Tanzu is VMware's expensive wrapper around Kubernetes that tries to make container orchestration feel like traditional VMware infrastructure. Think of it as Kubernetes for people who are terrified of yaml files and kubectl commands, but willing to pay enterprise prices for the privilege of avoiding them.
Since Broadcom bought VMware for $61 billion, they've been systematically jacking up prices and forcing customers into subscription bundles. What used to be "buy what you need" has become "buy everything or get fucked." AT&T's VMware costs were going to spike by 1,050% until they sued Broadcom and got a settlement.
The Technical Reality Check
Here's what Tanzu actually gives you: a bunch of Kubernetes clusters with VMware management tooling slapped on top. The Tanzu Application Platform (TAP) is basically CI/CD pipelines with extra steps and vendor lock-in. You'll spend more time configuring TAP than you would setting up Jenkins or GitHub Actions. Even VMware's own TAP troubleshooting guides acknowledge the platform's complexity issues.
Tanzu Kubernetes Grid (TKG) promises "consistent cluster management," but good luck with that. The GitHub issues are full of deployment failures like "initializing the cluster stalls at 45%" and "management cluster creation stuck in bootstrap phase." One engineer spent 6 hours debugging a TKG installation that failed because of incompatible NSX-T versions. The official troubleshooting docs are basically "check the logs and pray."
The "Enterprise-Grade" Features Nobody Asked For
Tanzu's "comprehensive RBAC and policy enforcement" translates to: more configuration overhead, more points of failure, and more consultants you'll need to hire. The RBAC implementation requires deep NSX-T integration knowledge that most Kubernetes engineers don't have. The AI-powered development tools are mostly marketing fluff - they'll tell you to upgrade your dependencies and scan for vulnerabilities, stuff any decent CI pipeline already does.
The VMware ecosystem integration sounds great until you realize it means you can't easily migrate away. Your networking depends on NSX, your storage needs vSAN, and your monitoring requires vRealize Operations. It's vendor lock-in by design.
Real-World Deployment Pain Points
Installing Tanzu on vSphere isn't the seamless experience they promise. Multiple installation guides and deployment blogs document the same recurring problems. Common issues include:
- Bootstrap failures:
tanzu management-cluster create
hanging for hours with cryptic errors likeError: failed to create management cluster: unable to patch the webhook...dial tcp 0.0.0.0:9443: connect: connection refused
- Certificate hell: PKS-to-TKG migrations break because of expired certs that nobody documented, and Harbor registry self-signed certificates cause deployment nightmares
- Resource conflicts: Tanzu assumes you have dedicated compute clusters, which most shops don't - network configuration issues are common
- Version compatibility nightmares: TKG 2.1 doesn't work with NSX-T 3.0, TKG 2.3 requires vSphere 7.0 U2, and performance tuning becomes a full-time job
- The 3am special: One poor bastard spent 4 hours debugging
Error: could not find image: harbor.corp.local/tkg/pause:3.7
because the corporate firewall was blocking harbor.corp.local but the error message made it look like a missing container image
The official docs assume you're a VMware networking expert. If you're not, prepare to hire expensive consultants or spend months learning NSX-T integration just to get Kubernetes working. Compare this to managed Kubernetes services that just work out of the box.