Broadcom KB 423893 remains the single source of truth for the Microsoft certificate expiration topic in UEFI Secure Boot VMs.
Important: even if the Microsoft KEK certificate expires, affected VMs will continue to boot. The impact is mainly that the VM may not be able to update Microsoft KEK, DB and DBX certificates, which can block future Secure Boot related security updates. Guest OS updates not relying on these Secure Boot databases should continue to work.
This topic only concerns VMs with UEFI Secure Boot enabled. The KB also includes PowerShell scripts to identify Secure Boot / vTPM VM status and to reboot VMs.
For Windows VMs, wait for the automated PK update solution (to be available in an upcoming 9.1.x patch release)
4
Disabled
Enabled
No Action
No Action
No Action
Summary:
Secure Boot enabled without vTPM: patch ESXi hosts to 8.0 U3j and reboot the VMs to remediate PK automatically.
Secure Boot enabled with vTPM: follow the KB carefully. For Windows VMs, Broadcom recommends waiting for the automated remediation in a future ESXi patch.
After PK remediation, follow the guest OS vendor guidance to update KEK, DB and DBX certificates.
Are your CPUs memory-starved while your infrastructure struggles with underutilization and growing costs? Enter Memory Tiering with NVMe — a groundbreaking feature in vSphere 9.0 that promises up to 40% lower TCO by intelligently managing your memory resources.
What Is Memory Tiering?
Memory tiering allows ESXi to use NVMe devices as a secondary memory tier, extending beyond traditional DRAM. By classifying memory pages as hot, warm, cold, or very cold, vSphere can dynamically move less frequently used pages to NVMe-backed memory. This unlocks better VM consolidation, more predictable performance, and optimized CPU usage.
Key Benefits
Cost Efficiency: Offloads cold pages from expensive DRAM to more affordable NVMe.
Better Utilization: Frees up to 30% of CPU cores for actual workloads.
Advanced Observability: Gain detailed visibility into DRAM and NVMe usage.
Resilient Architecture: Supports RAID, vMotion, DRS, and encryption at both VM and host level.
Who Should Use It?
Ideal for general workloads and tiered VMs, but not supported for latency-sensitive or passthrough-based VMs. Ensure your NVMe meets Broadcom’s vSAN compatibility requirements and configure the DRAM:NVMe ratio wisely (default is 1:1).
Summary
Memory tiering isn’t just a cool buzzword — it’s a strategic shift that aligns your infrastructure with modern performance and cost demands. Whether you’re scaling your VDI environment or looking to cut memory costs without compromising on performance, NVMe Memory Tiering in vSphere 9.0 is a game changer.
ESXCLI Commands for NVMe Memory Tiering – Commands Recap
Description
Command
Check maintenance mode
esxcli system maintenanceMode get
List storage devices
esxcli storage core adapter device list
Create NVMe tier device
esxcli system tierdevice create -d <device> <vendor> <id>
List tier devices
esxcli system tierdevice list
Enable kernel memory tiering
esxcli system settings kernel set -s MemoryTiering -v TRUE
Verify tiering status
esxcli system settings kernel list -o MemoryTiering
Are you looking to maximize AI/ML performance in your virtualized environment? At VMware Explore 2025, I attended a compelling session — INVB1158LV: Accelerating AI Workloads: Mastering vGPU Management in VMware Environments — that unpacked how to effectively configure and scale GPUs for AI workloads in vSphere.
This blog post shares key takeaways from the session and outlines how to use vGPU, MIG, and Passthrough to achieve optimal performance for AI inference and training on VMware Cloud Foundation 9.0.
vGPU Configuration Options in VMware vSphere
🔹 1. DirectPath I/O (Passthrough)
A dedicated GPU is assigned to a single VM or containerized workload.
Ideal for maximum performance and full GPU access (e.g., LLM training).
No sharing or resource fragmentation.
🔹 2. NVIDIA vGPU – Time Slicing Mode
Shares one physical GPU across multiple VMs.
Each VM gets 100% of GPU cores for a slice of time, while memory is statically partitioned.
Supported on all NVIDIA GPUs.
Useful for efficient GPU sharing, especially for model inference and dev/test setups.
✅ Example profiles: grid_a100-8c, grid_a100-4-20c
🔹 3. Multi-Instance GPU (MIG)
Available on NVIDIA Ampere & Hopper (e.g., A100, H100).
Splits GPU into isolated hardware slices (compute + memory).
Offers deterministic performance and better isolation.
Best for multi-tenant AI inference, production-grade deployments.
✅ Example profiles: MIG 1g.5gb, MIG 2g.10gb, MIG 3g.20gb ✅ Assignable via vSphere UI with profiles like grid_a100-3-20c
Time Slicing vs. MIG – When to Use What?
Mode
Best For
Sharing Type
Time Slicing
LLM training, dev/test environments
Time-shared
MIG
Production inference, multitenancy
Spatial (hardware)
Passthrough
Maximum performance for single workload
Not shared
Smarter vMotion for AI Workloads in VCF 9.0
One of the standout improvements presented during session INVB1158LV was the vMotion optimization for VMs using vGPUs. With vSphere 8.0 U3 and VMware Cloud Foundation 9.0, the way vMotion handles GPU memory has been completely reengineered to minimize downtime (stun time) during live migration.
Instead of migrating all GPU memory during the VM stun phase, 70% of the vGPU cold data is now pre-copied in the pre-copy stage, and only the final 30% is checkpointed during stun. This greatly accelerates live migration even for massive LLM workloads running on multi-GPU systems.
📊 Example results with Llama 3.1 models:
Migrating a VM using 2×H100 GPUs (144 GB vGPU memory) saw stun time drop from 24.5s to just 6.3s.
Migrating a large model on 8×H100 (576 GB) now completes in 21s, compared to 325s for a power-off-and-reload approach — that’s a 15× improvement.
These enhancements make zero-downtime AI infrastructure upgrades and scaling possible, even for large language model deployments
I had the pleasure of attending the excellent session “Deploying Minimal VMware Cloud Foundation 9.0 Lab” by Alan Renouf and William Lam at VMware Explore 2025. It was packed with practical advice, hardware insights, and field-tested tips on how to stand up a fully functional VCF environment—even on a tight budget.
Whether you’re a home lab enthusiast, enterprise architect, or just VCF-curious, here’s a recap of the key takeaways.
Key Changes: VCF 5.x vs VCF 9.x
VCF 5.x:
Required 4+ ESXi hosts
Monolithic installer
vSAN required
3-node NSX cluster
10GbE NICs mandatory
VCF 9.x:
More modular design
Only 2–3 ESXi hosts required
1 x 10GbE NIC sufficient
Support for singleton appliances
Flexible storage (vSAN ESA, FC, NFS)
VCF 9.0 Tips & Tricks (with real CLI guidance)
Here’s the juicy part—real-world deployment tips and overrides:
1. Minimum ESXi Host Requirements
For vSAN/FC: 3 ESXi hosts
For NFS: 2 ESXi hosts
⚠️ You can install VCF Installer + SDDC Manager even on a single ESXi host (great for nested labs!)
This setup is small, powerful, and flexible enough for a complete VCF 9.0 deployment.
Deployment Walkthrough – TL;DR
Here’s the summarized 8-step flow:
Install ESXi (kickstart from USB)
Deploy VCF Installer VM
Connect to Offline Depot
Run Installer with JSON
Configure vSAN ESA
Deploy vCenter
Update Storage Policies
Deploy SDDC Manager, NSX, Fleet Manager, Automation, etc.
Summary
This session truly showcased how far VCF has come in terms of flexibility and accessibility. More info: VMware Cloud Foundation (VCF) 9.x in a Box. All trademarks belong to their respective owners.
With the release of VMware Cloud Foundation (VCF) 9.0, Aria Operations for Logs has officially been rebranded as VCF Operations for Logs. However, if you were expecting a simple in-place upgrade, there’s an important caveat: no direct in-place upgrade is supported.
Instead, administrators must deploy VCF Ops for Logs 9.0 as a fresh installation and gradually migrate integrations and data sources from their existing Aria Ops for Logs 8.18.x environment.
Why No In-Place Upgrade?
VMware Aria Operations for Logs version 8.18.x does not support an in-place upgrade path to version 9.0. The architectural and platform changes introduced in VCF 9.0 require a clean deployment.
This means that if you are currently running Aria Ops for Logs 8.18.3, you cannot simply apply an upgrade package. Instead, both versions must temporarily coexist while you complete the transition.
Recommended Migration Approach
Broadcom’s official upgrade guidance outlines the following steps:
Deploy VCF Ops for Logs 9.0
Set up a fresh instance of VCF Ops for Logs in your environment.
Keep your Aria Ops for Logs 8.18.3 instance online, but start unconfiguring existing integrations.
This ensures that historical log data remains accessible, even though new logs will be directed elsewhere.
Reconfigure Integrations on 9.0
Point all your log sources, agents, and integrations to the new VCF Ops for Logs 9.0 instance.
Validate ingestion pipelines to confirm that logs are flowing properly.
Leverage Log Transfer if Needed
Broadcom provides guidance for log transfer, allowing you to move log data from the old environment to the new one.
Decommission the Old Instance
Once all integrations and data have been verified in the new platform, you can safely retire your 8.18.3 deployment.
Key Takeaways
Rebrand Only in Name? Not Quite. While the product name has changed from Aria Ops for Logs to VCF Ops for Logs, the lack of in-place upgrade means the transition is more than cosmetic.
Parallel Operations Are Required. You’ll need to run 8.18.3 and 9.0 side by side during the migration phase.
Fresh Deployment Is Mandatory. Treat this as a new installation rather than an upgrade.
Plan for Migration Effort. Reconfiguring all integrations and log sources can be time-intensive, so schedule accordingly.
Summary
If your organization relies heavily on VMware Aria Operations for Logs today, be prepared for a stepwise migration process rather than a straightforward upgrade. By planning the deployment of VCF Ops for Logs 9.0 carefully—and keeping the old instance online for historical data—you can ensure a smooth transition without losing valuable log visibility.
For more details, consult Broadcom’s official documentation:
The vSphere Cluster Services (vCLS) are a critical part of maintaining cluster features like vSphere DRS and HA in your VMware environment. But there might be scenarios where you need to disable vCLS on a cluster — for example, for troubleshooting or special configurations. This is where Retreat Mode comes in.
In this post, you’ll learn:
What Retreat Mode is
The impact of using it
How to enable or disable it safely across different vSphere versions
📌 What is vCLS and Retreat Mode?
vCLS deploys lightweight agent VMs in every vSphere cluster to maintain cluster services. Without these VMs, some services like vSphere DRS and HA cannot function properly in vSphere versions prior to 9.0.
Retreat Mode is a way to tell vCenter: “Stop running vCLS VMs on this cluster.” This disables vCLS for that cluster — but at a cost.
👉 Good news: Starting with vSphere 9.0, you can disable vCLS without losing DRS or HA functionality!
👉 Important for older versions: In versions before vSphere 9.0, disabling vCLS means DRS will stop working and HA placement will be suboptimal. Also, vSAN cluster health might show as degraded.
⚠️ Risks and Impacts of Retreat Mode
If you enter Retreat Mode on a cluster:
✅ vCLS VMs will be removed
❌ DRS will stop balancing workloads automatically
❌ HA can still restart VMs, but may pick less optimal hosts
❌ vSAN cluster health may show “Degraded”
Use Retreat Mode only when absolutely necessary.
🛠️ How to Enable Retreat Mode
✅ vSphere 7.0 U3o, 8.0 U2, and Later
VMware has made this easy in recent updates:
Log in to the vSphere HTML5 Client.
Go to Hosts and Clusters.
Select your cluster.
Click the Configure tab.
Under vSphere Cluster Services, click General.
Click EDIT VCLS MODE (top right).
Select Retreat Mode and click OK.
Done! The vCLS VMs will be cleaned up automatically.
✅ Older Versions (before 7.0 U3o / 8.0 U2)
This takes a few extra steps:
1️⃣ Log in to vSphere Client. 2️⃣ Go to your cluster and copy its domain ID from the URL. Example:
domain-c1006
⚠️ Only use the domain-c<number>! Using the wrong ID can break vCenter.
3️⃣ In the vCenter Server, go to Configure → Advanced Settings → Edit Settings.
If you’re planning an upgrade to VMware vSphere 9.0 or just exploring which edition is the right fit for your organization, here’s a clear overview straight from the official vSphere 9.0 Product Line Comparison PDF.
In version 9.0, VMware shifts its focus:
The traditional vSphere Standard and vSphere Enterprise Plus editions are only available up to version 8 Update 3.
vSphere 9.0 capabilities are now exclusively packaged as part of VMware vSphere Foundation 9.0 and VMware Cloud Foundation 9.0.
This means new features and innovations, especially around Kubernetes integration, AI services, advanced storage architectures, and modern cloud operations, require the Foundation or Cloud Foundation bundles.
📊 Full Feature Comparison Table (Extracted and Formatted)
Below is a condensed and formatted table showing a selection of key features across the three product lines:
vSphere Standard → Ideal for small deployments with core virtualization needs.
vSphere Enterprise Plus → Full suite for automation, DRS, and powerful resource scheduling, but limited to version 8.
vSphere Foundation 9.0 → Next-gen features including Kubernetes, AI services, advanced storage architectures, compliance management, and tight integration with Cloud Foundation.
Modern IT teams are increasingly challenged to manage both traditional virtual machines (VMs) and modern Kubernetes workloads side-by-side. VMware Cloud Foundation 9.0 rises to this challenge by tightly integrating vSphere Supervisor, transforming your vSphere clusters into a robust hybrid platform for VMs and Kubernetes.
In this Hands-On Lab (HOL-2633-01-VCF-L), you’ll get guided, practical experience on how to unify VM and Kubernetes management using vSphere Supervisor, from foundational concepts to deploying real workloads.
📚 Lab Modules at a Glance
Module
Title
Duration
Level
1
What is the vSphere Supervisor?
15 min
Beginner
2
How does the vSphere Supervisor work?
30 min
Beginner
Let’s break down each module.
⚙️ Module 1: vSphere Supervisor Concepts and Components
✅ What is vSphere Supervisor?
vSphere Supervisor introduces a declarative Kubernetes control plane natively into your vSphere cluster. This means your cluster can now run:
VMs via the VM Service
Kubernetes Pods directly on ESXi hosts (as vSphere Pods)
Full upstream Kubernetes clusters using vSphere Kubernetes Service (VKS)
This hybrid model enables a consistent cloud-like experience for both traditional and modern workloads.
🔑 Key Components
vSphere Zone: Logical boundary to provide high availability. Clusters are mapped to Zones for resilience against failures.
vSphere Namespace: Think of it as a resource pool with policy-based limits (CPU, memory, storage) for workloads. It maps to Kubernetes namespaces but adds vSphere-specific governance.
Supervisor Networking: Uses either vSphere networking or NSX. Load balancers ensure external access for workloads.
Supervisor Storage: Utilizes storage policies to manage placement for VMs, Pods, persistent volumes, and container images.
🧩 Extensible Services
vSphere Supervisor comes with base services like:
VM Service
Kubernetes Service
Velero for backup
Additional services (like Grafana, Harbor, DNS, and vDPP) can be installed modularly to enhance the Supervisor’s capabilities.
🛠️ Module 2: Enabling and Configuring vSphere Supervisor
This module is all about getting your hands dirty — you’ll step through setting up vSphere Supervisor, deploying Namespaces, provisioning VMs and Kubernetes clusters, and expanding functionality with services.
⚡ Key Steps:
🔑 1️⃣ Prerequisites
Prepare clusters with vSAN or shared storage.
Define storage policies for control plane, VMs, Pods, and VKS clusters.
🔑 2️⃣ Enable vSphere Supervisor
Connect to the Management vCenter.
Create vSphere Zones for high availability.
Use the wizard to configure networking (NSX or vSphere stack), management network, and workload network.
Select control plane size and storage policy.
(Note: The lab walks through these steps but does not deploy a live Supervisor due to time constraints.)
🔑 3️⃣ Deploy & Configure a Namespace
Create a new Namespace and bind it to the Supervisor.
Assign VM Classes (defining VM sizing options).
Attach storage policies for workloads.
Create and associate a Content Library to provide VM templates.
🔑 4️⃣ Deploy Workloads
Deploy a VM using the VM Service and Consumption Interface.
Attach persistent storage and a Load Balancer.
Deploy a Kubernetes cluster (VKS) by specifying node pools and cluster config.
Validate external access via network service cards.
🔑 5️⃣ Add Services
Expand functionality by uploading YAMLs to register services like Grafana, Harbor, etc.
🎓 Summary
✔️ Unified Operations: Manage VMs and Kubernetes side-by-side in the same cluster with consistent policies. ✔️ Self-Service for DevOps: Namespaces, storage, and VM classes empower developers with agility. ✔️ Resilience and Scalability: Zones and Supervisor Services ensure HA and modularity.
If you’re ready to unlock the full power of VMware’s latest vSphere release, the HOL-2630-01-VCF-L hands-on lab is your perfect starting point. This lab provides a practical deep dive into the newest features, enhancements, and operational improvements in vSphere 9.0, all seamlessly integrated into VMware Cloud Foundation (VCF) 9.0.
In this walkthrough, I’ll break down what you’ll learn, module by module, to help you get the most out of your lab experience.
🗂️ Module 1: What’s New in vSphere 9 Overview
Kick things off with a comprehensive overview of what’s new in vSphere 9:
✅ Memory Tiering — Officially introduced, this feature allows NVMe devices to be used as tiered memory, expanding your host’s memory footprint while optimizing costs. ✅ Virtual Hardware Version 22 — Unlocks support for up to 960 logical processors, enhanced device support, and performance improvements for demanding workloads. ✅ VPC in vCenter — Create flexible Virtual Private Clouds and manage public/private networking seamlessly. ✅ Unified Licensing — Say goodbye to license keys — a new secure license file model simplifies lifecycle management. ✅ vSphere Configuration Profiles — The next-gen replacement for Host Profiles, offering cluster-wide desired state config at scale.
You’ll also experience the updated ESX Host Client UI, now with dark mode and deep customization options.
🔹 Staged Updates — Push update payloads to hosts before remediation to minimize maintenance downtime. 🔹 Parallel Remediation — Remediate multiple hosts simultaneously for faster patch cycles — perfect for large clusters. 🔹 Standalone Host Support — Manage isolated hosts via API or the new config profiles.
⚙️ Module 3: Resource Management — Enhanced DRS, vMMR, CPU Topology, and Latency
Efficiency meets performance:
✨ Enhanced DRS (Distributed Resource Scheduler) — Smarter load balancing with new automation levels and predictive DRS for proactive resource allocation. ✨ vMMR (vSphere Memory Monitoring & Remediation) — Gain granular insights into memory usage and performance impact. ✨ Simplified Virtual NUMA — New CPU topology tools simplify configuring vNUMA for VMs, improving latency for sensitive workloads.
🧩 Module 4: Guest OS and Workloads
Modern workloads, fully supported:
🔑 Virtual TPM (vTPM) Policies — Clone Windows 11 VMs securely by auto-replacing TPM devices. 📈 Virtual Hardware Upgrades — Upgrade clusters to the latest hardware version in bulk. 🔒 Device Virtualization Extensions — Expanded framework for vendors to build hardware-backed virtual devices with better live migration support.
🤝 Module 5: Mixed Vendor Clusters
In vSphere 9, clusters can mix hosts from multiple hardware vendors while still managing updates with cluster-based images. This makes infrastructure more flexible and vendor-agnostic.
🔄 Module 6: Live Patch
Zero downtime patching is here:
⏱️ Live Patch — Apply updates to ESXi hosts without reboots or maintenance mode. Improve security posture while keeping workloads running.
🧮 Module 7: Introduction to Memory Tiering
Dive deeper into Memory Tiering:
📚 Learn how to set up NVMe drives as cost-effective memory extensions, boosting capacity and lowering DRAM costs. 📊 See how this impacts workload density and CPU utilization.
🔑 Module 8: vSphere Licensing and Operations
Simplify your day-to-day management:
🗝️ Unified License Management — Use the VCF Business Services Console to license your entire Software Defined Data Center with a single license file. 📋 One Pane of Glass — Link vCenter instances for holistic operations and monitoring.
Ready to elevate your VMware Cloud Foundation (VCF) operations game? In the latest Hands-On Lab HOL-2610-03-VCF-L, you’ll get practical experience with all the new operational capabilities in VMware Cloud Foundation 9.0, learning how to monitor, secure, troubleshoot, and manage your private cloud infrastructure efficiently.
Below is a deep dive into each module so you know exactly what to expect.
📊 Module 1: Monitoring Private Cloud Infrastructure with Diagnostic Findings and VCF Health
Kick off by mastering the new Diagnostic Findings and VCF Health tools.
Diagnostic Findings offers real-time checks for security advisories (VMSAs), vulnerabilities (CVEs), and best practice deviations. It categorizes issues as Critical, Immediate, or Warning and includes easy links to relevant KB articles.
VCF Health gives you a clear, unified view of the entire environment—instances, vCenters, clusters, hosts, and NSX. You can quickly pinpoint trouble spots and drill down into domains and specific components.
Use powerful filters, historical findings, and export features to stay on top of the operational state of your cloud.
🔑 Takeaway: Get proactive issue detection and a health dashboard for streamlined troubleshooting.
🌐 Module 2: Monitoring Network Operations
The new Network Operations Dashboard integrates NSX and vSphere network monitoring right into VCF Operations—no more jumping between consoles!
View the network inventory at a glance: NSX Instances, Edge Clusters, Transport Nodes, and more.
Check out NSX Health, analyze business application flows, and dig into traffic patterns.
Use the interactive vSphere Network Inventory to see object relationships visually, expand views, and trace connections down to distributed virtual switches.
🔑 Takeaway: Gain deep insights into your network’s health, traffic, and relationships—all in one place.
🗄️ Module 3: Monitoring Storage Operations
Next, manage your storage like a pro:
The Storage Operations Dashboard centralizes monitoring for vSAN and non-vSAN datastores.
Analyze storage alerts, usage trends, capacity distribution, and performance.
Dive into vSAN Clusters to see detailed configurations, efficiency metrics, and IOPS data.
You’ll learn to filter by storage type, run diagnostics, and use dashboards to ensure healthy storage across the environment.
🔑 Takeaway: Proactively monitor and troubleshoot storage issues before they impact workloads.
🔒 Module 4: Monitoring Security Operations
Security is a top priority in VCF 9.0—and the new Security Operations Dashboard puts control at your fingertips:
User Security: Track authentication activity, failed logins, and permission changes with detailed dashboards.
Infrastructure Security: Review host encryption status, vSAN cluster encryption, advisories, certificate health, and VM encryption in one unified view.
Use intuitive widgets and drill-down dashboards to manage compliance and spot risks fast.
🔑 Takeaway: Unified, real-time visibility into user actions and infrastructure security helps you strengthen compliance and reduce vulnerabilities.
💸 Module 5: Chargeback and Billing
Finally, master cost transparency and control:
Explore the enhanced Chargeback and Billing capabilities integrated into the unified operations console.
Dashboards let you view chargeback summaries by organizations, projects, region quotas, and running workloads.
Generate and manage bills seamlessly, and preview tenant-facing billing interfaces for greater transparency.
🔑 Takeaway: Simplify financial operations and ensure tenants have clear insights into their cloud usage and costs.
✅Summary
VMware Cloud Foundation 9.0 Operations introduces robust, integrated monitoring and management tools designed to:
Unify health checks, diagnostics, and security monitoring
Provide actionable insights across infrastructure, network, storage, and user activity
Streamline chargeback and billing for clearer financial accountability