Kubernetes Without the Chaos: Running Containers on VCF with VKS

Kubernetes promises faster delivery and more portable applications. In practice, many organizations end up with clusters scattered across clouds, a skills gap on the infrastructure team, and day-2 operations they didn’t plan for.

If you run VMware Cloud Foundation (VCF), you already own a better path: vSphere Kubernetes Service (VKS), the Kubernetes runtime built into the platform. It lets you run containers alongside VMs, on infrastructure your team already knows.

In this post, we cover the VKS challenges we see most often, how we solve them, and what that looks like in real ClearBridge engagements.

What VKS brings to VCF

VKS (formerly the Tanzu Kubernetes Grid Service) is the CNCF-certified Kubernetes runtime built into VCF, included with the platform at no extra cost. It runs on the vSphere Supervisor, which turns ESX clusters into a Kubernetes-aware control plane so VMs and containers are managed side by side.

For platform teams, that means:

• Self-service clusters: developers declare the cluster they need (size, node pools, storage, networking) and VKS provisions, scales, and upgrades it.
• Familiar operations: vSphere Namespaces map to resource pools, so infrastructure teams govern Kubernetes with the tools they already know.
• Integrated services: load balancing through Avi, lateral security through the distributed firewall, persistent storage through vSAN, plus Broadcom-validated add-ons for certificates, monitoring, backup, and more.
• Fleet management: VKS Cluster Management in VCF 9.x provisions and governs clusters across the environment without a separate management plane.
• Current Kubernetes: Broadcom typically ships new Kubernetes versions within about two months of upstream, and VKS 3.7 supports Kubernetes 1.36.

Common VKS challenges and how we solve them

1. The Kubernetes skills gap

The challenge: Infrastructure teams know vSphere inside out, but Supervisor setup, namespaces, storage policies, and cluster networking are new territory. Without hands-on experience, early projects stall.

The solution: We build VKS on the vSphere constructs your team already understands, then teach as we go. Every engagement ends with documentation and knowledge transfer, so your team can run the platform on day two without us.

2. Inconsistent clusters and Kubernetes sprawl

The challenge: Different teams spin up clusters different ways, some on-premises and some in the public cloud. The result is drift, duplicated effort, and clusters nobody fully owns.

The solution: We standardize cluster definitions and govern them centrally with VKS Cluster Management. Everything is defined as code with Terraform, Ansible, and Git, so every cluster is built the same way and every change is tracked.

3. Day-2 operations are harder than day one

The challenge: Deploying a cluster is the easy part. Upgrades, add-on management, certificates, monitoring, and backups are where Kubernetes’ hidden costs live.

The solution: We put GitOps tooling such as Argo CD at the center of operations and use Broadcom’s validated VKS add-ons for common services. Upgrades and changes become repeatable, reviewable commits instead of late-night manual work.

4. Networking and ingress get in the way

The challenge: Load balancers, ingress controllers, and IP management are often the slowest part of getting an app live, especially when every request needs a network ticket.

The solution: With Avi integrated into VCF, VKS automatically deploys the Avi Kubernetes Operator, so developers get load balancing, WAF and ingress inside their normal Kubernetes workflow. NSX VPC networking keeps each team’s environment isolated.

5. Securing containers like everything else

The challenge: Security teams have spent years hardening VM environments, and containers can feel like a blind spot with their own tools and rules.

The solution: In VCF 9.1, distributed firewall and threat prevention policies cover VKS workloads as well as VMs. We design one consistent security model across both, aligned with your compliance requirements.

6. Proving value before committing

The challenge: Leadership wants evidence that Kubernetes on VCF will work for their applications before funding a full rollout.

The solution: Our VKS Proof of Concept runs over four to six weeks. We deploy VKS, validate networking and storage integration, run a real or sample app across up to three clusters, and introduce your team to GitOps and CI/CD pipelines along the way.

VKS in action: ClearBridge case studies

Accelerating cloud-native modernization with VKS on VCF

A client needed a production-ready Kubernetes platform inside its existing VCF environment, without abandoning its vSphere, NSX, and vSAN investments. Our Senior VKS Consultant designed and deployed VKS across the environment, integrated it with the existing stack, and automated deployments with Ansible, Terraform and Git. The result was a scalable, repeatable platform for expanding containerized workloads. Read the case study

Moving VMware management from click-ops to GitOps

This client already ran GitOps in the public cloud, but its VMware environment still depended on manual, GUI-driven changes. A ClearBridge VMware GitOps Architect introduced infrastructure as code, Git-based version control, and automated deployment workflows. The client gained more consistent deployments, less configuration drift, and one operating model across private and public cloud. Read the case study

Keeping a mission-critical Kubernetes platform resilient

In a highly secure environment, a client needed to keep its Kubernetes platform reliable while increasing automation. Our Senior Site Reliability Engineer automated provisioning and deployments with Terraform and Argo CD and strengthened CI/CD practices. The client reduced manual work and improved availability for mission-critical workloads. Read the case study

Modernizing Kubernetes in a classified environment

A client needed a TS/SCI-cleared engineer to modernize its Kubernetes platform over a long-term engagement. Our consultant automated infrastructure, optimized CI/CD pipelines, and improved observability, minimizing onboarding time while meeting classified security standards. Read the case study

How ClearBridge helps

The easiest way to see VKS working in your environment is our VKS Proof of Concept. Over four to six weeks, delivered remotely, a ClearBridge architect:

1. Plans and deploys VKS, including networking, certificates, load balancing and storage
2. Validates integration with vSphere and runs your application, or a sample app, across up to three clusters
3. Introduces your team to GitOps with Argo CD or Flux, and to CI/CD pipelines that deploy straight into Kubernetes
4. Closes with documentation, lessons learned, and recommendations for your business use case

From there, we can scope a production rollout, including multi-site designs and regulated environments. Our work is backed by a team that includes Broadcom Knights and cleared engineers experienced in mission-critical platforms.

Ready to run Kubernetes on the platform you already own? Contact us to schedule a VKS Proof of Concept.