Capacity can grow by adding a cluster to an existing domain or by creating a new domain; the documented attributes of each make the choice mechanical once the driver is known. Figure 6.1 shows the questions that decide between the two.
What each option gives and costs
A new workload domain brings a new vCenter and SSO domain, an independent lifecycle, optionally its own NSX instance and identity provider, and a separate ESX management VLAN and subnet (the ESX design recommends one per workload domain). Its costs land partly on the management domain (another vCenter appliance and possibly three NSX Manager nodes), partly on operations (another set of credentials and password rotations) and partly on the network team (more VLANs and subnets). The design library recommends workload domains for customer workloads in the first place, accepting the extra hardware.
A new vSphere cluster in an existing domain shares that domain’s vCenter, SSO domain, NSX instance and lifecycle, but brings its own:
- Cluster model. Models are chosen per cluster, so a domain can mix single-rack, multi-rack and stretched clusters.
- Principal storage. Each cluster has its own principal storage type, fixed at creation; a new cluster can use a different type.
- Image. Each cluster needs a vSphere Lifecycle Manager cluster image when it is created.
- Supervisor zone. In a domain with vSphere Supervisor, each cluster is a vSphere zone, and a three-zone Supervisor management layout needs three clusters; that choice is made at activation and cannot be changed later.
Decision rules
| Requirement or driver | Design decision | Justification | Implication |
|---|---|---|---|
| Separate administrators or identity provider | New workload domain | Own vCenter SSO domain; dedicated IdP supported | More credentials; vCenter in management domain |
| Separate maintenance windows and versions | New workload domain | Independent lifecycle per domain | More lifecycle operations to schedule |
| Network or security isolation from other tenants | New workload domain with dedicated NSX | Own management plane and transport zone | Three NSX nodes in management domain |
| More capacity for existing tenants | New cluster in existing domain | No new vCenter, SSO or NSX | Shares domain lifecycle and NSX |
| Different availability level for some workloads | New cluster with another cluster model | Models are set per cluster | Model-specific host counts and VLANs |
| Different storage type or hardware | New cluster with its own principal storage | Principal storage is per cluster | Hosts commissioned for that storage type |
Scale limits also matter: the Workload Domain Models page gives up to 24 workload domains per VCF instance in addition to the management domain; the 25 in the vCenter design page’s SSO requirement counts the management domain’s vCenter as well.
Common trap: Creating a new workload domain whenever more capacity is needed - each domain adds a vCenter (and possibly an NSX Manager cluster) to the management domain plus separate credentials to rotate; when no isolation, identity or lifecycle driver exists, add a cluster to an existing domain.