KubeDB on VMware vSphere Kubernetes Service (VKS)
Joint Solution Brief

Key Benefits

• Self-Service Inside vSphere Controls: Application teams provision production databases with a single Kubernetes object or a few clicks in the KubeDB console. Everything stays inside the quotas, storage policies, and permissions that vSphere administrators set through vSphere Namespaces and vCenter Single Sign-On.
• Private-Cloud DBaaS for Regulated and Air-Gapped Sites: Hyperscaler database services rarely fit regulated, sovereign, edge, or air-gapped environments. KubeDB delivers a DBaaS operating model on your own VCF estate, with images mirrored to Harbor for disconnected sites.
• One Database API Across Hybrid Estates: KubeDB runs on any conformant Kubernetes cluster, so teams use the same database API on VKS and everywhere else, without provider-specific tooling or unpredictable costs.
• Built on the VCF Services You Already Run: Storage comes from vSAN ESA through the vSphere CSI driver, networking from NSX, and identity from vCenter Single Sign-On. KubeDB reuses them instead of introducing parallel infrastructure.
• Layered Resilience: Each layer handles its own failures. vSphere HA restarts virtual machines, VKS replaces failed worker nodes, KubeDB promotes a standby when a primary fails, and backups are stored off-cluster.
• An Audit Trail Instead of Runbooks: Day-2 changes such as scaling, volume expansion, and certificate rotation run as OpsRequests. The operator executes each one step by step and records its status, so every change is visible and repeatable.

Validated on VKS: What Was Tested

• Provisioning: A three-member PostgreSQL 18.3 cluster with TLS, created from one Postgres object, was ready in 71 seconds with one primary, two standbys, and three vSAN volumes.
• Automatic Failover: After the primary pod was deleted, a standby was promoted in 31 seconds and the old primary rejoined as a standby in 47 seconds. Writes continued without client changes.
• Online Volume Expansion: Volumes grew from 50Gi to 100Gi in 2 minutes 28 seconds, with no pod restarts.
• Horizontal and Vertical Scaling: The database scaled from three to four members in 68 seconds and back in 1 minute 51 seconds while staying available. Vertical scaling completed in 3 minutes 8 seconds as a rolling restart, standbys first.
• TLS Certificate Rotation: Server certificates were re-issued and applied in 5 minutes 3 seconds, with data intact.
• Backup and Restore: A KubeStash backup to S3-compatible storage took 9 seconds, and restoring into a new database took 37 seconds, with every row recovered, including rows written after the failover.
• Monitoring: Prometheus scraped all targets and the KubeDB Grafana dashboard populated as expected.
• About These Results: All eight tests passed on KubeDB v2026.10.12, VCF 9.0, and VKS 3.7. They ran on a single-zone cluster smaller than the recommended production size, so production timings may differ.

Reference Architecture at a Glance

Layered Availability. vSAN Storage. NSX Isolation. Full Control.

• Infrastructure: VMware Cloud Foundation 9.0 with vCenter Server 9.0.2 and VKS 3.7 provide CNCF-conformant Kubernetes clusters. A vSphere Namespace holds quotas, VM classes, storage policies, and permissions for each environment.
• Storage: vSAN ESA through the vSphere CSI driver, with each vSAN policy exposed as a StorageClass and one volume per database member. RAID-5 suits general-purpose databases, and RAID-6 suits mission-critical and regulated workloads.
• Networking and Security: NSX VPCs and the distributed firewall isolate database traffic. TLS certificates come from cert-manager, vSAN encrypts data at rest, and KubeStash encrypts backups before they leave the cluster. Pinniped connects Kubernetes RBAC to vCenter Single Sign-On.
• High Availability and Placement: Members spread across worker nodes with anti-affinity, PodDisruptionBudgets protect quorum during drains and upgrades, and an arbiter pod keeps elections safe when the member count is even. The primary Service always follows the current primary.
• Data Protection and Disaster Recovery: KubeStash provides database-aware backups, cluster-object backups, and point-in-time recovery for PostgreSQL, MySQL, MariaDB, and MongoDB. Writing repositories to a second-site object store lets a standby VKS cluster restore your databases after a site loss.
• Day-2 Operations: Version updates, scaling, volume expansion, reconfiguration, and credential rotation run as OpsRequests. Compute and storage autoscaling, per-engine Grafana dashboards, and GitOps with Argo CD or Flux are built in.
• Run Any Database: KubeDB supports more than 30 engines, including PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Kafka, Elasticsearch, OpenSearch, Microsoft SQL Server, Oracle, and the Qdrant, Milvus, and Weaviate vector databases. PostgreSQL was the engine validated on VKS, and the same operating model applies to the others.
• Get Started: Request a license, then install the full KubeDB Platform with the AppsCode installer, or install KubeDB and KubeStash only with Helm. We recommend a proof of value on one contained workload, measuring provisioning time, restore time, and operational effort before you scale.

Learn More

• KubeDB on vSphere Kubernetes Service on VMware Cloud Foundation: Reference Architecture
• KubeDB by AppsCode on VMware vSphere Kubernetes Service (VKS): AppsCode Blog
• Empowering Platform Teams with VMware vSphere Kubernetes Service Validations: VMware Blog