NSX VPC or Another Workload Domain? Choosing the Right Isolation Boundary in VCF 9.1

This article provides a detailed analysis of isolation boundaries in VMware Cloud Foundation 9.1, focusing on when to use NSX VPCs versus separate workload domains. It explains that creating a workload domain for every isolation request leads to unmanageable complexity, with dozens of vCenter instances and fragmented clusters. The correct design principle is to use the smallest boundary that satisfies the strongest verified requirement, such as subnet, NSX VPC, project, cluster, or workload domain. It covers trade-offs for network isolation, overlapping IP space, delegated security, compute capacity, and administrative independence. Aimed at IT professionals designing VCF deployments, it offers practical guidance to avoid excessive workload domains.