I spent the weekend browsing the VMware Cloud Foundation 9.1 documentation. It is 9,091 pages, so I stuck to the Kubernetes sections (a few hundred pages, still more than enough for a weekend).. but if you are going to have an opinion on a competitor you should at least read what they actually ship, not what you remember from the Tanzu era.
What I wanted to know was simple. Forget the cluster. Does VCF 9 give you the platform you need to run Kubernetes properly.. observability, GitOps, alerting, security policy, admin and developer access, centralized AAA?
On paper, yes. Nearly all of it.
Metrics go from Telegraf to VCF Operations. Logs go through Fluent Bit. There is a Broadcom-built Argo CD operator. Security policy is OPA Gatekeeper with ten built-in templates and a policy insights API. Developer access is a CLI that writes your kubeconfig from vCenter SSO or any OIDC provider via Pinniped. Harbor is everywhere. Cost and chargeback down to the VKS node. I was genuinely impressed by the list.
Then I looked at where each piece actually lives.
The platform is split in two. The vCenter-direct pattern (what the design guide recommends for “foundational VKS enablement”) gets you a Supervisor, namespaces, SSO, a basic L4 load balancer, Pinniped, Fluent Bit and Telegraf. That’s it. The richer half.. the policy engine, the cluster observability APIs, automated VKS monitoring, project self-service, cost and chargeback.. is only documented through VCF Automation “All Apps” organizations. And All Apps requires NSX VPC. No exceptions in the doc.
So the “included” platform is really four products (vCenter, VCF Operations, VCF Automation, NSX) plus a set of Supervisor Services, and you only get the whole thing once you have committed to the whole stack. Even then, authorization is three models stacked on top of each other (vCenter object permissions, VCF Automation project roles, Kubernetes RBAC) and the mapping between them is left to you.
My honest take?? If you have already decided your future is vSphere everywhere, this is a very good answer and you should use it. If you have not, you are being asked to buy a networking fabric to get a policy engine, which is an odd trade for a Kubernetes platform.
Which half of that platform are you actually going to run?
Want to dive deeper? Read the VMware Cloud Foundation 9.1 documentation.