Managing and Operating VMware Cloud Foundation
Day-2 work in VCF splits into three buckets: capacity, identity and secrets, and protection. Know which console owns which operation, because questions routinely offer the wrong tool.
Capacity and inventory
SDDC Manager is the inventory of record. Hosts are commissioned into the free pool, then added to a domain cluster or used to create a new domain. Clusters and domains scale out from SDDC Manager; vCenter is where you do policy and in-guest work, not domain membership.
Identity and secrets
SDDC Manager holds the credential vault. Service accounts for vCenter, NSX, ESXi and Aria rotate on a configurable policy or on demand; scripts and integrations holding old passwords are the classic breakage. Directory integration is LDAPS-based - the directory server's certificate chain must validate or the bind fails. Role assignment (admin, operator, viewer) is configured in SDDC Manager, not vCenter.
Protection
- SDDC Manager backup to an SFTP target is the anchor artefact; it captures inventory and configuration, not workload VMs.
- vCenter file-based backup, NSX Manager backup and Aria Suite Lifecycle backups are scheduled separately.
- Health and compliance views sit in SDDC Manager; deeper monitoring, dashboards and log analytics come from Aria Operations and Aria Operations for Logs.
Traps
- Believing an SDDC Manager backup protects tenant VMs.
- Restoring components in the wrong order - SDDC Manager first, then reattach the rest.
- Rotating passwords without updating integrations.
- Treating certificate replacement as cosmetic; swapping VMCA for an enterprise CA is a planned workflow.
Rule of thumb
Before any change window: take an SDDC Manager backup, confirm DNS and NTP health, and verify no credential is near expiry. Most failed day-2 tasks are stale secrets or name resolution, not product defects.