Introduction

Today we are hitting on a key shift in how vSphere Administrators can interact with and empower developers (DevOps). Let’s expand on this and why VMware Tanzu Kubernetes Grid (TKG) is a compelling solution.

The Traditional vSphere Admin/Developer Workflow (and its Pain Points):

The traditional model often involves a ticketing system. Developers need resources (VMs, storage, networking) and file a request. The vSphere admin then has to manually provision these resources. This leads to:

• Slow Turnaround: Delays in provisioning can slow down development cycles.
• Administrative Overhead: Managing individual requests is time-consuming for the vSphere admin.
• Lack of Agility: Developers lack the ability to quickly experiment and iterate.
• Configuration Drift: Manual configuration can lead to inconsistencies and errors.

Kubernetes and Tanzu Kubernetes Grid (TKG) as a Solution:

Kubernetes, and specifically TKG, offer a different paradigm. They provide a self-service model for developers, while still giving the vSphere admin control and visibility.

Why TKG?

• Consistent Kubernetes: TKG delivers a consistent, conformant Kubernetes experience across vSphere environments (and even on public clouds). This means developers can use the same tools and workflows regardless of where their applications are deployed.
• Integrated with vSphere: TKG is deeply integrated with vSphere. This allows you to leverage your existing vSphere infrastructure (compute, storage, networking) and management tools. You’re not replacing vSphere; you’re enhancing it.
• Centralized Management: While developers gain self-service capabilities, you retain centralized control over the Kubernetes clusters. You can set resource quotas, limits, and security policies to ensure compliance and prevent resource abuse.
• Simplified Operations: TKG simplifies the deployment and management of Kubernetes clusters. It automates many of the tasks that would otherwise be manual, reducing your operational overhead.
• Developer Self-Service: Developers can use kubectl and YAML files to define their infrastructure needs (as you mentioned). They can request and provision resources on demand, without having to go through a ticketing system.

Why is this Interesting for the vSphere Administrator?

• Reduced Ticket Volume: By empowering developers with self-service capabilities, you can significantly reduce the number of resource requests you have to handle.
• Increased Efficiency: You can focus on higher-level tasks, such as capacity planning, security, and infrastructure optimization.
• Improved Developer Satisfaction: Developers are happier because they can get the resources they need quickly and easily.
• Modernization of Your Skillset: Managing Kubernetes environments is a valuable skill in today’s IT landscape. TKG provides a way for you to expand your expertise and stay relevant.
• Strategic Role: You become an enabler of innovation, rather than a bottleneck. You can help your organization adopt modern application development practices and accelerate its digital transformation.

In short, TKG allows you to provide a “paved road” for developers to consume infrastructure resources while maintaining governance and control. It’s a win-win for both developers and vSphere administrators.

Elephent in the Room ( Permissions and empowerment)

The conflict between platform stability and developer autonomy is more apparent than ever in today’s cloud-native environment. Businesses that move to shared Tanzu Application Platform (TAP) and Tanzu Kubernetes Grid (TKG) environments must strike a careful balance between giving developers the self-service tools they require and avoiding resource sprawl, which can throw operations and budgets off course.

An exciting path towards containerised microservices can easily turn into the “wild west” of Kubernetes resources, where storage volumes remain long after their usefulness has gone, namespaces proliferate unchecked, and CPU and memory requirements far outweigh real needs.

The ramifications are more than just hypothetical. Uncontrolled resource usage results in rapidly increasing cloud expenses, deteriorated performance for important workloads, and possible outages when platform limitations are suddenly reached.

However, tight limitations are also not the solution. Developers eventually find workarounds or, worse, give up on platform adoption completely when they encounter too much bureaucracy when allocating resources. When teams are unable to iterate rapidly, the very efficiencies Tanzu promised vanish.

Let’s discuss a problem that every DevOps team encounters: how can you allow developers the latitude they require on a shared Tanzu platform without allowing resource utilisation to get out of hand? Working with platform teams and following industry best practices, we have found governance strategies that preserve this important equilibrium. The following is a useful guide for setting up rules that safeguard your environment while maintaining the developer experience that first makes Tanzu worthwhile.

Resource Management – The Foundation

Namespaces are essential. Namespaces are the cornerstone of resource management in Kubernetes (and hence Tanzu). Every project or team ought to have its own namespace. This gives you solitude and lets you set limitations and quotas on your own.

Resource quotas limit how much memory, CPU, persistent storage, and other resources can be used in a namespace overall. Establish quotas that avoid excessive consumption while yet satisfying the team’s or project’s acceptable needs. For instance:

Namespace isolation is essential, not optional. Create dedicated namespaces for each team or project to establish clean boundaries for applying controls and maintaining accountability.

Resource quotas should be tailored to each team’s actual workflow patterns:

yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: dev-quota
  namespace: dev-team-a
spec:
  hard:
    cpu: "4"
    memory: "8Gi"
    pods: "20"
    persistentvolumeclaims: "5"
    services: "10"
    configmaps: "30"
    secrets: "30"

Limit Ranges: These specify the standard resource requests and restrictions that containers in a namespace are subject to. Additionally, they stop users from building deployments or pods without defining resource needs or restrictions. This guarantees that the resource boundaries of each container are clearly defined. For instance:

Implement granular limit ranges that prevent resource hogging while still accommodating legitimate workload spikes:

yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: limits-dev
  namespace: dev-team-a
spec:
  limits:
  - default:
      cpu: 500m
      memory: 256Mi
    defaultRequest:
      cpu: 250m
      memory: 128Mi
    max:
      cpu: "2"
      memory: "2Gi"
    min:
      cpu: 50m
      memory: 64Mi
    type: Container

Beyond Resources – Security Boundaries

Network policies should be designed as a comprehensive mesh. Start with a default-deny policy, then explicitly allow only required communication paths between namespaces and external services.

For Pod Security, embrace the shift to Pod Security Admission with customized profiles that match your security posture. Consider implementing:

• Development namespaces: Baseline with select exceptions
• Staging environments: Restricted with limited exceptions
• Production: Fully restricted profiles with no exceptions

Network Policy:
Control Communication: Network traffic between pods and namespaces is restricted by network policies. This can lessen the effect of a compromised or misbehaving application and is essential for security. You may, for instance, limit communication between the production and development namespaces.

Pod Security Policies:

Although they are no longer in use, it’s nevertheless crucial to comprehend the idea for shifting.

Security Contexts: Although Pod Security Admission has replaced Pod Security Policies, the fundamental ideas are still applicable. To limit what a container can do, you can set security contexts (e.g., executing as root, accessing host filesystems). These days, Pod Security Admission is used to handle them.
PSPs have been replaced by Pod Security Admission (PSA). Various security profile levels (Privilege, Baseline, and Restricted) are defined by PSA that you can

These are now managed through Pod Security Admission.  

• Pod Security Admission (PSA): This is the replacement for PSPs. PSA defines different levels of security profiles (Privileged, Baseline, Restricted) that you can apply to namespaces. This is a more declarative and easier-to-manage way to enforce pod security.  

Image Registries and Scanning:

• Approved Images Only: Use a private image registry and only allow developers to deploy images that have been scanned for vulnerabilities and approved. This prevents the introduction of malicious or insecure software into the cluster.
• Image Scanning: Integrate image scanning into your CI/CD pipeline. Reject images that fail the scan.

Monitoring and Alerting:

• Real-time Visibility: Set up monitoring and alerting to track resource usage. Alert on namespaces that are approaching or exceeding their quotas. Tools like Prometheus and Grafana are excellent for this.
• Cost Monitoring: If you’re using a cloud provider, use their cost monitoring tools to track spending by namespace or project.

Automation and GitOps:

• Infrastructure as Code (IaC): Manage your Kubernetes resources (quotas, limits, network policies) as code using tools like Terraform or Flux. This allows you to version control your configurations and automate their deployment.  
• GitOps: Use Git as the source of truth for your Kubernetes configurations. Changes are made through pull requests, reviewed, and then automatically deployed. This provides an audit trail and helps to prevent unauthorized changes.  

Developer Training and Guidelines:

• Education is Key: Train developers on Kubernetes best practices, resource management, and the importance of adhering to quotas and limits.
• Clear Guidelines: Establish clear guidelines for resource usage and application deployment. Make sure developers understand the consequences of over-provisioning.

Tiered Access Control (RBAC):

• Principle of Least Privilege: Grant developers only the permissions they need to do their jobs. Avoid giving them cluster-admin privileges. Use RBAC to define roles and assign them to users or groups.

Example RBAC Setup (Simplified):

• dev-role: Allows developers to create, update, and delete resources within their assigned namespace, but restricts them from creating namespaces or managing cluster-wide resources.
• dev-team-a group: Developers in this group are assigned the dev-role for the dev-team-a namespace.

Practical Controls

Image governance should be proactive. Implement Kyverno or OPA Gatekeeper policies that automatically reject images:

• From unapproved registries
• With critical CVEs
• Without proper labeling
• Lacking resource specifications

Enhance your monitoring with predictive analytics. Track resource consumption trends over time to identify potential issues before they become problems. Set up multi-level alerts (warning at 70%, critical at 90%) with automatic notifications to both DevOps, development teams, and the management team for awareness.

Process Matters

Evolve beyond basic GitOps to policy-as-code. Define organizational standards as enforceable policies that automatically validate changes against best practices. This creates guardrails that prevent problematic configurations from being applied.

Develop a comprehensive education program that includes:

• Hands-on workshops for resource optimization
• Peer review sessions for deployment configurations
• Case studies from actual production incidents
• Recognition for teams demonstrating resource efficiency

Tiered Access Model

Implement a sophisticated RBAC structure with contextual permissions:

• Namespace-specific developer roles with granular permissions
• Time-bound elevated access for debugging and deployments
• Audit-focused roles for compliance and security teams
• Pipeline service accounts with scoped permissions

For larger organizations, consider namespace federation where teams can request resources through a self-service portal with built-in governance checks.

Remember that effective governance requires continuous refinement based on actual usage patterns and feedback. The most successful Tanzu environments balance controls with developer agility through data-driven policies and transparent processes.

Conclusion

In summary, the adoption of DevOps and microservices demands a fundamental transformation in our approach to infrastructure management. The dynamic and fluid nature of morden application development is simply too much for the ticket-based, traditional method of a decade ago. We now orchestrate sophisticated microservices deployments that need scalability and rapid iteration, rather than deploying monolithic applications on static infrastructure. Encouraging DevOps engineers is now a need for businesses to stay competitive, not just a “nice-to-have.” The provision of self-service infrastructure access, in conjunction with strong governance and control, is essential to this empowerment. The platform to close this gap is offered by tools like VMware Tanzu Kubernetes Grid (TKG), which empowers vSphere administrators to act as innovators rather than gatekeepers. Through the use of Kubernetes and an infrastructure-as-code methodology, We can simplify processes, cut down on administrative burdens, and allow developers to concentrate on creating and implementing applications—what they do best. In addition to increasing developer satisfaction and speeding up time-to-market, this change enables vSphere administrators to update their skill set and take on a more strategic role in the digital transformation of their company. Automation, self-service, and cooperation between development and operations teams are key components of the future of IT. In the era of microservices, embracing these changes is essential to maximising DevOps’ potential and achieving business success.

Sources:

https://blogs.vmware.com/vsphere/2020/03/vsphere-7-tanzu-kubernetes-clusters.html

Whats new in vSphere 7 U1 and VCF 4 Introducing the vSphere with Tanzu Grid the fastest way to provision the Morden application. Deliver Developer ready Infrastructure.

You will be leveraging the existing infrastructure to build your modern datacenter using the Kubernetes to enable and empower your developers this is the fastest way you can achieve this. The vSphere will be leverating your vDS virtual distributed switch for all the networking needs as we will not have NSX -T few of the component that are depended on it will be removed. We will need a load balancer which is why VMware has introduced HA Proxy which can do the job for it.

Check out the video presentation on vSphere 7 U1

These are some of the new features and enhancements that has been introduced in vSphere 7 U1

EVC on GPU

vSphere 7 U1 max host per cluster increase to 96 ESXi Host

Max VM’s per cluster 10,000

Max VM CPU 768

Max VM Memory 24 TB

Max CPU per host 768

Max Host Memory 24 TB

New feedback and voting tab for new features.

vLCM and NSX T- integration

Simplified Deployment

Hi All,

As you may know, I attended VMworld, it was quite a different experience this year, as I became a vExpert 2019. I had an opportunity to see and meet a lot of folks in the vCommunity. I remember last year when I was in VMworld, I was discussing getting my home lab setup and I remember Ather suggested that, I can start blogging again using my home lab.

A year forward I managed to Make Your My Mark and became a VMware vExpert 2019.

If you don’t know what is vExpert Program is about?

vExpert 2019 is an award given VMware evangelist, advocates. The program is designed to put VMware’s marketing resources towards your advocacy efforts, who has displayed going above and beyond with their use of the data. It forms part of their global evangelism and advocacy program.

I applied for the award after I was recommended by other vExperts – having seen the work done with my blog agileops.co.uk and his YouTube channel, if you haven’t seen it, check them out! And don’t forget to subscribe .

By the way, the program does have a lot of perks and it opens applications twice every year. in December and July. So if you are ready to Make Your Mark give it a go and you never know, you might become a vExpert 2020 https://vexpert.vmware.com/

vExpert Program Benefits

• Invite to our private #Slack channel
• vExpert certificate signed by our CEO Pat Gelsinger.
• Private forums on communities.vmware.com.
• Permission to use the vExpert logo on cards, website, etc for one year
• Access to a private directory for networking, etc.
• Exclusive gifts from various VMware partners.
• Private webinars with VMware partners as well as NFRs.
• Access to private betas (subject to admission by beta teams).
• 365-day eval licenses for most products for home lab / cloud providers.
• Private pre-launch briefings via our blogger briefing pre-VMworld (subject to admission by product teams)
• Blogger early access program for vSphere and some other products.
• Featured in a public vExpert online directory.
• Access to vetted VMware & Virtualization content for your social channels.
• Yearly vExpert parties at both VMworld US and VMworld Europe events.
• Identification as a vExpert at both VMworld US and VMworld EU.

So, what are you waiting for the applications for the vExpert 2020 program are now open, apply at https://vexpert.vmware.com/apply.

Don’t miss vForum on 12th December

If you have missed the VMworld this year you still have time to register for vForum which is this week on 12 December. This is a great opportunity to catch up, click here and registers vForum
vForum Online is VMware’s largest virtual event for IT professionals, is back with a post-VMworld update! Join the online event to hear about exclusive announcements from VMworld 2019 Europe regarding top solutions: disruptive technologies at the core of the digital foundation.

and guess what you can Register today and WIN A TICKET TO VMWORLD 2020! who knows you might just get lucky and win a trip to VMworld Europe 2020

vForum Online comes to you live, online, and direct to your desktop or laptop. With travel not required, there’s no reason not to attend!

Check out our exciting agenda below:

• Keynote:Tech in the Age of Any
  Joe Baguley, Chief Technology Officer EMEA, VMware
• Cloud Session:Accelerate Your Cloud Journey
  Rory Choudhuri, EMEA Solutions Product Marketing Director, VMware
• Modern Apps Session:VMware Tanzu and Your Kubernetes Journey
  Ed Hoppitt, Director of Modern Apps and Cloud Native Platforms EMEA, VMware
• Networking and Security 2.0 Session:What we said at VMworld 2019
  Garry Owen, EMEA Senior Solutions Product Marketing Manager, VMware
• Digital Workspace Session:Why We Need to Put the Employee Experience First Today
  Spencer Pitts, Chief Technologist EMEA, VMware
• Live Q&A Session

Lets discuss some of the important highlights of VMworld 2019 according to me:

Tanzu Mission Control

VMware Tanzu is Vmware’s modern application solution. fundamentally this about trying all the new products VMware has recently acquired and integrate it under one umbrella under Build, Run and Manage.

in simple term, this will simplify the life of VMware Admin’s as they no longer need to struggle to find which VM’s makes an application. it will be all group which will make life simple for troubleshooting too.

Vmware Tanzu is delivered in a way that allows any organization to adopt container and Kubernetes related technology incrementally.

 Tanzu supports scenarios from we are getting started with contemnors to we are running Kubernetes in production but are struggling to scale up.

Project Pacific – K8s on vSphere

Personally I think this is going to disrupt everything the big announcement at VMworld about, Project Pacific which is fundamentally re-architected vSphere with native Kubernetes to change the game when it comes to building and running modern applications.

DevOps get self-service resources from their cloud and Virtual administrators get to manage logical workloads as a group rather than the VMs that make them up.

There is a lot of information about Project Pacific here is a short video from Joe Beda, Principal Engineer for Cloud-Native Apps at VMware, answers all things Kubernetes and what customers can expect to gain from new technologies like Project Pacific and Tanzu Mission Control.

Azure VMware Solution by CloudSimple

Azure VMware Solution by CloudSimple is a fully managed service that allows you to run the VMware platform in Azure.

This solution includes vSphere, vCenter, vSAN, NSX-T, etc.

This was announced at VMworld this year too. I think this is really great news that we can run VMware Workload natively on Azure. of course the service is only offered by CloudSimple, however, I think its a great move by VMware to get the customers from Azure. I am sure we will be seeing more of similar services coming forward in the future.

Some important points to remember are:
Service offered by CloudSimple
Get scale, automation and fast provisioning for your VMware workloads on global Azure infrastructure.
Keep using your existing VMware investments, skills and tools, including VMware vSphere, vSAN, vCenter and all other providers’ tools
Modernise your VMware workloads by integrating with native Azure services such as Azure Active Directory, AI and Analytics.
Take advantage of unmatched Azure pricing and benefits for Windows Server and SQL Server.

Some of the advantages are: Stay on native VMware technologies without rearchitecting your environment when you move or extend your VMware workloads to Azure.
Get integrated management of Azure and VMware resources, and manage your cloud and on-premises applications the same way.
Modernise existing applications and build new ones by tapping into the massive Azure ecosystem of products and services.
Take advantage of unmatched Azure pricing and benefits for Windows Server and SQL Server.

VMware Cloud On Dell EMC

VMC on Dell EMC VMware Cloud on Dell EMC is actually Data Center As a Service which brings best of both world public cloud in private datacenter.

I think this is a great offering from VMware where you have restrictions from putting the data on public cloud partners or customers can use this.
This is similar to VMware on AWS, however, in this instance, it’s hosted on a private data centre.

currently, this offering is only available in the USA with an aim to roll out to Europe in the next year.

The benefits we get by using this VMware offering is we get the full solution managed and maintained by VMware support with 365/24 hours with 4 hours response time. VMware takes care of operating the infrastructure: deploying it., troubleshooting issues; and performing patching, upgrading and maintenance. This frees you and your experts to work on what matters the most and focus on your product.

This runs on vXRail hardware with full SDDC solution, however, in this instance VMware keeps the access for the VMware Cloud Foundation and give the customer a different portal to manage and run the environment.

What we have in this HCI solution is full SDDC stack running on vSphere hypervisor and vSAN, with the cutting edge security offered by NSX-T.
This gives us more time to focus on something else other than just managing and maintaining the VMware infrastructure.

Other benefits include:
Increase agility
simplified operation
Accelerated Innovation
Mitigated Risk
Controlled cost
Increased performance

Don’t forget to check out my short video on VMware Cloud on Dell EMC.

VMware Hands-ON Labs Command Center

I managed to find some time to do a lab on vRNI which was designed by one of my friend Atif @ VMware, this was one of the lightning labs which are designed for 30 minutes sessions.

On my last day at VMworld I had an opportunity to understand from one of the experts, how the VMware Learning Platform leverages different types of cloud private and public to spin up the labs on demand?

As mentioned the HOL is running on a mix of private and public cloud, we can see the true potential of vRelize Operations Manager, monitoring all the different cloud. IBM Cloud, AWS and VMware private hosted data centre, have a look at a short video where I tried to explain it.

Raspberry Pi ESXi on ARM

Not sure if you have missed my post about the Pi,

In solution Exchange one of the busy booth was ARM showcasing ESXi running on Raspberry Pi.

Use Cases:

1.Use case was running FT VM on Pi on remote or branch office.This can boot from iSCSI back storage

2. vSAN cluster witness site. Good enough for a lab environment I guess not for any production setup.

here is a short video of the ARM booth as they had quite a few demos running during that time.

So get ready to make your mark in 2020 and good luck.

References:

https://searchvmware.techtarget.com/feature/Whats-new-with-VMware-Cloud-on-AWS
https://blogs.vmware.com/vsphere/2019/04/announcing-vmware-cloud-on-dell-emc.html#respond
Image: https://blogs.vmware.com/vsphere/files/2019/04/introducing-vmc-on-dell-emc.png
https://azure.microsoft.com/en-gb/overview/azure-vmware/

https://docs.microsoft.com/en-us/azure/vmware-cloudsimple/cloudsimple-vmware-solutions-overview

Azure and CloudSimple

Image: https://docs.microsoft.com/en-us/azure/vmware-cloudsimple/media/azure-vmware-solution-by-cloudsimple.png

vExpert

https://vexpert.vmware.com/

vFourom

https://onlinexperiences.com/scripts/Server.nxp?LASCmd=AI:4;F:QS!10100&ShowUUID=25147DFB-BFB6-4000-8A9E-17D2D3795DB0&AffiliateData=OS