Password, Certificate & Backup Management UI/API for VMware vSphere Foundation (VVF) 9.1

Products

• VCF Operations

Issue/Introduction

• In VMware vSphere Foundation (VVF) 9.1 and VMware Cloud Foundation (VCF) 9.1, administrative access to Password, Certificate, and Backup management interfaces varies based on the Deployment Type and Entitlement Type.
• When deploying VVF without VCF Management Services (VCFMS), standard unified Fleet Management UI options are unavailable. Administrators must understand where and how to manage credentials, TLS certificates, and backup/restore workflows across different VVF and VCF deployment combinations.

Environment

 

• VMware vSphere Foundation (VVF) 9.1

• VMware Cloud Foundation (VCF) 9.1

• VCF Operations 9.1

• VCF Management Services (VCFMS)

 

Cause

The VVF deployment model includes a workflow without VCF Management Services (VVF without VCFMS) that deploys standalone components (vCenter Server, ESXi, VCF Operations, VCF License Server) rather than a VCFMS-backed stack. Because capability exposure depends on both the underlying deployment type and the license entitlement, centralized Fleet Management UIs are restricted or disabled in certain non-VCFMS architectures.

Resolution

The table below outlines where Password, Certificate, and Backup management functions are exposed depending on the environment configuration:

Deployment Type	Entitlement Type	Management Interface Access
VVF without VCFMS	VVF	Standalone Component UI / API
VVF with VCFMS	VVF	VCF Operations Component API
VVF without VCFMS	VCF	Standalone Component UI / API
VVF with VCFMS	VCF	VCF Operations Fleet Management UI / API
VCF with VCFMS	VCF	VCF Operations Fleet Management UI / API

 

Scenario A: VVF without VCFMS (Standalone Components)

When deployed without VCF Management Services, administrators must manage each component using its native interface:

• ESXi: Use the local ESXi Host Client / API for password and TLS certificate updates.

• vCenter Server: Use VCSA Management Interface (VAMI - Port 5480) for certificates and local accounts (root).

• VCF Operations: Use the native VCF Operations Administration UI/API for certificates, password management, and backup configurations.

Scenario B: VVF with VCFMS (VVF Entitlement)

For environments using VCFMS under a VVF entitlement, management tasks for VCFMS components (e.g., Log Management) are handled via specific VCF Operations Component APIs:

1. Password Management API:

   Used to rotate and manage accounts provisioned for VCFMS, including:

   • vmware-system-user

   • [email protected]

2. Certificate Management API:

   Used to update and manage TLS certificates provisioned across all FQDNs configured for VCFMS.

3. Fleet Backup / Restore API:

   Used to trigger and configure system backups and restorations for the VCFMS stack.

Scenario C: Deployments with VCF Entitlement (VVF with VCFMS or VCF)

For environments operating under a full VCF entitlement with VCFMS enabled:

• Administrators can manage passwords, certificates, and backups centrally via the VCF Operations Fleet Management UI or the corresponding Fleet Management APIs.

 

Additional Information

Technical Reference: Password, Certificate & Backup Management UI/API for VMware vSphere Foundation (VVF) 9.1