The management domain must be deployed using vSAN, NFS, or Fibre Channel (FC). Supported protocols include NFSv3 and VMFS on FC.
vSAN (including OSA) is the default recommended option, but NFSv3 and VMFS on FC are also supported for environments where external storage arrays are required.
NVMe/TCP and vVols are not supported for the initial management domain's principal storage.
vVols may be used in workload domains after deployment, but they are not a supported foundation for the management domain.
Therefore, the three correct storage solutions for the first management workload domain are:
VMFS on FC, NFSv3, and vSAN OSA.

The vSphere CSI driver allows vSphere storage to be exposed as persistent storage to containerized applications running on Kubernetes clusters. The driver implements the Kubernetes CSI specification and enables dynamic provisioning, attach/detach, and snapshot operations for persistent volumes.

In VCF 9.x, air-gapped bring-up requires staging the required binaries in the VCF Installer. The documented list explicitly includes NSX and VCF Operations among the components to upload.
The product guide states: "VMware Cloud Foundation required binaries include... NSX ... VMware Cloud Foundation Operations ... vCenter ... SDDC Manager..." (exact list excerpt). This list does not call for ESX images or the legacy "Lifecycle Manager."

VCF supports only certificates in PEM format when replacing system component certificates with those signed by an external Certificate Authority.
PEM is the standard Base64 format with .crt and .key files. PFX (PKCS#12) is used for Windows stores but not supported in VCF automation. P7B is for certificate chains, while DER is binary encoding. Thus, the required format for certificates in VCF is PEM.

When deploying a new VKS workload cluster, the Antrea Container Networking Interface is automatically enabled by default to provide pod-to-pod and pod-to-service networking. Antrea is fully integrated with NSX-T for advanced policy control.
Flannel, Calico, and Cilium are widely used CNIs in upstream Kubernetes but are not the default in VCF. Administrators can optionally integrate with third-party CNIs, but the supported default choice is Antrea.