Broadcom's rebranding of the Tanzu portfolio has created significant confusion for enterprise Kubernetes buyers. This guide cuts through the complexity: what Tanzu includes, what it costs, how VCF bundling works, and how to avoid paying for Kubernetes platform capabilities you don't need.
The Tanzu product family was VMware's strategic bet on the Kubernetes platform market, assembled through a series of acquisitions including Heptio, Bitnami, and Pivotal. When Broadcom acquired VMware in 2023, it inherited this complex portfolio and has since restructured it under the "Tanzu Platform" umbrella. Understanding what is in the current Tanzu Platform — and what has been discontinued or separated — is essential to making informed licensing decisions. This page links to the broader Broadcom VMware licensing guide for overall context.
The key components of the current Tanzu portfolio are Tanzu Kubernetes Grid (TKG), which provides managed Kubernetes cluster lifecycle management; Tanzu Application Service (TAS), formerly Pivotal Application Service, which provides a PaaS layer for application deployment; Tanzu Service Mesh, which provides application-layer networking and observability; and Tanzu Application Catalog, which provides a curated, pre-hardened open-source software catalogue. Not all of these are bundled together, and not all are included in VCF.
Many enterprises pay for Tanzu when they only need basic Kubernetes cluster management, which can be achieved with upstream Kubernetes, managed Kubernetes services (EKS, AKS, GKE), or open-source tools like Rancher at zero or near-zero licensing cost. Before committing to Tanzu licensing, assess whether your Kubernetes requirements genuinely require the enterprise features Tanzu provides.
| Product | What It Does | Included in VCF? | Standalone Pricing Basis |
|---|---|---|---|
| Tanzu Kubernetes Grid (TKG) | Kubernetes cluster lifecycle management on vSphere, cloud, and edge | YES (VCF) | Per core, all nodes in managed clusters |
| Tanzu Application Service (TAS) | Cloud Foundry-based PaaS for Java/.NET/Node applications | NO — Add-on | Per core of underlying infrastructure |
| Tanzu Service Mesh | Istio-based service mesh, mTLS, observability | NO — Add-on | Per cluster or per node |
| Tanzu Application Catalog | Pre-hardened Helm charts and container images | NO — Add-on | Subscription per team/project |
| Tanzu Platform for Cloud Foundry | Next-gen TAS on Kubernetes, developer platform | NO — Add-on | Per core or per application instance |
The most common licensing question for enterprise Tanzu buyers is whether to use Tanzu Kubernetes Grid (TKG) or Tanzu Application Service (TAS) — or both. TKG is the lower-level Kubernetes management layer, appropriate for organisations that have platform engineering teams capable of managing clusters and deploying workloads via Helm charts and manifests. TAS (and its successor, Tanzu Platform for Cloud Foundry) is a higher-level PaaS that abstracts Kubernetes complexity for development teams that want to "push code" without managing infrastructure.
Most organisations building net-new Kubernetes capabilities should evaluate TKG first, as it provides the lower-cost foundation and avoids the legacy Cloud Foundry architecture of TAS. TAS customers who are currently locked in should evaluate whether migration to TKG or a managed Kubernetes service is commercially viable before their next major renewal.
Within a VMware Cloud Foundation (VCF) subscription, Tanzu Kubernetes Grid is included at no additional charge. This means that VCF customers can deploy TKG clusters on their vSphere infrastructure without purchasing additional Tanzu licences. This inclusion is one of the more compelling components of the VCF bundle for organisations with Kubernetes ambitions.
However, it is critical to understand what is not included: TAS is not part of VCF. Tanzu Service Mesh is not part of VCF. The Tanzu Application Catalog is not part of VCF. Customers who assume VCF gives them the complete Tanzu portfolio will be in for an unpleasant surprise at their first renewal when add-on charges appear.
Broadcom's sales team will typically propose Tanzu add-ons during the VCF subscription discussion. Developer platform teams are often consulted and may enthusiastically endorse adding TAS or Tanzu Service Mesh. The resulting scope expansion can significantly inflate the total cost. Ensure procurement governance requires formal approval for any Tanzu add-ons beyond the TKG baseline included in VCF.
The Kubernetes platform market is highly competitive. Tanzu faces credible alternatives at every level of the stack, and this competitive pressure is your primary negotiation leverage:
Before any renewal, conduct a deployment audit to identify which Tanzu components are actively used versus licensed but inactive. TAS environments in particular often have unused application instances or legacy pipelines that inflate the licensed core count without delivering business value.
If you are paying for TAS, conduct a formal application portfolio assessment to determine which TAS-hosted applications could be re-platformed to TKG or a managed Kubernetes service. Even a partial migration — moving 30–40% of applications — can justify significant TAS licence reduction at the next renewal.
Red Hat OpenShift pricing is publicly disclosed and provides a direct benchmark for Tanzu Platform pricing. Obtain an OpenShift quote before engaging Broadcom on Tanzu renewal, and present it as your competitive reference. Broadcom will typically offer significant discounts rather than lose a Tanzu footprint to Red Hat.
If you are purchasing or renewing VCF, explicitly document that TKG is included and define the scope of included TKG capabilities in the contract. Broadcom's sales team may attempt to present TKG as a separate commercial add-on for larger deployments. Push back with the standard VCF entitlement documentation.
TAS is licensed per core of the underlying infrastructure. Application consolidation — reducing the number of foundation nodes or Diego cells by decommissioning underutilised applications — directly reduces the licensable core count. A 20% reduction in application portfolio size can yield a 15–20% reduction in TAS licensing costs.
Tanzu pricing has increased significantly post-acquisition. Any multi-year Tanzu commitment should include locked per-core or per-instance pricing for the full term with annual escalation caps. Three-year locked pricing is achievable and typically yields a 10–15% discount versus annual renewal.
In large VMware renewal negotiations, Broadcom's team often bundles Tanzu with vSphere and vSAN decisions to obscure individual component pricing. Insist on separate line-item pricing for each product family. This gives you the ability to optimise individual components independently and prevents cross-subsidisation.
Tanzu pricing is complex and opaque. Independent VMware negotiation advisors who have benchmarked Tanzu deals across multiple enterprises can validate whether Broadcom's proposed pricing is market-competitive and identify structural optimisations that internal teams typically miss.
Tanzu licensing compliance is an emerging area of risk as Broadcom tightens its compliance programme. Key exposure areas include TKG clusters deployed beyond the licensed core boundary, TAS application instances that exceed contracted capacity during burst periods, and unlicensed use of Tanzu Service Mesh or Application Catalog features that are accessed through VCF deployments but not separately licensed. The broader VMware audit defense guide covers the procedural response to any compliance inquiry, and preparing a licence position ahead of any renewal or audit remains the most important proactive step.
Many enterprises are overpaying for Kubernetes platform capabilities they don't fully use. Our advisors specialise in VMware Tanzu licensing optimisation and competitive benchmarking.