The Architect’s Edge: Decoding VMware Cloud Foundation 9.1.1 (and EP1) 👷☁

The release of VMware Cloud Foundation (VCF) 9.1.1—alongside its associated 9.1.1.0100 Express Patches (EP1)—just dropped. While it’s technically classified as a maintenance release with an updated Bill of Materials, any architect dismissing it as a mere patch is missing the bigger picture.

This release is heavily focused on Day-Two resilience, resolving architectural footprint bloat, and introducing critical network integrations. Let’s dig into the release notes and decode what this means for your fleet.

1. The “Right-Sized” Management Footprint 📈

When VCF Management Services (VCMS) were introduced in 9.1, they brought powerful centralized management but demanded a hefty resource tax. VCF 9.1.1 addresses this directly by right-sizing the footprint for initial Day-0 deployments.

• The Impact: A new “Small” (non-HA) deployment now requires one fewer VCMS worker node, saving 12 vCPU and 24 GB of memory in the management domain.
• Architectural Edge: VCF Installer now defaults to this “Small” size instead of Medium for new fleet deployments. If you are operating edge environments or constrained management clusters, this reclaims vital workload capacity.

2. Avi Load Balancer: TEP-less Networking & Active/Active EVPN 🌐

The most significant architectural shifts reside within the Avi Load Balancer integration:

• TEP-less Networking Support: Avi Service Engines can now operate in workload domains that have no overlay (Geneve) tunnel endpoints configured. You no longer need to provision an overlay network just to onboard VCF Automation; tenants can consume pure VLAN-backed subnets.
• Active/Active EVPN Route Controllers: EVPN route controllers in Distributed Transit Gateway topologies can now utilize an active/active design. Each active controller establishes an independent BGP session with your external EVPN gateways, drastically reducing convergence time during failure scenarios.

3. Operations & Lifecycle (The EP1 Factor) ⚙

VCF 9.1.1 transforms VCF Operations into a much stronger management control plane with automated remediation. The corresponding 9.1.1.0100 (EP1) patch releases specifically target the lifecycle components you rely on most: Fleet Lifecycle, SDDC Lifecycle, and the Migration Service Engine.

• Automated Secure Boot Key Remediation: Older Microsoft Secure Boot certificates are expiring. vCenter now identifies powered-on VMs with outdated NULL Platform Keys via an alarm, and ESX can silently update the key during a guest reboot (for VMs not using a vTPM).
• Break-Glass Account Alerting: VCF Operations now monitors the Avi Load Balancer secure channel certificate and issues proactive alerts prior to expiration. Furthermore, the break-glass (emergency local admin) account password lifecycle is natively tracked with configurable expiry policies.
• VMware Salt Integration: A new VMware Salt for VCF Components API has been introduced, providing a programmatic avenue to manage designated configuration settings across the VCF stack.

4. Deprecations to Watch 🛑

Knowing what is being removed is just as important as knowing what is new:

• Native Public Cloud Management: Native management of public cloud resources (AWS, Azure, GCP) within VM Apps organizations is now deprecated and disabled by default.
• Hardware Boot Mediums: Support is officially deprecated for USB and SD boot devices, as well as ESX hosts running without a persistent system storage device for the OSDATA partition.
• Syslog Ports: Unencrypted port 514 (UDP/TCP) is now blocked for syslog data transfers to vCenter. You must transition to port 1514 (TLS-encrypted).

---

🔗 Deep Dive Links for Your Architecture Notebook:

Want to read the source material? Bookmark these:

• VCF 9.1.1.0 Release Notes – Full feature breakdown.
• Patch Releases 9.1.1.x (EP1 Tracking) – Direct links to the Fleet and SDDC Lifecycle 9.1.1.0100 patches.
• VMware Avi Load Balancer for VCF 9.1.1 – Details on TEP-less and EVPN configurations.

Fellow architects: How are you planning to leverage the reclaimed Management Domain resources, or are you more excited about the TEP-less Avi Load Balancer support? Let’s discuss below! 👇

---

💬 Join the conversation: This edition of The Architect’s Edge was originally published on LinkedIn. Head over to the LinkedIn Pulse article to share your thoughts, ask questions, and connect with fellow architects!