The documented behavior of kubectl edit is that it opens the object manifest in a local text editor, and the editor it launches is controlled by environment variables. In the VCF 9.0 documentation (Workload Management / Supervisor operations), the procedure explicitly states: "The kubectl edit command opens the namespace manifest in the text editor defined by your KUBE_EDITOR or the EDITOR environment variable." If the administrator's environment does not have KUBE_EDITOR or EDITOR defined (or they point to an invalid/interactive-less editor in the current session), kubectl edit may not open the expected editor workflow, and the admin may not see the normal confirmation after saving and exiting. Setting KUBE_EDITOR (preferred for kubectl-specific behavior) or EDITOR ensures kubectl launches a known-good editor, allowing the manifest to be modified, saved, and then submitted back to the API server when the editor exits. The same documented requirement also applies to editing other Kubernetes objects (such as a VKS cluster manifest) because the kubectl edit mechanism is identical.

A Virtual Machine Class (VM Class) in VMware vSphere with vSphere Supervisor is a policy-driven construct used to define the resource footprint of virtual machines managed via the Kubernetes API. Within the VCF 9.0 ecosystem, the VM Class acts as a blueprint that specifies the amount of virtual CPU (vCPU) and Memory (RAM) allocated to a VM instance. This abstraction allows developers to request standardized sizes (such as " best-effort-small " or " guaranteed-large " ) without requiring direct access to the underlying ESXi host configurations.
In the context of the vSphere Kubernetes Service (VKS), when a user deploys a VirtualMachine object or a Tanzu Kubernetes Cluster node, the system references the assigned VM Class to determine the resource reservations and limits. The vSphere Supervisor ensures that the hypervisor correctly allocates these compute resources based on the specified class. While specialized VM Classes can be created to support advanced hardware like GPUs (using PCI passthrough), the primary and mandatory resources defined in every VM Class are CPU and Memory. Storage is managed independently through StorageClasses and Persistent Volume Claims (PVCs), while networking is governed by the Supervisor Namespace ' s network settings. By centralizing these compute definitions, VCF 9.0 provides a consistent, scalable method for platform administrators to manage hardware resources while offering self-service capabilities to DevOps teams.

Within the VMware Cloud Foundation (VCF) 9.0 ecosystem, managing security and multi-tenancy in the vSphere Supervisor and associated workload clusters relies on Kubernetes Role-Based Access Control (RBAC). A Role is the specific Kubernetes object used to define a set of permissions that are scoped to a single namespace. While a ClusterRole defines permissions at the cluster level (across all namespaces or for cluster-scoped resources), a Role is explicitly designed to govern what actions a user or service account can perform within the boundaries of a specific Supervisor Namespace.
In a VKS environment, when a platform administrator grants a user access to a namespace, the system creates or references a Role (or a ClusterRole bound to a specific namespace via a RoleBinding) to specify allowed operations such as " get, " " list, " " create, " or " delete " on pods, deployments, and services. VCF 9.0 documentation highlights that utilizing namespaced Roles is a best practice for implementing the principle of least privilege, ensuring that developers or applications in one namespace cannot impact or view resources in another. This granular control is essential for enterprise environments where multiple teams share the same vSphere infrastructure. While " User " represents the identity and " Networkpolicy " handles traffic flow, the Role is the foundational object that defines the administrative or operational capabilities allowed within the namespace ' s logical boundary.

In VCF 9.0, cluster autoscaling is delivered as anoptionalcapability that requires installing theCluster Autoscaleras a standard package. The VCF 9.0 materials explicitly call out Cluster Autoscaler as an optionally installed package for vSphere Kubernetes Service, alongside other optional packages (for example, Harbor, Velero, Istio, etc.). The release information further emphasizes that autoscaling features (including newer behaviors such as scaling from/to zero for supported VKr versions) require that "the autoscaler standard package" be installed.
Operationally, installing the autoscaler package provides the controller that watches pending pods and node utilization signals and then drives the required changes in desired worker capacity. After that controller is present, you typically express scaling intent through the cluster's declarative configuration (for example, worker pool/node pool constraints and limits) so the autoscaler can act within the boundaries you define.
Without the autoscaler package, changing replica counts or expecting automatic node growth/shrink will not produce autoscaling behavior because the control loop that performs those actions is missing.

In the architecture of VMware Cloud Foundation (VCF) 9.0 and the vSphere Supervisor, a vSphere Pod (sometimes referred to as a Supervisor Pod) represents a unique execution model for containers. Unlike standard pods in a vSphere Kubernetes Service (VKS) workload cluster-which run as containers on top of a shared Linux guest operating system within a worker node virtual machine-a vSphere Pod runs directly on the ESXi hypervisor. This is achieved through the Container Runtime for ESXi (CRX) .
Each vSphere Pod is essentially wrapped in a highly optimized, lightweight virtual machine that contains its own dedicated Linux kernel. This architecture provides the strongest possible security isolation, as it utilizes the hardware-level boundaries of the hypervisor rather than just the software namespaces of a shared guest OS. Because each pod has its own kernel, the " attack surface " is significantly reduced, preventing container breakout scenarios from affecting other workloads. From an operations perspective, this allows vSphere administrators to view and manage these pods as first-class objects within the vCenter inventory, applying vSphere storage policies and viewing real-time performance metrics directly on the ESXi host. While VKS workload clusters are the primary vehicle for general-purpose Kubernetes applications in VCF 9.0, the vSphere Pod remains a key capability for high-security or performance-critical workloads that require the dedicated resources and isolation of a unique kernel instance.