Broadcom published a technical white paper in February 2026 covering the integration of Kong API Gateway with vSphere Kubernetes Service (VKS) within VMware Cloud Foundation. The paper describes a reference architecture for organizations looking to combine Kubernetes workloads with enterprise-grade API governance.
Why Kong on VKS?
As Kubernetes environments scale, the challenge shifts from raw throughput to governance: how do you ensure consistent security, predictable latency, and auditable traffic management across all your microservices? Kong acts as the intelligent "front door" of the VKS cluster, filling exactly the gap that standard ingress controllers leave behind.
Two deployment models
The white paper fully details two architectures, complete with all accompanying YAML and Helm commands:
- On-premises – Both the Control Plane and Data Plane run locally within the VKS cluster. This model is particularly suited for high-compliance environments where the management layer must remain on-premises — a familiar requirement in public sector environments.
- Hybrid (Kong Konnect) – The Control Plane is a SaaS service, while the Data Plane remains local. Operational management is centralized in the cloud, but all API traffic is processed within your own infrastructure boundary.
Technical environment
The validation was performed on VKS version 3.5, Kubernetes v1.34.2, Ubuntu 24.04, and vSAN ESA with RAID-5 as the storage policy. The Kong Operator (v1.0.2) was installed via Helm, supplemented by cert-manager for automated mTLS certificate rotation between the Control Plane and Data Plane.
Relevance for VCF infrastructure design
For infrastructure architects working on VCF designs, this paper is particularly interesting because it demonstrates how Kubernetes-native tooling — Gateway API, Cluster API, GitOps via Argo CD — integrates seamlessly with existing vSphere workflows. NSX handles network micro-segmentation, the vSphere CSI driver transparently exposes vSAN storage policies as Kubernetes storage classes, and the entire stack is declaratively manageable — including certificate lifecycle and routing policies as code.
Source: VMware by Broadcom Technical White Paper – Kong on vSphere Kubernetes Service
