VCF 9.1.1: A Leaner Management Footprint and How to Plan for It

Every VCF deployment starts with a management domain. Before a single workload VM runs, the management domain requires its own set of ESXi hosts, its own vCenter, NSX managers, SDDC Manager, and the VCF Management Services Runtime (VCFMS) cluster. In smaller environments, the management domain can represent a significant portion of total infrastructure capacity.

VCF 9.1.1, which reached general availability on September 3, 2026 [1], introduces optimizations that reduce the management services footprint. Combined with the new vDefend Security Services Platform (SSP) 5.2 two-node form factor [2], organizations running VCF can reclaim meaningful resources. This article breaks down what changed, what the numbers look like, and how to use the updated Planning and Preparation Workbook to size it all before Day 0.

What VCFMS 9.1.1 Changes Under the Hood

The VCFMS cluster is a Kubernetes-based platform that runs fleet-level and instance-level management components [3]. In VCF 9.1, the Day-0 worker nodes were provisioned with a fixed machine type and replica count regardless of what the cluster actually needed at initial deployment.

VCF 9.1.1 introduces optimized Day-0 worker machine types and minimum replica counts [4]. New (greenfield) deployments at 9.1.1 receive these settings automatically. The compact form factor, according to Broadcom, reduces required CPU and memory by up to 40% [5].

For existing (brownfield) deployments that patched from 9.1 to 9.1.1, the optimization is not applied automatically. Broadcom provides a script called rightsize-day0-workers.sh, documented in KB 455842 [4], that applies the optimized worker size, machine type, and minimum replica count. The script:

• Runs on a control-plane node via SSH
• Detects the platform size profile, HA setting, and fleet/instance deployment type
• Applies the matching optimized configuration
• Triggers a rolling worker node replacement (approximately 10 to 15 minutes)
• Aborts without changes if Log Management or Real-time Metrics (Day-N components) are installed

This last point is important: the rightsizing applies only to Day-0 configurations. Once you add Day-N operations like log management, the workers require additional capacity and the script will not run.

Small HA: High Availability Without the Medium Price Tag

Before 9.1.1, achieving high availability for the VCFMS cluster required stepping up to a Medium deployment profile. This meant additional control plane nodes and worker capacity that smaller environments could not justify.

VCF 9.1.1 introduces Small High Availability (Small HA) as a new deployment option [6]. This provides three control-plane nodes (instead of one in the Simple model) while keeping the worker footprint at the Small tier. The VCF Operations 9.1.1 release notes confirm that "The Small (High Availability) functionality is introduced in both Fleet Lifecycle and SDDC Lifecycle 9.1.1" [6].

According to the Planning and Preparation Workbook (v1.9.1.102) [7], the Small HA first-instance sizing breaks down as follows:

Control nodes: 3x (12 vCPU, 30 GB RAM, 300 GB disk each) Worker nodes: 3x (30 vCPU, 48 GB RAM, 2,800 GB disk each) Total: 11 VMs, 68 vCPUs, 187 GB RAM, approximately 7 TB disk

By comparison, the Simple model uses one control-plane node and three worker nodes [3], saving one worker node's worth of resources (approximately 12 vCPU, 24 GB RAM) but sacrificing control-plane redundancy. For production environments, Small HA closes the gap: you get resilience without the resource jump to Medium.

The API uses small_ha in the vspClusterSpec for programmatic deployments.

vDefend SSP 5.2: The Two-Node Option

Security Services Platform 5.2, released alongside VCF 9.1.1, introduces a two-node form factor [2]. Previous SSP deployments required a minimum cluster of three worker nodes. The new option uses two Worker VMs plus three Controllers, delivering what Broadcom describes as a "lighter footprint" that still provides "production-grade Security Intelligence, Rule Analysis, and vDefend 1-2-3-4 (DFW)" with "scale-out capacity" [2].

The unified SSP installer can deploy and manage up to five independent platform instances from a single SSPI (Security Services Platform Installer), which Broadcom states is "significantly slashing operation resource overhead" [2].

There are constraints worth noting from the Planning and Preparation Workbook [7]:

• License Hub 2.0 is required per VCF Fleet
• A single SSPI manages up to 5 SSP instances
• The SSP form factor is based on the NSX Manager size
• Medium form factor covers Security Intelligence
• Large with 8 or more workers is required for full Advanced Threat Prevention (Malware Prevention, NTA, NDR)

For organizations that need DFW and basic security intelligence without the full ATP stack, the two-node form factor represents a meaningful reduction in dedicated security infrastructure.

Using the Planning and Preparation Workbook

The VCF 9.1.1 Planning and Preparation Workbook (v1.9.1.102) [7] is a 22-sheet Excel document that serves as both a pre-deployment planning guide and a standalone sizing calculator. The latest revision, dated September 11, 2026, includes updated sizing guidance specifically for Security Services Platform deployments.

Here is how to use it effectively:

Start with the VCF & VVF Planning sheet. This is the master planning sheet. Select your deployment type, target version (9.1.1.0), and configuration parameters. Your choices here flow into the sizing calculations on subsequent sheets.

Move to Management Domain Sizing. This sheet shows component-level VM requirements, including VCFMS control and worker nodes, vCenter, NSX managers, and SDDC Manager. It also contains the SSP sizing notes and constraints. The host parameters section helps you determine the minimum number of ESXi hosts needed based on the selected deployment profile.

Use Deploy Management Domain for Day-0 inputs. Rows 36 through 40 of this sheet cover the scale options. This is where you specify Simple versus HA, choose your size profile, and configure network and storage parameters. The workbook validates your selections against the sizing requirements.

Reference Management Domain As Built after deployment. This sheet provides a post-deployment reference with a complete component breakdown. It is useful for verifying that your deployment matches the planned configuration.

Check the Prerequisite Checklist first. Before any of the above, the prerequisite checklist ensures you have the DNS records, IP addresses, NTP configuration, and certificate authority in place. Missing prerequisites are the most common cause of deployment delays.

The workbook is not just documentation. It is a living calculation tool: change a deployment parameter and the sizing numbers update throughout. For teams planning a VCF 9.1.1 deployment, working through the workbook before touching the installer is the single most effective way to avoid post-deployment surprises.

Practical Recommendations

For new deployments: Deploy directly at 9.1.1 to receive the optimized VCFMS footprint automatically. Use Small HA unless you have a specific reason to scale to Medium. Run through the Planning and Preparation Workbook before Day 0.

For existing 9.1 environments: Patch to 9.1.1, then evaluate whether the Day-0 rightsizing script applies to your environment. Remember that it only works on deployments without Day-N components (Log Management, Real-time Metrics). Both Fleet Lifecycle and SDDC Lifecycle must be at 9.1.1 before scaling from Small to Small HA [6].

For vDefend planning: If your security requirements are DFW and Security Intelligence without full ATP, the SSP 5.2 two-node form factor reduces the dedicated infrastructure. Use the workbook's sizing guidance to validate the form factor against your NSX Manager size.

For all environments: Download the latest Planning and Preparation Workbook from Broadcom and make it part of your standard deployment workflow. The September 2026 revision includes the updated SSP sizing guidance that reflects the new two-node option.

Related Reading

• What's New in VMware Cloud Foundation 9.1: Complete Feature Overview and Architecture
• VCF 9.1 Protection and Recovery: Deploy, Configure, and Protect Your VMs with vSAN ESA Snapshots (No License Required)
• VMware HyperArmor: Proactive Host-Layer Defense for the AI Threat Era

References

[1] VMware Cloud Foundation 9.1.1.0 Release Notes↗ - Broadcom TechDocs

[2] Security Services Platform 5.2 Release Notes↗ - Broadcom TechDocs

[3] VCF Management Services Models↗ - Broadcom TechDocs

[4] Reducing Footprint of VCF Management Services Cluster (KB 455842)↗ - Broadcom Knowledge Base

[5] New AI and Kubernetes Private Cloud Operations Capabilities in VMware Cloud Foundation 9.1.1↗ - VMware Blog (Broadcom)

[6] VCF Operations 9.1.1.0 Release Notes↗ - Broadcom TechDocs

[7] VCF 9.1.1 Planning and Preparation Workbook v1.9.1.102 - Broadcom

Disclosure: The author is an employee of Broadcom. This article represents the author's technical analysis and does not represent Broadcom's official position.