WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud Foundation
  • VKS
  • Homelab
    • Resources
    • Nested Virtualization
  • VMware Nostalgia
  • Apple

vSAN ESA HCL hardware mock VIB for Nested ESXi

01.23.2025 by William Lam // 1 Comment

Whether you are configuring vSAN Express Storage Architecture (ESA) directly from vCenter Server or from VMware Cloud Foundation (VCF), the underlying ESXi hardware is automatically validated against the vSAN ESA Hardware Compatibility List (HCL) to ensure that you are using supported vSAN hardware.

In the case of vCenter Server, you can simply ignore the HCL warnings and accept the risks and proceed with the configuration but when using VCF, the operation is blocked to ensure customers have a good experience when selecting vSAN ESA when deploying a VCF Management or Workload  Domain.


With that said, there is workaround where you can create your own custom vSAN ESA HCL JSON based on the hardware that you have and then upload that to either Cloud Builder for setting up a new VCF Management Domain or to SDDC Manager for deploying a new VCF Workload Domain, which I have blogged about HERE and HERE.

The use of Nested ESXi is a very popular way to deploy VCF, especially if you are new to solution and allows you to easily experiment and learn. More recently, I have noticed an uptick in the interests for deploying VCF with vSAN ESA and while you can certainly generate a custom vSAN ESA HCL as mentioned earlier, the process still requires some effort and in some situations the vSAN ESA HCL could get overwritten leading some frustration in debugging.

After helping some folks debug their VCF environments recently, I was thinking about a better experience and leveraging another technique that may not be very well known externally ...

UPDATE (02/03/25) - This solution can also be used for a physical ESXi deployment for use with vSAN ESA and VCF.

[Read more...]

Categories // Automation, Nested Virtualization, VMware Cloud Foundation, VSAN Tags // Nested ESXi, VMware Cloud Foundation, vSAN ESA

vCenter Server Identity Federation with Keycloak Identity Provider without SCIM

01.21.2025 by William Lam // 3 Comments

After publishing my recent article about using Authentik as an Identity Provider (IdP) for vCenter Server, which I have recieved a lot of positive feedback both internally (including a small typo note from my VP 😅 ) and externally, I had several folks ask whether the same could also be accomplished with another popular open source IdP called Keycloak.

While I have not personally worked with Keycloak before, I know it is a popular identity provider solution for modern applications, especially within a Kubernetes environment. After getting Keycloak up and running, I found out that it does NOT have support for a System for Cross-domain Identity Management (SCIM) server, which is used to automatically synchronize your users and groups from your IdP to your clients, which would be vCenter Server in this case.

While there are a couple of 3rd party SCIM providers for Keycloak such as this one, they were either out of date or just did not work for me and after a few hours of troubleshooting, I eventually gave up. It certainly would have been nice to have SCIM server out of the box with a nice UX like Authentik.

I figured I was completely out of luck with using Keylock as an IdP for vCenter Server, because it needs to know about the users before you can assign vSphere Permissions. As a last resort, I pinged a few folks from our IdP team to see if there were any tricks I that I could leverage given the lack of SCIM server support. It turns out since vCenter Server uses the Identity Broker (vIDB) for Identity Federation, there is an option for manually publishing users into vIDB by leveraging its APIs! 🤩

Disclaimer: Keycloak is currently not an officially supported vCenter Server IdP, please use at your own risk.

[Read more...]

Categories // VCSA, VMware Cloud Foundation, vSphere, vSphere 8.0 Tags // Identity Provider, Keycloak, OAuth, OIDC, vCenter Server

vCenter Server Identity Federation with Authentik Identity Provider

01.13.2025 by William Lam // 1 Comment

While answering a recent question on the VMware Reddit Community, I came to learn about Authentik, an open source identity provider (IdP), which is pretty feature rich and best of all, you can self-host the Authentik IdP solution.

While Authentik is not one of the officially supported Identity Providers for vCenter Server Identity Federation such as Okta, Microsoft Entra ID, Microsoft ADFS or PingFederate, I was curious if it would to allow me to easily play with the Identity Federation feature in vCenter Server? 🤔

Hint: It works! 😁

Disclaimer: Authentik is currently not an officially supported vCenter Server IdP as mentioned earlier, please use at your own risk.

[Read more...]

Categories // VCSA, VMware Cloud Foundation, vSphere, vSphere 8.0 Tags // Authentik, Identity Provider, OAuth, OIDC, SCIM, vCenter Server

  • « Previous Page
  • 1
  • …
  • 8
  • 9
  • 10
  • 11
  • 12
  • …
  • 560
  • Next Page »

Search

Thank Author

Author

William is Distinguished Platform Engineering Architect in the VMware Cloud Foundation (VCF) Division at Broadcom. His primary focus is helping customers and partners build, run and operate a modern Private Cloud using the VMware Cloud Foundation (VCF) platform.

Connect

  • Bluesky
  • Email
  • GitHub
  • LinkedIn
  • Mastodon
  • Reddit
  • RSS
  • Twitter
  • Vimeo

Recent

  • VMUG Connect 2025 - Minimal VMware Cloud Foundation (VCF) 5.x in a Box  05/15/2025
  • Programmatically accessing the Broadcom Compatibility Guide (BCG) 05/06/2025
  • Quick Tip - Validating Broadcom Download Token  05/01/2025
  • Supported chipsets for the USB Network Native Driver for ESXi Fling 04/23/2025
  • vCenter Identity Federation with Authelia 04/16/2025

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2025

 

Loading Comments...