Part 9 of the 10-part VCF series. This technical reference manual covers automated lifecycle management, certificate rotation, security compliance, and backup strategies for keeping a VMware Cloud Foundation (VCF) 9.x platform operational.
Orchestrated Lifecycle Management (LCM)
The core operational advantage of VCF 9.x is unified platform patching managed by SDDC Manager. Instead of manually executing independent upgrades for hypervisors, network controllers, and storage engines, SDDC Manager validates and applies pre-sequenced update bundles. This enforces strict software interoperability limits automatically across the entire stack.
- vSphere Lifecycle Manager (vLCM) Integration: SDDC Manager utilizes vLCM cluster images to manage ESXi host baselines. A cluster image establishes a declarative state defining the ESXi version, specific vendor drivers, and hardware firmware.
- Rolling Remediation: During an update, SDDC Manager automates a rolling remediation process. Workloads are non-disruptively migrated via vMotion, the host enters maintenance mode, updates are applied, the host reboots, and it rejoins the active cluster pool.
- Depot Modes: In Connected Mode, SDDC Manager polls the Broadcom online depot directly to download software bundles. In Air-Gapped/Disconnected Mode, bundles are staged on a localized offline depot which SDDC Manager accesses internally.
Automated Certificate and Password Lifecycle
Manually updating secrets and cryptographic trust chains across private clouds introduces operational risk. VCF 9.x consolidates these functions directly into the central control engine.
- Certificate Tracking: SDDC Manager tracks the expiration boundaries of SSL/TLS certificates across vCenter Servers, NSX Managers, and underlying management appliances. It provides built-in, automated workflows to renew or rotate certificates through integrations with internal Active Directory Certificate Services (ADCS) or external Certificate Authorities (CAs).
- Password Rotation Workflows: SDDC Manager acts as a secure vault for administrative and internal service accounts across ESXi hosts, vCenter, and NSX. Passwords are automatically randomized upon deployment and rotated via configurable security policies to satisfy strict enterprise audit requirements.
Enterprise Telemetry, Logging, and Configuration Compliance
VCF 9.x combines monitoring instrumentation with configuration management to maintain estate health.
- Unified Monitoring: VCF Operations provides proactive health dashboards covering host status, vSAN storage thresholds, and logical network fabrics. Advanced ESXi health diagnostics categorize critical platform issues, track connectivity states, and alert on system faults.
- Centralized Log Aggregation: Log data streams continuously to VCF Operations for Logs. This integrated component ingests, indexes, and analyzes unstructured logs across the management and workload infrastructure domains.
- Configuration Drift Detection: Implemented natively within the control plane, administrators define an immutable host and cluster configuration baseline. The platform continuously checks for drift, such as altered NTP servers or modified syslog endpoints, alerting administrators for rapid remediation.
Control Plane Backup and Disaster Recovery
Workload virtual machines must be backed up using enterprise third-party solutions (e.g., Veeam, Cohesity, Dell PowerProtect) integrated at the storage or vCenter layer. However, VCF automates protection for its own management infrastructure.
SDDC Manager orchestrates native backup policies for the management control plane, including:
- SDDC Manager database file backups.
- vCenter Server file-based backups (FTP/SFTP/HTTP targets).
- NSX Manager cluster configuration backups.
Administrators must verify successful control plane backup states immediately prior to initializing any automated software lifecycle upgrade.
Licensing Governance
Licensing compliance is maintained via internal tracking protocols:
- Connected Mode: The platform automatically syncs with the Broadcom Business Services Console every 24 hours to transmit telemetry and download updated license entitlements without manual intervention.
- Disconnected Mode: License tracking is managed manually by importing entitlement files straight into SDDC Manager. New greenfield instances provide a standard 90-day evaluation window to finalize license deployments.
Next in Part 10, we conclude the series by analyzing the VCF Installer and stepping through the end-to-end deployment workflows required to stand up a VCF 9.1 private cloud from bare metal.