Before the host can be recommissioned and added back to the SDDC Manager inventory, you must reset the system configuration. This can be done from the ESXi Direct Console User Interface (DCUI) by selecting the "Reset System Configuration" option. This will remove any previous configuration and allow the host to be re-added to the environment.

Lockdown Mode limits direct host access (A), and restricting the DCUI/SSH (D) reduces the attack surface. DRS (B) is for resource balancing, and there is no feature called "vSphere Configuration Encryption" (C). You can encrypt VMs or vSAN, but not the entire configuration in that manner.

NSX segments need to be configured for Kubernetes namespaces to provide network connectivity and isolation for the Kubernetes workloads that will be deployed.
The Supervisor Cluster must be deployed as part of the IaaS Control Plane to manage the Kubernetes workloads and enable vSphere with Tanzu.
Enabling workload management in vCenter Server allows the deployment and management of Kubernetes workloads alongside virtual machines, utilizing vSphere with Tanzu.

Typically, a given VM's disks should reside entirely on a single storage type (vSAN or SAN/NAS), rather than split across different storage solutions to avoid complexity. SIOC is for block-based LUNs, ephemeral bridging (C) isn't supported, and vSAN doesn't have multiple "active cluster master nodes" (D) in that sense.