Holodeck 9.0.2 with VCF 9.0.2.0 Stuck at Install-VcfInstallerBundles

Holodeck 9.0.2 with VCF 9.0.2.0 hangs at Install-VcfInstallerBundles: why the API returns 8 bundles, the PowerShell workaround, and the proper fix.


Bug VCF 9.0.2.0 with Holodeck 9.0.2

While deploying VMware Cloud Foundation 9.0.2.0 with Holodeck 9.0.2, I hit an interesting issue during the bundle download phase.

The deployment did not fail with a clear error. Instead, it stalled indefinitely at:

Install-VcfInstallerBundles

At first glance, everything looked fine. The VCF Installer depot UI showed all required components as downloaded successfully. However, the Holodeck deployment kept waiting forever.

The root cause turned out to be a hardcoded bundle count check inside the Holodeck PowerShell module.


Environment

The issue was observed with the following setup:

Holodeck:        9.0.2
HoloRouter OVA: 9.0.2.0424
VCF Installer: 9.0.2.0
Target VCF: 9.0.2.0
Deployment: Full VCF, ManagementOnly
Depot: Online depot

Important detail: this was full VCF, not VVF.


Symptom

During deployment, the log repeatedly showed:

SddcMgmtDomain[<pid>]: [INFO] Received Bundles. Checking if all VCF 9 bundles are available
SddcMgmtDomain[<pid>]: [INFO] Didn't receive all bundles. Received 8 bundle details. Trying again after 10 seconds

This message repeated every 10 seconds.

At the same time, the VCF Installer UI showed all visible components as successfully downloaded:

SDDC Manager 9.0.2.0
VMware Cloud Foundation Automation 9.0.2.0
VMware Cloud Foundation Operations 9.0.2.0
VMware Cloud Foundation Operations Collector 9.0.2.0
VMware Cloud Foundation Operations fleet management 9.0.2.0
VMware NSX 9.0.2.0
VMware vCenter 9.0.2.0

So from the UI perspective, everything looked complete. However, Holodeck was still waiting.


Root Cause

The problematic logic is inside the Holodeck PowerShell module on the deployed HoloRouter:

/root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1

The affected function is:

Install-VcfInstallerBundles

Holodeck queries the VCF Installer API:

https://${HostName}/v1/bundles/download-status?imageType=INSTALL

Then it filters bundles matching the selected VCF version:

}elseif($Version -eq "9.0.2.0"){
$vcf9_bundle_details = $bundle_details.elements | Where-Object {$_.version -match "9\.0\.2\.0\.*"}
}

The problem is the final count check:

elseif($vcf9_bundle_details.count -eq 7){
Write-Log -Message "Received all Bundle Details"
$bundle_api_response = $true
}
else{
Write-Log -Message "Didn't receive all bundles. Received $($vcf9_bundle_details.count) bundle details. Trying again after 10 seconds"
Start-Sleep -Seconds 10
}

For VCF 9.0.2.0, the API returns 8 matching bundle entries, not 7.

That means this condition never becomes true:

$vcf9_bundle_details.count -eq 7

Holodeck receives 8 bundles, but waits for exactly 7.

Result: an infinite loop.


Why Does the API Return 8 Bundles?

In VCF 9.0.2.0, the bundle structure changed compared to earlier VCF 9 versions.

The depot UI shows 7 visible rows, but the API response contains 8 entries matching:

9.0.2.0.*

The 9.0.2 BOM appears to split some components more granularly, for example around VCF Operations, Operations Collector, and Fleet Management. The UI abstracts this nicely, but the API exposes one additional bundle-level entry.

The important part is this:

VCF Installer UI: 7 visible downloaded components
VCF Installer API: 8 matching bundle entries
Holodeck logic: expects exactly 7

That mismatch is enough to block the deployment.


Workaround

Edit the Holodeck module directly on the HoloRouter.

Change this:

}elseif($vcf9_bundle_details.count -eq 7){

To this:

}elseif($vcf9_bundle_details.count -ge 7){

One-liner:

sed -i 's/$vcf9_bundle_details.count -eq 7/$vcf9_bundle_details.count -ge 7/' \
/root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1

This changes the check from “exactly 7 bundles” to “at least 7 bundles”.


Restart the Running PowerShell Session

The currently running pwsh process already has the old function loaded in memory.

After patching the file, kill the running PowerShell process:

pkill -9 -f pwsh

Then start a fresh PowerShell session and resume the deployment:

Import-HoloDeckConfig -ConfigID <id>

New-HoloDeckInstance -Version 9.0.2.0 -InstanceID <same-as-before> <original flags>

For example:

New-HoloDeckInstance -Version 9.0.2.0 -InstanceID 1 -ManagementOnly

Use the same flags you used in the original deployment.


What Happens After the Patch?

After applying the workaround, Holodeck resumes at the existing deployment state.

In my case, the state engine resumed at:

Install-VcfInstallerBundles

The patched function immediately accepted the 8 returned bundle entries and logged:

Received all Bundle Details

The deployment then moved forward.

Some bundle download calls may return:

BUNDLE_DOWNLOAD_ALREADY_DOWNLOADED

That is expected because the bundles are already present in the depot. The existing try/catch handling allows the phase to complete quickly.

After that, the deployment advanced to the management-domain phase.


Suggested Proper Fix

The quick fix is:

- }elseif($vcf9_bundle_details.count -eq 7){
+ }elseif($vcf9_bundle_details.count -ge 7){

A version-specific fix would also work, for example:

VCF 9.0.0.0 / 9.0.1.0 -> expect 7
VCF 9.0.2.0 -> expect 8

However, that would likely reintroduce the same type of bug in a future VCF BOM revision.

A better long-term approach would be to avoid a hardcoded count completely and validate the actual bundle download state instead.

For example, Holodeck should check that all required bundles for the selected deployment type and version are present and successfully downloaded, instead of assuming that the bundle count is always static.

Still, as an immediate workaround, changing -eq 7 to -ge 7 is enough to unblock the deployment.


Important Notes

This is an unofficial workaround.

The affected PowerShell module is not part of the public Holodeck documentation repository. It is bundled inside the HoloRouter OVA distributed through the Broadcom Support Portal.

Before editing vendor-supplied files, it is always a good idea to make a backup:

cp /root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1 \
/root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1.bak

Then apply the patch.


Summary

This is a good example of a small hardcoded assumption causing a deployment to stall without an obvious fatal error.

The VCF Installer API was returning valid data. The depot was populated. The UI showed the bundles as successfully downloaded. But Holodeck was waiting for an exact number of bundle entries that no longer matched the VCF 9.0.2.0 BOM.

For affected Holodeck 9.0.2 users deploying VCF 9.0.2.0, the key symptom is:

Didn't receive all bundles. Received 8 bundle details. Trying again after 10 seconds

If you see this message, check the bundle count logic in:

SddcMgmtDeployment.psm1

The workaround is small, but it can save a lot of troubleshooting time.


Quick Reference

cp /root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1 \
/root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1.bak

sed -i 's/$vcf9_bundle_details.count -eq 7/$vcf9_bundle_details.count -ge 7/' \
/root/.local/share/powershell/Modules/HoloDeck/Modules/SddcMgmtDeployment.psm1

pkill -9 -f pwsh

Then resume:

Import-HoloDeckConfig -ConfigID <id>
New-HoloDeckInstance -Version 9.0.2.0 -InstanceID <same-as-before> <original flags>

KB 406901: Fix “Certificate authorities update failed” in the VCF Management CA Wizard (VCF 9.0)

VCF 9.0 CA wizard: “Certificate authorities update failed” and 401 Unauthorized? A # or & in the CA service account password causes it (KB 406901).

Short answer: if the VCF 9.0 wizard Configure Certificate Authority for VCF Management fails with “Certificate authorities update failed” and /var/log/vrlcm/vmware_vrlcm.log shows 401 Unauthorized, check the Microsoft CA service account password. A # or & in the password breaks the request (Broadcom KB 406901). Change the password to one without those characters and run the wizard again.

When integrating a Microsoft Certificate Authority (CA) with VMware Cloud Foundation (VCF) Operations / Fleet Management in VCF 9.0, you may hit a frustrating blocker: the “Configure Certificate Authority for VCF Management” wizard fails with:

“Certificate authorities update failed”

This is documented in Broadcom KB 406901 and, importantly, it’s not always a connectivity or permissions problem—it can be a password character parsing issue.


What you’ll see

UI symptom

In the Configure Certificate Authority for VCF Management wizard, the validation/update step fails with:

  • Certificate authorities update failed

Log symptom (Fleet Management / VCF Operations appliance)

On the VCF Operations appliance, you’ll typically find a 401 Unauthorized in:

  • /var/log/vrlcm/vmware_vrlcm.log

Example (as shown in the KB):

  • Exception occurred while trying to validate Microsoft CA
  • HttpClientErrorException$Unauthorized: 401 Unauthorized
  • 401 - Unauthorized: Access is denied due to invalid credentials.

At first glance, this looks like wrong credentials or insufficient permissions. But KB 406901 highlights a very specific trigger.


Root cause (the “gotcha”)

This is a known issue with special characters in the CA service account password, specifically:

  • # or &

Even if the username/password are correct, the wizard’s CA validation request can fail in a way that surfaces as a 401 Unauthorized.


Resolution / Workaround (what to do now)

1) Reset the service account password

Change the Microsoft CA service account password to a value that does NOT contain:

  • #
  • &

Use a “safe” password character set (letters + numbers is the simplest) to avoid re-triggering the issue.

2) Re-run (or re-save) the CA configuration in the wizard

Go back to the Configure Certificate Authority for VCF Management wizard, enter the updated credentials, and run the validation/update again.

Once certificates have been reissued from the new CA, you can verify the chain with vCert on the vCenter side: the CA certificates in VECS and VMware Directory, and the Lookup Service trust anchors.

Link: Configure Certificate Authority for VCF Management fails with error, “Certificate authorities update failed”

Next step: once the CA is configured, it changes who renews which certificate across the fleet, and how new ESX hosts must be onboarded. See VCF 9 Certificate Management: Custom CAs, Auto-Renewal, and Host Onboarding.

Accelerating AI Workloads: Mastering vGPU Management in VMware Environments

Recap of Explore 2025 session INVB1158LV: managing NVIDIA vGPU for AI/ML workloads in VMware, vGPU profiles, MIG and placement tips.

Explore 2025 Session Recap – INVB1158LV

Are you looking to maximize AI/ML performance in your virtualized environment? At VMware Explore 2025, I attended a compelling session — INVB1158LV: Accelerating AI Workloads: Mastering vGPU Management in VMware Environments — that unpacked how to effectively configure and scale GPUs for AI workloads in vSphere.

This blog post shares key takeaways from the session and outlines how to use vGPU, MIG, and Passthrough to achieve optimal performance for AI inference and training on VMware Cloud Foundation 9.0.


vGPU Configuration Options in VMware vSphere

🔹 1. DirectPath I/O (Passthrough)

  • A dedicated GPU is assigned to a single VM or containerized workload.
  • Ideal for maximum performance and full GPU access (e.g., LLM training).
  • No sharing or resource fragmentation.

🔹 2. NVIDIA vGPU – Time Slicing Mode

  • Shares one physical GPU across multiple VMs.
  • Each VM gets 100% of GPU cores for a slice of time, while memory is statically partitioned.
  • Supported on all NVIDIA GPUs.
  • Useful for efficient GPU sharing, especially for model inference and dev/test setups.

✅ Example profiles: grid_a100-8c, grid_a100-4-20c

🔹 3. Multi-Instance GPU (MIG)

  • Available on NVIDIA Ampere & Hopper (e.g., A100, H100).
  • Splits GPU into isolated hardware slices (compute + memory).
  • Offers deterministic performance and better isolation.
  • Best for multi-tenant AI inference, production-grade deployments.

✅ Example profiles: MIG 1g.5gb, MIG 2g.10gb, MIG 3g.20gb
✅ Assignable via vSphere UI with profiles like grid_a100-3-20c


Time Slicing vs. MIG – When to Use What?

ModeBest ForSharing Type
Time SlicingLLM training, dev/test environmentsTime-shared
MIGProduction inference, multitenancySpatial (hardware)
PassthroughMaximum performance for single workloadNot shared

Smarter vMotion for AI Workloads in VCF 9.0

One of the standout improvements presented during session INVB1158LV was the vMotion optimization for VMs using vGPUs. With vSphere 8.0 U3 and VMware Cloud Foundation 9.0, the way vMotion handles GPU memory has been completely reengineered to minimize downtime (stun time) during live migration.

Instead of migrating all GPU memory during the VM stun phase, 70% of the vGPU cold data is now pre-copied in the pre-copy stage, and only the final 30% is checkpointed during stun. This greatly accelerates live migration even for massive LLM workloads running on multi-GPU systems.

📊 Example results with Llama 3.1 models:

  • Migrating a VM using 2×H100 GPUs (144 GB vGPU memory) saw stun time drop from 24.5s to just 6.3s.
  • Migrating a large model on 8×H100 (576 GB) now completes in 21s, compared to 325s for a power-off-and-reload approach — that’s a 15× improvement.

These enhancements make zero-downtime AI infrastructure upgrades and scaling possible, even for large language model deployments

Deploying a Minimal VCF 9.0 Lab – Insights from Explore 2025

Deploy a minimal VCF 9.0 lab on 2–3 hosts: single-host domain flag, NIC speed bypass, vSAN ESA HCL mock VIB, HTTP offline depot and a sample hardware BOM.

Short answer: a minimal VCF 9.0 lab needs only 2 ESXi hosts with NFS or 3 with vSAN/FC, a single 10GbE NIC, and singleton appliances. For nested labs you can even put the VCF Installer and SDDC Manager on one host. The tricks that make it work in a homelab are a single-host domain flag, a NIC-speed validation bypass, a vSAN ESA HCL mock VIB, and an HTTP offline depot, all shown below with the exact commands. Reference hardware: MINISFORUM MS-A2 with 128 GB RAM.

I had the pleasure of attending the excellent session “Deploying Minimal VMware Cloud Foundation 9.0 Lab” by Alan Renouf and William Lam at VMware Explore 2025. It was packed with practical advice, hardware insights, and field-tested tips on how to stand up a fully functional VCF environment—even on a tight budget.

Whether you’re a home lab enthusiast, enterprise architect, or just VCF-curious, here’s a recap of the key takeaways.


Key Changes: VCF 5.x vs VCF 9.x

VCF 5.x:

  • Required 4+ ESXi hosts
  • Monolithic installer
  • vSAN required
  • 3-node NSX cluster
  • 10GbE NICs mandatory

VCF 9.x:

  • More modular design
  • Only 2–3 ESXi hosts required
  • 1 x 10GbE NIC sufficient
  • Support for singleton appliances
  • Flexible storage (vSAN ESA, FC, NFS)

VCF 9.0 Tips & Tricks (with real CLI guidance)

Here’s the juicy part—real-world deployment tips and overrides:

1. Minimum ESXi Host Requirements

  • For vSAN/FC: 3 ESXi hosts
  • For NFS: 2 ESXi hosts
  • ⚠️ You can install VCF Installer + SDDC Manager even on a single ESXi host (great for nested labs!)
> cat /home/vcf/feature.properties

feature.vcf.internal.single.host.domain = true

> echo 'y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh

2. NIC Validation Bypass

If your ESXi host doesn’t have a 10GbE NIC:

> cat /etc/vmware/vcf/domainmanager/application.properties

enable.speed.of.physical.nics.validation = false

> echo 'y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh

3. vSAN HCL Override

VCF Installer will fail validation if your SSD or controller is not on the vSAN ESA HCL. Install a “mock” VIB to bypass:

esxcli software vib install -v /tmp/vsan-mock.vib

4. Offline Depot HTTPS Requirement

By default, the VCF installer requires HTTPS:

cat /opt/vmware/vcf/lcm/lcm-app/conf/application-prod.properties

lcm.depot.adapter.httpsEnabled=false

systemctl restart lcm

5. Basic Auth Requirement

You don’t need a full-blown web server:

python http_server_auth.py --bind 192.168.1.100 --user myuser --password mysecurepassword --port 443 --directory /myrepo

Reference Hardware for Minimal Lab

Here’s an example BOM shared by the presenters:

  • MinisForum MS-A2 w/ AMD Ryzen 7945HX (16c/32t)
  • 128GB DDR5 (2x64GB SODIMM)
  • 3x M.2 NVMe SSDs
  • 10GbE SFP+ NIC + 2.5GbE onboard
  • MikroTik 5-port 10GbE switch (for under $200)

This setup is small, powerful, and flexible enough for a complete VCF 9.0 deployment.


Deployment Walkthrough – TL;DR

Here’s the summarized 8-step flow:

  1. Install ESXi (kickstart from USB)
  2. Deploy VCF Installer VM
  3. Connect to Offline Depot
  4. Run Installer with JSON
  5. Configure vSAN ESA
  6. Deploy vCenter
  7. Update Storage Policies
  8. Deploy SDDC Manager, NSX, Fleet Manager, Automation, etc.

Summary

This session truly showcased how far VCF has come in terms of flexibility and accessibility. More info: VMware Cloud Foundation (VCF) 9.x in a Box. Related on vDan: Holodeck 9.0.2 stuck at Install VcfInstallerBundles, VCF 9 upgrade: vRNI SSL thumbprint in SDDC Manager and vSphere editions comparison: VVF vs VCF 9.1.
All trademarks belong to their respective owners.

Holodeck for VCF 9 (9.0.2 and 9.1): HoloRouter, Home Lab Requirements, Deployment Steps and Known Issues

Holodeck 9.1 deploys nested VCF 9.1, 9.0.x and 5.2.x labs. HoloRouter, host requirements, download location, deployment commands and known issues.

Short answer: Holodeck is VMware’s free toolkit for deploying a nested VCF lab. It runs on a single ESX host or on a vSphere cluster. The current release, Holodeck 9.1, deploys VCF 9.1.0.0, 9.0.x and 5.2.x, plus VVF. You download the HoloRouter OVA from the Broadcom Support Portal and upload the VCF Installer and ESX binaries to it. Then you run New-HoloDeckConfig and New-HoloDeckInstance in PowerShell on HoloRouter. It is a lab tool only; VMware does not support it.

Holodeck for VCF 9 overview: HoloRouter appliance with nested management domain and workload domain ESX hosts on one physical ESX host
Holodeck environment overview (from the official Holodeck documentation)

Holodeck VCF 9: which release deploys which VCF version

The table below is taken from the official Holodeck release notes. Each release lists the minimum ESX version for the physical host.

Holodeck releaseReleasedVCF versions it deploysMinimum ESX on target
9.12026 (release notes: May 2026)9.1.0.0, 9.0.2.0, 9.0.1.0, 9.0.0.0, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2 (plus VVF 9.x)8.0 U3
9.0.2February 20269.0.2.0, 9.0.1.0, 9.0.0.0, 5.2.2, 5.2.1, 5.28.0 U3
9.0.1October 20259.0.1.0, 9.0.0.0, 5.2.2, 5.2.1, 5.28.0 U3
9.0June 20259.0, 5.2.x8.0 U3

Version notes from the docs:

  • For VCF 9.0.0.0, 9.0.1.0 and 9.0.2.0, the docs recommend VCF Installer 9.0.2.0. VCF Installer 9.0.0.0 is no longer supported for nested deployments.
  • If you want 9.1.0.0, use VCF Installer 9.1.0.0.
  • Starting with 9.0.2, -InstanceID is mandatory. The Day 2 tasks that used to run with -Interactive now live in Update-HoloDeckInstance.

What is HoloRouter?

HoloRouter is a Photon OS appliance, delivered as an OVA, and it is the backbone of every Holodeck lab. The Holodeck PowerShell module comes built into it. HoloRouter provides these services to the nested environment:

  • DNS, DHCP and NTP
  • L3 routing between the nested VLANs and a firewall
  • BGP peering with the NSX Tier-0 gateway
  • A proxy for the VCF Installer
  • Job scheduling
  • An optional webtop desktop on port 30000 of the management IP

Holodeck 9.1 adds several services, all on the fixed vcf.lab domain behind HTTPS: Technitium DNS, HashiCorp Vault, Authentik SSO, an internal CA, and an optional GitLab (“Enable GitOps”) that can trigger deployments from a pipeline.

Default networking uses the 10.1.0.0/20 range for Site A and 10.2.0.0/20 for Site B. The VLANs are 0 and 10–25 for Site A and 40–58 for Site B. You can pass your own /20 CIDR, a VLAN start value and a DNS domain instead. The deployment runs against a centralized JSON config and is idempotent: if it fails, you rerun the same command and it continues where it stopped.

VCF 9 home lab requirements for Holodeck

These are the recommended physical host resources from the official pre-requisites. Holodeck 9.1 applies soft validation: it warns you instead of blocking when you are below them.

TargetSingle site CPU / RAM / diskDual site CPU / RAM / disk
VCF 9.148 / 650 GB / 2.2 TB96 / 1.5 TB / 5 TB
VCF 9.0 (VCF Automation, vSAN OSA)24 / 325 GB / 1.1 TB48 / 768 GB / 2.5 TB
VCF 9.0 (VCF Automation, vSAN ESA)32 / 325 GB / 1.1 TB64 / 768 GB / 2.5 TB
VVF 9.124 / 512 GB / 2 TB48 / 1 TB / 4 TB
VVF 9.012 / 256 GB / 1 TB24 / 512 GB / 2 TB
VCF 5.216 / 384 GB / 2 TB32 / 1 TB / 4 TB

Other requirements from the docs:

  • Target: a stand-alone ESX host or a vCenter-managed cluster. vSphere 8.0 U3 and 9.0 are tested. Use SSD/NVMe storage and have NTP running on every target host.
  • Switch: MTU 9000 on the vSS, vDS or NSX segment.
  • Port group: a dedicated trunk port group (VLAN 4095 on a vSS) with Promiscuous mode, MAC address changes and Forged transmits set to Accept. An NSX overlay segment with matching segment profiles also works.
  • HoloRouter: 6 vCPU, 12 GB RAM and 75 GB disk, plus one external IP per Holodeck environment.
  • Memory tiering: not recommended for nested labs.
  • Licensing: VCF 9.x runs in “License Later” mode for 90 days (60 days for 5.2.x). After that you must license or redeploy.

Holodeck 9.0 / 9.1 deployment flow

  1. Download. Get the HoloRouter OVA (and optionally the Offline Depot OVA) from the Holodeck product files on the Broadcom Support Portal. The docs say you must be signed in with an entitled account. The VCF Installer OVA and the ESX ISO come from the VCF downloads and need a Broadcom account with VCF entitlement.
  2. Deploy HoloRouter. Deploy the OVA to the ESX host or the vCenter. Connect one external port group for management and the trunk port group for Site A/B. Set the password, and enable SSH and webtop if you want them.
  3. Stage the binaries. Copy the binaries into the matching version folder, for example /holodeck-runtime/bin/9.0.2.0/ or /holodeck-runtime/bin/9.1.0.0/.
  4. Create a config and deploy. SSH to HoloRouter and run the commands shown below.
scp /<local-path>/<ESX ISO File Name> root@<Holorouter-IP>:/holodeck-runtime/bin/9.0.2.0/
scp /<local-path>/<VCF Installer OVA File Name> root@<Holorouter-IP>:/holodeck-runtime/bin/9.0.2.0/
ssh root@<holorouter-ip>
pwsh
New-HoloDeckConfig -Description <Description> -TargetHost <vCenter/ESX IP or FQDN> -Username <user> -Password <password>
New-HoloDeckInstance -Version "9.0.2.0" -InstanceID <id> -ManagementOnly -vSANMode OSA

If you leave out -ManagementOnly, you get a full stack: a 4-host management domain plus a 3-host workload domain. Optional switches add more components:

  • -NsxEdgeClusterMgmtDomain adds an NSX Edge cluster in the management domain.
  • -DeployVcfAutomation deploys VCF Automation.
  • -DeploySupervisorMgmtDomain or -DeploySupervisorWkldDomain deploys a Supervisor.
  • -DepotType Offline uses the offline depot.
  • -ProvisionOnly deploys only the nested hosts and the VCF Installer, for a manual greenfield install.
  • -VVF deploys VVF instead of VCF.

In a new PowerShell session, reload the config with Get-HoloDeckConfig and then Import-HoloDeckConfig -ConfigId <id> -Site a. In 9.1, -Site is mandatory. Use one config per deployment.

Known issues worth knowing before you start

  • Pre-check error “No trunk port groups found”. Create the trunk port group (VLAN 4095 plus the three security settings) and rerun the check.
  • Pre-check error “NTP service is not running on target host”. Configure and start NTP on the physical host.
  • DNS resolution fails during deployment. This happens if you gave HoloRouter an upstream DNS server as an FQDN instead of an IP address. Use an IP. The release notes include a DNSMASQ ConfigMap fix.
  • VVF 9.0.0.0 with VCF Installer 9.0.2.0 fails at “Generate Workload Domain Runtime Data Model”. Download the vCenter 9.0.2.0 bundle as well, then resume.
  • VCF 5.2.x ends with “No route to host” at Sync-HolodeckComponents. You can ignore it; VCF 5.2 has no VCF Operations to query.
  • vSAN ESA uses more nested storage than expected. Plan disk space above the minimum.
  • Older 9.0/9.0.1 issues are fixed in 9.0.2. These include the expired NSX Edge OVF certificate (Broadcom KB 424034) and “Validate NSX Install Image is Available”. Use the current release.

I hit a different problem myself: Holodeck 9.0.2 stuck at the VCF Installer bundle step. The fix is in the related post below.

Holodeck was presented at VMware Explore 2025 in session CODEQT1247LV, “Automagically Deploy VMware Cloud Foundation 9.0 in Homelab Using VMware Cloud Foundation Holodeck Toolkit”:

Sources

Related on vdan.cz

VMware Explore 2025 in Las Vegas | Day 1 Recap

VMware Explore 2025 in Las Vegas | Day 1 Recap

VMware Explore 2025 in Las Vegas | Day 1 Recap

VMware Explore 2025 in Las Vegas Day 1 Recap | August 25, 2025 If you heard the collective buzz across the Venetian Convention and Expo Center today, that was Day 1 of VMware Explore in Las Vegas coming to life. You crushed it—140 sessions across all four tracks, endless hallway conversations, and a few “just … Continued The post VMware Explore 2025 in Las Vegas | Day 1 Recap appeared first on VMware Explore Blog.


Broadcom Social Media Advocacy

From Aria Operations for Logs to VCF Ops for Logs: What You Need to Know About the Upgrade Path

No in-place upgrade from Aria Operations for Logs 8.18 to VCF Operations for Logs 9.0: deploy fresh, run both, move integrations, then retire 8.18.

Short answer: there is no in-place upgrade from Aria Operations for Logs 8.18.x to VCF Operations for Logs 9.0. Deploy VCF Operations for Logs 9.0 fresh, keep 8.18.x running for historical logs, move integrations and log sources to the new instance, optionally transfer old logs, then decommission 8.18.x (KB 402314).

With the release of VMware Cloud Foundation (VCF) 9.0, Aria Operations for Logs has officially been rebranded as VCF Operations for Logs. However, if you were expecting a simple in-place upgrade, there’s an important caveat: no direct in-place upgrade is supported.

Instead, administrators must deploy VCF Ops for Logs 9.0 as a fresh installation and gradually migrate integrations and data sources from their existing Aria Ops for Logs 8.18.x environment.


Why No In-Place Upgrade?

VMware Aria Operations for Logs version 8.18.x does not support an in-place upgrade path to version 9.0. The architectural and platform changes introduced in VCF 9.0 require a clean deployment.

This means that if you are currently running Aria Ops for Logs 8.18.3, you cannot simply apply an upgrade package. Instead, both versions must temporarily coexist while you complete the transition.


Recommended Migration Approach

Broadcom’s official upgrade guidance outlines the following steps:

  1. Deploy VCF Ops for Logs 9.0
  2. Unconfigure Integrations from 8.18.3
    • Keep your Aria Ops for Logs 8.18.3 instance online, but start unconfiguring existing integrations.
    • This ensures that historical log data remains accessible, even though new logs will be directed elsewhere.
  3. Reconfigure Integrations on 9.0
    • Point all your log sources, agents, and integrations to the new VCF Ops for Logs 9.0 instance.
    • Validate ingestion pipelines to confirm that logs are flowing properly.
  4. Leverage Log Transfer if Needed
    • Broadcom provides guidance for log transfer, allowing you to move log data from the old environment to the new one.
  5. Decommission the Old Instance
    • Once all integrations and data have been verified in the new platform, you can safely retire your 8.18.3 deployment.

Key Takeaways

  • Rebrand Only in Name? Not Quite. While the product name has changed from Aria Ops for Logs to VCF Ops for Logs, the lack of in-place upgrade means the transition is more than cosmetic.
  • Parallel Operations Are Required. You’ll need to run 8.18.3 and 9.0 side by side during the migration phase.
  • Fresh Deployment Is Mandatory. Treat this as a new installation rather than an upgrade.
  • Plan for Migration Effort. Reconfiguring all integrations and log sources can be time-intensive, so schedule accordingly.

Summary

If your organization relies heavily on VMware Aria Operations for Logs today, be prepared for a stepwise migration process rather than a straightforward upgrade. By planning the deployment of VCF Ops for Logs 9.0 carefully—and keeping the old instance online for historical data—you can ensure a smooth transition without losing valuable log visibility.

For more details, consult Broadcom’s official documentation:

vCLS Retreat Mode: How to Disable vCLS on a vSphere Cluster (7.0, 8.0, 9.0)

What “vSphere Cluster Services are disabled by retreat mode” means, what breaks in 7.0/8.0 vs 9.0, and how to enter or exit vCLS Retreat Mode.

Retreat Mode removes the vSphere Cluster Services (vCLS) VMs from one cluster. In vSphere 7.0 and 8.0 that has a price: DRS stops working and HA placement becomes suboptimal, which is exactly what the banner “vSphere Cluster Services are disabled by retreat mode” warns you about. From vSphere 9.0, vCLS can be disabled without any impact on DRS or HA. On 7.0 U3o, 8.0 U2 and later you switch it in the vSphere Client in a few clicks.

What “vSphere Cluster Services are disabled by retreat mode” means

When a cluster is in Retreat Mode, vCenter shows one of these messages on the cluster:

vSphere Cluster Services are disabled by retreat mode. vSphere DRS is not functioning and vSphere HA will not perform optimally.

vSphere Cluster Services are disabled by retreat mode. vSphere HA will not perform optimally.

The exact wording depends on which cluster services are enabled. Both mean the same thing: someone (or a script) put the cluster into Retreat Mode, the vCLS VMs were removed, and the cluster is running without them. If that wasn’t intentional, exit Retreat Mode and the vCLS VMs are redeployed automatically.

What vCLS and Retreat Mode are

vCLS runs small agent VMs in every vSphere cluster to keep cluster services such as DRS running independently of vCenter. There are two implementations:

  • External vCLS (vSphere 7.0 U1 to 8.0 U2): agent VMs deployed and managed by the ESX Agent Manager (EAM), up to three per cluster.
  • Embedded vCLS (vSphere 8.0 Update 3 and later): vCLS VMs based on vSphere Pod technology, managed internally by vpxd instead of EAM, with a redundancy of two VMs per cluster and a minimum of one powered-on VM for DRS (TechDocs: Embedded vCLS).

Retreat Mode tells vCenter to stop running vCLS VMs on one cluster. Embedded vCLS keeps the same per-cluster activate/deactivate capability, so Retreat Mode works the same way on 8.0 U3.

What breaks in Retreat Mode, by version

vSphere versionDRSHAvSAN cluster health
7.0.x and 8.0.xDoes not function on the clusterRestarts VMs, but placement is not optimal (HA relies on DRS for placement)Cluster Service health shows Degraded
9.0 and laterNo impactNo impact–

Source: Broadcom KB 316514. On 7.0 and 8.0, use Retreat Mode only for a specific task, such as storage maintenance or troubleshooting, and exit it as soon as you’re done.

How to enable Retreat Mode

vSphere 7.0 U3o, 8.0 U2 and later (vSphere Client)

  1. In the vSphere Client, go to Hosts and Clusters and select the cluster.
  2. Open Configure → vSphere Cluster Services → General.
  3. Click EDIT VCLS MODE (top right).
  4. Select Retreat Mode (the second option) and click OK.
Edit vCLS Mode dialog in the vSphere Client with the Retreat Mode option

vCenter removes the vCLS VMs from the cluster automatically.

Older versions (before 7.0 U3o / 8.0 U2): advanced setting

  1. Select the cluster in the vSphere Client and copy its domain ID from the browser URL, for example domain-c1006. Use only the domain-c<number> part; a wrong ID can break vCenter.
  2. Select the vCenter Server and open Configure → Advanced Settings → Edit Settings.
  3. Add the setting below and click Save. vCenter removes the vCLS VMs automatically.
Name:  config.vcls.clusters.domain-c<number>.enabled
Value: False

Many clusters at once: retreatModeConfiguration.py

KB 316514 provides a Python script to change Retreat Mode in bulk:

python retreatModeConfiguration.py -r disable
python retreatModeConfiguration.py -r enable

How to exit Retreat Mode

  • vSphere Client (7.0 U3o / 8.0 U2 and later): open EDIT VCLS MODE again and select the first (default) option instead of Retreat Mode.
  • Advanced setting: set config.vcls.clusters.domain-c<number>.enabled back to True.
  • Script: run retreatModeConfiguration.py with the opposite option.

vCenter redeploys the vCLS VMs, and on 7.0/8.0 DRS resumes once they are running. Check that the banner has disappeared from the cluster.

How to identify vCLS VMs

  • vCLS VMs are named vCLS-{UUID}, where the UUID is the UUID of the ESXi host, and sit in the vCLS folder in the VMs and Templates view.
  • Embedded vCLS VMs (8.0 U3 and later) carry the extra config option vCLSCRX.agent = true.
  • You can also check which extension manages a VM in the Managed Object Browser, for example https://<vCenter>/mob/?moid=vm-1004&doPath=config.managedBy. On vSphere 9 the MOB is disabled by default: see how to enable the MOB in vSphere 9.

Summary

  • vSphere 9.0 and later: you can disable vCLS without affecting DRS or HA.
  • vSphere 7.0 and 8.0: Retreat Mode also stops DRS and weakens HA placement. Use it for a specific task, then exit it.

Related: Introduction to vSphere Clustering Service (vCLS). Official reference: Disable vCLS on a Cluster via Retreat Mode (KB 316514).

vSphere Editions Comparison for 9.1: Standard, Enterprise Plus, VVF and VCF

vSphere Standard and Enterprise Plus stop at 8.0 U3; vSphere 9.1 ships only in VVF and VCF. See what each edition includes and which one fits you.

There is no vSphere 9 Standard or Enterprise Plus. Broadcom’s vSphere 9.1 Product Line Comparison states that the standalone vSphere Standard and vSphere Enterprise Plus editions are available only up to 8.0 Update 3, and that vSphere 9.1 features ship only in VMware vSphere Foundation (VVF) 9.1 and VMware Cloud Foundation (VCF) 9.1. So the real choice is between staying on 8.0 U3 or moving to VVF or VCF. The tables below show what separates them.

Which vSphere editions exist today

EditionLatest vSphere versionWhat it is
vSphere Standard8.0 Update 3Standalone vSphere for basic consolidation: vCenter Standard, vMotion, HA, no DRS or Distributed Switch
vSphere Enterprise Plus8.0 Update 3Standalone vSphere with DRS, Distributed Switch and the advanced resource-management features
VMware vSphere Foundation (VVF)9.1vSphere 9.1 bundled with vSAN (0.25 TiB per core), Supervisor / Kubernetes services and VCF Operations for monitoring, logs and compliance
VMware Cloud Foundation (VCF)9.1The full private-cloud platform: vSphere, vSAN, NSX, vSphere Kubernetes Service, VCF Operations, VCF Automation, HCX and VCF Private AI services

Sources: Broadcom vSphere 9.1 Product Line Comparison (Ver 1.0, April 2026) and the VCF 9.1 FAQ (September 2026).

Is there a vSphere 9 Standard?

No. Standard and Enterprise Plus end at 8.0 Update 3. If you need anything from vSphere 9.x, you need VVF 9.1 or VCF 9.1. Staying on Standard or Enterprise Plus means staying on the 8.0 line, so check its support dates in the Broadcom product lifecycle matrix before you commit to it.

Key differences between the editions

A selection of the features that most often decide the choice. For the complete matrix (storage protocols, vSAN data services, security features), use the official datasheet.

FeaturevSphere Standard (8.0 U3)vSphere Enterprise Plus (8.0 U3)VVF 9.1VCF 9.1
vCenter editionvCenter StandardvCenter StandardvCenter StandardIncluded
vSphere Lifecycle Manager✔✔✔✔
vMotion, HA✔✔✔✔
Fault Tolerance✔ (2 vCPU only)✔✔✔
Distributed Resource Scheduler (DRS)–✔✔✔
vSphere Distributed Switch, LACP, Load-Based Teaming–✔✔✔
Network I/O Control (NIOC), port mirroring, NetFlow/IPFIX–✔✔✔
Supervisor, vSphere Kubernetes Service (VKS), VM Service––✔✔
Container networking with Antrea, Supervisor load balancing––✔✔
VCF Operations: monitoring, capacity, compliance, log management––✔✔
NSX, VCF Automation, HCX–––✔

✔ included, – not included. The Standard, Enterprise Plus and VVF columns follow the Broadcom datasheet; the VCF column reflects that VCF includes vSphere and the components listed in the VCF 9.1 FAQ.

Which edition fits your environment

Your situationEditionWhy
Small site, a few hosts, no need for DRS or a Distributed Switch, and 8.0 is finevSphere StandardCovers vMotion and HA; no path to 9.x
You need DRS, a Distributed Switch or NIOC, and plan to stay on 8.0 for nowvSphere Enterprise PlusFull resource management on 8.0 U3; no path to 9.x
You want vSphere 9.x, Kubernetes via Supervisor/VKS, or built-in operations and compliance monitoringVVF 9.1The smallest bundle that includes vSphere 9.1
You need software-defined networking and security (NSX), self-service automation, or migration with HCXVCF 9.1The full private-cloud stack

Licensing terms and core minimums change between Broadcom announcements, so confirm them with your Broadcom partner before you size a purchase. Included vSAN capacity, per KB 313548 at the time of writing: 0.25 TiB per core with VVF and 1 TiB per core with VCF.

What VCF 9.1 adds on top of VVF

According to the VCF 9.1 FAQ, VCF 9.1 includes vSphere, vSAN, NSX, vSphere Kubernetes Service, VCF Operations, VCF Automation, HCX and VCF Private AI services. In practice, the step from VVF to VCF is about the network (NSX), automation and multi-site operations rather than about vSphere features themselves. Note that vSAN is not VCF-only: VVF includes 0.25 TiB of vSAN entitlement per licensed core, and VCF includes 1 TiB per core (KB 313548).

Planning the move to 9.x

vSphere Supervisor in VCF 9.0: VM Service, VKS and Namespaces (HOL-2633-01-VCF-L Deep Dive)

What vSphere Supervisor is in VCF 9: VM Service, vSphere Pods, VKS, Zones, Namespaces and Supervisor Services, walked through in hands-on lab HOL-2633-01-VCF-L.

Short answer: vSphere Supervisor turns a vSphere cluster into a Kubernetes control plane, so the same cluster can run VMs through the VM Service, vSphere Pods directly on ESX hosts, and full Kubernetes clusters through vSphere Kubernetes Service (VKS). In VCF 9 it is organised with vSphere Zones and Namespaces and extended with Supervisor Services such as Harbor or Velero. Supervisor is part of VVF and VCF, not of standalone vSphere Standard or Enterprise Plus. Below is my walkthrough of Broadcom’s hands-on lab HOL-2633-01-VCF-L.

Modern IT teams are increasingly challenged to manage both traditional virtual machines (VMs) and modern Kubernetes workloads side-by-side. VMware Cloud Foundation 9.0 rises to this challenge by tightly integrating vSphere Supervisor, transforming your vSphere clusters into a robust hybrid platform for VMs and Kubernetes.


In this Hands-On Lab (HOL-2633-01-VCF-L), you’ll get guided, practical experience on how to unify VM and Kubernetes management using vSphere Supervisor, from foundational concepts to deploying real workloads.


📚 Lab Modules at a Glance

ModuleTitleDurationLevel
1What is the vSphere Supervisor?15 minBeginner
2How does the vSphere Supervisor work?30 minBeginner

Let’s break down each module.


⚙️ Module 1: vSphere Supervisor Concepts and Components

✅ What is vSphere Supervisor?

vSphere Supervisor introduces a declarative Kubernetes control plane natively into your vSphere cluster. This means your cluster can now run:

  • VMs via the VM Service
  • Kubernetes Pods directly on ESXi hosts (as vSphere Pods)
  • Full upstream Kubernetes clusters using vSphere Kubernetes Service (VKS)

This hybrid model enables a consistent cloud-like experience for both traditional and modern workloads. Supervisor is part of VVF and VCF, not of standalone vSphere Standard or Enterprise Plus (see the vSphere editions comparison).

🔑 Key Components

  • vSphere Zone: Logical boundary to provide high availability. Clusters are mapped to Zones for resilience against failures.
  • vSphere Namespace: Think of it as a resource pool with policy-based limits (CPU, memory, storage) for workloads. It maps to Kubernetes namespaces but adds vSphere-specific governance.
  • Supervisor Networking: Uses either vSphere networking or NSX. Load balancers ensure external access for workloads.
  • Supervisor Storage: Utilizes storage policies to manage placement for VMs, Pods, persistent volumes, and container images.

🧩 Extensible Services

vSphere Supervisor comes with base services like:

  • VM Service
  • Kubernetes Service
  • Velero for backup

Additional services (like Grafana, Harbor, DNS, and vDPP) can be installed modularly to enhance the Supervisor’s capabilities.


🛠️ Module 2: Enabling and Configuring vSphere Supervisor

This module is all about getting your hands dirty — you’ll step through setting up vSphere Supervisor, deploying Namespaces, provisioning VMs and Kubernetes clusters, and expanding functionality with services.

⚡ Key Steps:

🔑 1️⃣ Prerequisites

  • Prepare clusters with vSAN or shared storage.
  • Define storage policies for control plane, VMs, Pods, and VKS clusters.

🔑 2️⃣ Enable vSphere Supervisor

  • Connect to the Management vCenter.
  • Create vSphere Zones for high availability.
  • Use the wizard to configure networking (NSX or vSphere stack), management network, and workload network.
  • Select control plane size and storage policy.

(Note: The lab walks through these steps but does not deploy a live Supervisor due to time constraints.)

🔑 3️⃣ Deploy & Configure a Namespace

  • Create a new Namespace and bind it to the Supervisor.
  • Assign VM Classes (defining VM sizing options).
  • Attach storage policies for workloads.
  • Create and associate a Content Library to provide VM templates.

🔑 4️⃣ Deploy Workloads

  • Deploy a VM using the VM Service and Consumption Interface.
  • Attach persistent storage and a Load Balancer.
  • Deploy a Kubernetes cluster (VKS) by specifying node pools and cluster config.
  • Validate external access via network service cards.

🔑 5️⃣ Add Services

  • Expand functionality by uploading YAMLs to register services like Grafana, Harbor, etc.

Supervisor and VKS troubleshooting: symptom → fix

The lab shows the happy path. These are the failures I have documented from real Supervisor and VKS environments, each with its cause and the fix:

SymptomCauseFix
Supervisor stays in Configuring with “ERROR – Configured Core Supervisor Services”, services show ReconcileFailedThe Supervisor’s HTTPS proxy blocks access to the internal registryConfigured Core Supervisor Services fix
Deployment or upgrade hangs at “Installed and Started Kubernetes Node Agent on the ESXi Host”Hosts are not compliant with the cluster’s vLCM image, so the spherelet VIB can’t be installedKubernetes Node Agent vLCM fix
Supervisor unhealthy after a year: kubectl Unauthorized, ESXi worker nodes NotReadyKubernetes and spherelet certificates expired (one-year lifetime)Rotate Supervisor certificates with certmgr
VKS cluster stuck provisioning, workers never power on, “POST /vsanHealth: 503”The CNS volume service in vmware-vsan-health on vCenter isn’t answeringVKS /vsanHealth 503 fix
vsphere-csi-node pods in CrashLoopBackOff with “Unauthorized”The CSI controller in the VKS cluster uses an old tokenvSphere CSI CrashLoopBackOff fix
VKS cluster upgrade stuck draining a nodeA Pinniped kube-cert-agent pod is recreated on the draining node (VKS 3.3+)VKS upgrade Pinniped drain fix
vSphere Pod to ClusterIP times out (VDS Supervisor), ErrImagePull while installing servicesTraffic is hairpinned through the workload network gateway or firewallClusterIP timeout on VDS Supervisor
TKG or VKS nodes can’t resolve names ending in .localsystemd-resolved sends .local to Multicast DNS.local DNS resolution fix

🎓 Summary

✔️ Unified Operations: Manage VMs and Kubernetes side-by-side in the same cluster with consistent policies.
✔️ Self-Service for DevOps: Namespaces, storage, and VM classes empower developers with agility.
✔️ Resilience and Scalability: Zones and Supervisor Services ensure HA and modularity.