot: trusting the certificate

If you stay on HTTPS with a private CA, VCF Installer must trust the depot certificate before you configure it. The Broadcom procedure, run as root over SSH, is:

openssl s_client -connect depot_server_FQDN:443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/server.crt
keytool -import -trustcacerts -file /tmp/server.crt -keystore /etc/alternatives/jre/lib/security/cacerts -alias offline_depot_server -storepass changeit -noprompt
echo 'y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh

Skipping this step, or using a certificate without the IP address in the SAN, will break the offline depot connection. HTTP avoids certificate handling entirely, which is the main practical benefit of the 9.1 change for labs and isolated sites.

Further reading

• William Lam: VCF 9.1 – New HTTP Offline Depot Support for VCF Installer & Fleet Depot Service
• Broadcom TechDocs: Set Up an Offline Depot Web Server (VCF 9.1)
• Broadcom TechDocs: Download Binaries to an Offline Depot by Using the VCF Download Tool
• vDan: VCF 9.1 VCF Download Tool (VCFDT) cheat sheet

#115 – GPU resource management for AI workloads with Frank Denneman!

#115 – GPU resource management for AI workloads…

Recently, Frank published a series of blog posts on GPU resource management. I invited Frank to the show to explain why GPU resource management is different than CPU and memory management in vSphere. Frank goes over all the intricate details, and as always, dives deep into the various […]

Broadcom Social Media Advocacy

Inside VCF 9.1: Platform, Lifecycle, and What’s Different Now | VMware Cloud Foundation 9.1 introduces a wide range of improvements across the platform, and in this episode, Pete and John sit down with William Lam to walk through the updates that matter most to practitioners.

Inside VCF 9.1: Platform, Lifecycle, and What’s…

VMware Cloud Foundation 9.1 introduces a wide range of improvements across the platform, and in this episode, Pete and John sit down with William Lam to walk through the updates that matter most to practitioners. From zero-touch provisioning and faster patching to fleet management, real-time […]

Broadcom Social Media Advocacy