VCF 9.1: An Architect's Field Guide to the Design Changes That Matter

When a new VCF release lands, my first read isn’t the announcement blog. It’s the what’s-new section of the release notes, line by line, with a notepad open. I want to know which lines will appear in customer HLDs over the next six months, and which won’t.

VCF 9.1 has more lines that matter than I expected.

There are the obvious headline numbers up to 40% TCO drop from Memory Tiering, up to 39% storage TCO drop from vSAN ESA dedup, 500 Kubernetes clusters per Supervisor. But more interesting are the changes that quietly remove constraints from architecture decisions: ESX Live Patching that takes “N+x for patch evacuations” out of the BoM, EVPN-VXLAN interop that collapses the NSX/underlay seam, Namespace Capture that turns Day-2 reproducibility from a tribal-knowledge exercise into a Git workflow.

This is an attempt to read VCF 9.1 the way I’d read it for a client design review. Eight themes, grouped not by feature list but by what they change in the design conversation. If you’re an architect, a platform engineer, or someone owning a VCF estate, these are the lines worth marking.

1. Infrastructure efficiency the sizing model changes

Three updates land directly on the infrastructure economics conversation.

Memory Tiering is the most interesting change to ESXi host sizing in years. The model is straightforward: ESXi now manages two memory tiers per host DRAM as tier 0, local NVMe as tier 1 with page-temperature tracking and automatic migration. What’s new in 9.1 is native software mirroring within the NVMe tier, which means redundancy without hardware-mirrored DIMMs. That single change moves the host BoM toward less DRAM and more NVMe per socket. Up to 40% TCO reduction is the marketing line; the actual story for architects is that your DRAM:NVMe ratio is now a sizing input you have to defend in design reviews.

vSAN ESA inline deduplication and compression in 9.1 extends across more cluster types and workload profiles, with dedup now operating on data-at-rest encrypted volumes. The architectural impact: re-baseline your raw-to-logical TB ratio in capacity planning. Previous sizing models assumed dedup didn’t apply to encrypted volumes that’s no longer true. Customers will see up to 39% lower storage TCO, but the design implication is that workload profiles previously excluded from dedup can now be consolidated into the same fault domain.

NFS v3 and v4.1 datastores now support up to 256 hosts per datastore. That sounds incremental, but if you’ve built clusters around the previous host-count cap, your fault domain design has more flexibility than it did. Multi-datastore architectures that existed purely to work around the cap can collapse into single-datastore designs. Fewer mount points, fewer policy attachments, less drift surface in operational topology.

Read across these three, the pattern is the same: VCF 9.1 lowers infrastructure TCO without requiring new hardware. The customer keeps buying the same servers; you just size them differently.

2. AI as a first-class virtualised workload

AI on VCF has historically required architectural concessions. You’d dedicate hosts to GPU workloads with passthrough, drop vMotion as a capability, and run AI clusters on a parallel design pattern from your general-purpose compute estate. VCF 9.1 closes that gap.

Enhanced DirectPath I/O now supports NVIDIA ConnectX-7 and BlueField-3 adapters, with direct GPU-to-GPU communication via RDMA over Converged Ethernet (RoCE). The critical part for design: virtualisation features stay on the table. vSphere vMotion, Storage vMotion, ESX Live Patch, Hot-Add/Remove all work with passthrough devices. AI clusters can now participate in normal evacuation flows during host maintenance instead of being carved out as exception zones.

AMD vIOMMU support lands in ESX 9.1. For environments running Intel-only host fleets because passthrough wasn’t supported on AMD, that constraint is gone. Mixed Intel/AMD fleets are viable in the same VCF instance for passthrough workloads, which makes silicon-economics decisions (where AMD often wins on core count and watts) independent of passthrough-capability.

Private AI and Sovereign Cloud capabilities in 9.1 integrate data residency controls and TPM-backed security at the platform level. For regulated industries financial services, government, healthcare where public-cloud AI services are non-starters for compliance reasons, this is the architectural completion of an on-prem AI story. Data, models, and inference stay inside the customer’s compliance boundary, attested via hardware roots of trust.

The result for AI design: VCF 9.1 makes “AI without leaving the data centre” a credible architecture, not a marketing line.

3. Kubernetes at platform scale

VKS 3.6 in VCF 9.1 changes the Kubernetes design ceiling. Up to 500 clusters per Supervisor control plane, up to 70% faster cluster provisioning, multi-vNIC nodes that separate application, storage, and management traffic at the K8s node level, and VM Service Linked Clones for sub-second VM provisioning. This is the scale where K8s on VCF stops being an exception pattern and becomes a real platform topology.

Namespace Capture is the quiet game-changer here. The full state of a live namespace configuration, policies, resource definitions, network and storage bindings serialises into a single YAML blueprint. You then redeploy it anywhere with parity. Combined with Namespace Self-Service for tenant onboarding, the operational model shifts: Day-2 reproducibility becomes a Git-managed workflow instead of undocumented operator skill.

For platform engineering teams running modern and traditional workloads on a unified platform, this is the inflection point.

4. Patch cycles stop being the architecture constraint

Patch overhead has historically been baked into design assumptions: N+x cluster capacity for evacuations, elaborate change windows for vCenter patching, PXE/TFTP scaffolding for new host onboarding. VCF 9.1 takes most of that out.

vCenter Quick Patch updates only the RPMs or binaries actually modified in the patch payload. Downtime drops to under 1 minute, sometimes zero. The implication for CVE remediation SLAs is direct: patch windows are no longer the binding constraint on response time.

ESX Live Patching, expanded in 9.1 for TPM-enabled hosts, removes host evacuation from the workflow. Spare cluster capacity reserved purely for patch evacuations can come out of the BoM. Fault domain design no longer needs “N+x for patching” as a separate sizing input.

Zero Touch Provisioning (ZTP) delivers ESX install over UEFI + HTTPS no PXE, no TFTP, no DHCP gymnastics. Combined with vSphere Elastic Provisioning, hosts are auto-discovered, imaged in parallel, and assigned consistent configuration from a single HTTPS URL. For data centres scaling capacity or repurposing hardware regularly, Day-0 onboarding lead times drop materially.

Combined, these three move VCF operations away from elaborate patch-cycle choreography and toward a model where security teams can run remediation against actual CVE timelines.

5. Sovereign cyber recovery, architecturally complete

For organisations where public-cloud recovery is a non-starter on compliance or sovereignty grounds, VCF 9.1 closes a long-standing architectural gap.

vSAN Protection and Recovery in 9.1 stops being a single-source replication tool and becomes a heterogeneous protection topology. Multi-source replication accepts vSAN, VMFS, and NFS sources into a vSAN ESA target. Fan-in architecture lets multiple source clusters point to a single centralised recovery site. Tiered Grandfather-Father-Son snapshot retention replaces simple FIFO. Manual Seeding lets you physically ship initial data to the target and run a differential sync a real design option for petabyte-scale datasets or constrained-WAN sites.

VCF 9.1 + Advanced Cyber Compliance (ACC) delivers a customer-owned, on-premises Isolated Recovery Environment (IRE) the clean room with push-button isolation, EDR integration, and ransomware recovery workflows native to Site Recovery Manager. Certified ReadyNodes for cyber recovery enable standardised IRE BoMs. For regulated customers, sovereign cyber design is no longer a gap to patch over with parallel tooling.

6. Networking one protocol across overlay and underlay

Three networking improvements that collapse design seams which have existed in NSX deployments for years.

EVPN-VXLAN interoperability with the physical fabric, including a dedicated integration for Arista Networks, lets the overlay and underlay share a single protocol vocabulary instead of being stitched together at L2/L3 boundaries. Policy primitives become consistent across VMs, containers, and bare metal. End-to-end flow traceability simplifies network diagnostics.

Native Infoblox IPAM and DNS integration for VPC deployments removes one of the most painful operational seams in enterprise NSX. VCF discovers Network Views, DNS Views, and Network Containers directly; subnets get created from Network Containers; VM IP and FQDN updates flow back to Infoblox. IP Block design also gets more flexible one block now supports up to 10 CIDRs, 10 IP ranges, and explicit IP exclusions without disrupting existing VPC consumers.

IPv6-only Guest Customization becomes first-class. Administrators can disable IPv4 entirely and configure IPv6-only networking via UI and API. Partial network customization lets you change only the network fields without supplying the full profile, and customization can run on powered-on VMs. For IPv6-first environments government, hyperscaler-style customers, IoT-heavy deployments the IPv4 dependency drops out.

7. Storage architecture moves forward

Two storage architectural changes worth flagging.

NVMe dispersed namespaces enable partner-validated NVMe-based stretch cluster solutions. Where stretch designs have historically been the preserve of SAN-based metro topologies, NVMe-attached storage can now participate as a validated stretch building block. The storage vendor ecosystem can now certify NVMe stretch SKUs against VCF 9.1. For metro and campus DR designs with latency budgets that approach DRAM territory, this is a new architectural lane.

iSNS auto-discovery for ESX iSCSI removes manual target plumbing from the operational topology. iSCSI target management converges toward how Fibre Channel zoning is handled service-driven, not host-by-host. Drift between intended and actual target maps becomes visible at the iSNS layer. Smaller feature than Memory Tiering, but it removes a real category of operational toil from iSCSI-backed HLDs.

8. For service providers and FinOps

Two changes that VCSPs and large enterprise tenant operators will notice.

The VCD → VCF Migration Service automates the transfer of VMware Cloud Director workloads and configurations into VCF 9.1, with enhanced Guest OS Customization API parity preserving tenant customization fidelity through the migration. Migration becomes a platform service rather than per-tenant scripting. Cutover windows shrink. Stage your tenant batches with rollback semantics, not big-bang cutovers.

Chargeback in VCF 9.1 evolves from a VM-only cost tool to a full FinOps capability built into the platform. Cost allocation extends from VMs across clusters, hosts, and data centres, with customizable cost ratios aligning charges to real CPU and memory usage. VKS cost management is included. Auto Bill PDF Export, Tenant Reports and Alerts, and Upfront Pricing visibility turn chargeback into a platform feature instead of an after-the-fact reconciliation exercise.

What I’d flag first in customer HLDs

Reading across the twenty changes, three themes underneath the feature list.

Infrastructure economics on the same hardware. Memory Tiering, vSAN dedup, and NFS scale collectively change the cost-per-workload model without requiring net-new hardware. For customers in renewal or refresh conversations, these are the early wins.

AI and modern workloads as first-class citizens. DirectPath I/O, AMD vIOMMU, VKS 3.6, and Private AI / Sovereign Cloud collectively make VCF a credible target for the next generation of workloads without forcing architectural concessions on virtualisation features.

Operational footprint shrinks. vCenter Quick Patch, ESX Live Patch, ZTP, Namespace Capture, EVPN-VXLAN, Infoblox, iSNS read together, this is a release that takes patch-cycle and operational-seam overhead out of the design baseline.

If I were prioritising what to put in front of a customer first, I’d lead with the patch-cycle changes (vCenter Quick Patch, ESX Live Patch) because they’re the easiest to convert into a measurable operational improvement, and follow with whichever of the three economic themes lands closest to their current pain memory cost, storage cost, or cluster sprawl.

A note on what I left out

This is a design-view summary, not a complete release-notes walkthrough. There are smaller updates I haven’t covered here VMware Tools 13.1 changes, Migration Toolkit enhancements, additional Guest Customization API details that matter in specific contexts. The Broadcom release notes and the VCF 9.1 announcement blog series are the right starting points for the complete picture.

Sources

• VCF 9.1 announcement Modern Private Cloud Built for Efficiency and Resilience

• What’s New with vSphere 9.1

• Simplify Workload Connectivity and Enhance Network Scale (VCF 9.1 networking)

• vSAN Protection and Recovery Enhancements for VCF 9.1

• VCF 9.1 Hands-on Labs

• Introducing VCF 9.1 to VCSPs

• Maximizing Profitability: VCF 9.1 for VMware Cloud Service Providers

• VCF 9.1 Release Notes What’s New