WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud Foundation
    • VMware Cloud Foundation 9.1
    • VMware Cloud Foundation 9.0
  • VKS
  • Homelab
    • Hardware Options
    • Hardware Reviews
    • Lab Deployment Scripts
    • Nested Virtualization
    • Homelab Podcasts
  • VMware Nostalgia
  • Apple

Search Results for: authentik

Configuring OIDC with PKCE in Keycloak for VCF Private AI Services

08.26.2026 by William Lam // Leave a Comment

I have taken a short hiatus from playing with my NVIDIA RTX 4000, which fits perfectly inside a Minisforum MS-A2 and is what I use to run VMware Cloud Foundation (VCF) 9.1. While redeploying my environment to test an upcoming release of VCF Private AI Services (PAIS), I was reminded that the deployment requires an OIDC provider that supports the Authorization Code grant flow with PKCE (Proof Key for Code Exchange).

When I originally deployed PAIS with VCF 9.0, I used Authentik as my identity provider (IdP). With my VCF Infrastructure Services (VIS) Appliance which provides a number of services including Keycloak as an OIDC provider, I wanted to figure out the required Keycloak configuration to satisfy the PAIS OIDC requirements, especially as this can help accelerate Lab/PoC deployments.

After some trial and error, and with the help of OpenAI Codex to debug my live environment, I now have Keycloak successfully configured with PAIS, along with a script to generate the access token required to interact with a PAIS Model Endpoint! 🥳

[Read more...]

Categories // Private AI Services, VMware Cloud Foundation Tags // PAIS, VCF 9.1

VMware Cloud Foundation 9.0

ℹ️ This page is applicable for VCF 9.0.x and for latest VCF 9.1.0 release, please see https://williamlam.com/vmware-cloud-foundation-9

VCF MS-A2 Lab Deployment

  • MS-A2 VCF 9.0 Lab: Build-of-Materials (BOM)
  • MS-A2 VCF 9.0 Lab: Physical Mini Rack Layout
  • MS-A2 VCF 9.0 Lab: Physical Network Layout
  • MS-A2 VCF 9.0 Lab: Physical Network Configuration with MikroTik
  • MS-A2 VCF 9.0 Lab: Configuring Minimal VCF Fleet Deployment
  • MS-A2 VCF 9.0 Lab: Configuring NSX Virtual Private Cloud (VPC)
  • MS-A2 VCF 9.0 Lab: Configuring vSphere Supervisor with NSX VPC Networking
  • MS-A2 VCF 9.0 Lab: Configuring vSphere Kubernetes Service (VKS)
  • MS-A2 VCF 9.0 Lab: Configuring VCF Automation
  • MS-A2 VCF 9.0 Lab: Configuring External IdP for Multiple VCF Automation Organizations
  • MS-A2 VCF 9.0 Lab: Installing VMware Private AI Services (PAIS)
  • MS-A2 VCF 9.0 Lab: Configuring Data Services Manager (DSM) for VMware Private AI Services (PAIS)
  • MS-A2 VCF 9.0 Lab: Configuring Authentik Identity Provider VMware for Private AI Services (PAIS)
  • MS-A2 VCF 9.0 Lab: Configuring Model Store using Harbor for VMware for Private AI Services (PAIS)
  • MS-A2 VCF 9.0 Lab: Deploying VMware Private AI Services (PAIS)
  • MS-A2 VCF 9.0 Lab: Deploying Model Endpoint with DirectPath I/O using VMware for Private AI Services (PAIS)
  • MS-A2 VCF 9.0 Lab: Modding an NVIDIA RTX 4000 Ada (20GB VRAM)

VCF General

  • Ultimate Lab Resource for VCF 9.0
  • Nested ESXi 9.0 Virtual Appliance
  • Automated VMware Cloud Foundation (VCF) 9.0 Lab Deployment Script
  • How to deploy VVF/VCF 9.0 using VMUG Advantage & VCP-VCF Certification Entitlement
  • Automating Lab Optimizations for Post-Deployment of VMware Cloud Foundation (VCF)
  • Cross vCenter vMotion workloads from vSphere 7.0 to vSphere 9.0
  • Quick Tip - Correlating VCF Component to Bundle ID/Name
  • Quick Tip - VCF 9.0.1 upgrade files now available on Broadcom Support Portal (BSP)
  • Identifying VMware Cloud Foundation (VCF) managed service accounts in vCenter Server
  • No ESX images available when upgrading from VMware Cloud Foundation (VCF) 9.0.0 to 9.0.1
  • Custom UEFI Boot Menu for ESXi 9.0 using rEFInd
  • Quick Tip - VCF 9.0 Versioning Scheme
  • VCF 9.0 Offline Depot using Synology
  • Single Node VMware Avi Load Balancer with VCF 9.0
  • Is my NIC supported with Enhanced Data Path (EDP) with VCF 9.0
  • Failed to locate kickstart on Nested ESXi VM CD-ROM in VCF 9.0
  • NVMe Tiering with Nested Virtualization in VCF 9.0
  • NVMe Tiering with AMD Ryzen CPU workaround for VCF 9.0
  • Minimal resources for deploying VCF 9.0 in a Lab
  • Crowdsourced Lab Hardware for ESXi 9.0 Dashboard
  • VCF 9.0 Hardware Considerations

VCF Installer

  • Automating the Retrieval of VCF Installer Deployment Milestones
  • Bypassing the ESX Tunnel Endpoint (TEP) 1600 MTU Check in the VCF Installer
  • TLS Chain of Trust when using SSL Inspection with VCF Download Tool (VCFDT)
  • Running VCF Download Tool (VCFDT) on Apple macOS
  • Increasing VCF Installer & SDDC Manager Timeout for NSX Deployment
  • JFrog Artifactory as VCF Software Depot for VCF Installer & SDDC Manager
  • VCF Software Depot Structure Deep Dive for Install & Upgrade
  • Side-loading VCF binaries into VCF Installer & SDDC Manager for Air-Gapped Environments
  • Enhancement in VCF 9.0.1 to bypass vSAN ESA HCL & Host Commission 10GbE NIC Check
  • Quick Tip - Custom JSON for Deploying VMware Cloud Foundation (VCF) with Custom TLS Certificates
  • Quick Tip - Establish trust between VCF 9.0 Installer and VCF Offline Depot w/self-sign TLS certificate
  • Clearing resource locks with VCF 9.0 Installer
  • VCF 9.0 Installer workaround for ESXi hosts with different vendor
  • Workaround for single NIC using NFS storage with VCF 9.0
  • Deploying VCF 9.0 on a single ESXi host?
  • vSAN ESA Disk & HCL workaround for VCF 9.0
  • Disable 10GbE NIC Pre-Check in the VCF 9.0 Installer
  • Using HTTP with VCF 9.0 Installer and SDDC Manager for Offline Depot

VCF Fleet

  • VCF 9.0 Fleet Latency Diagram
  • Flexible Combinations with VCF Fleet Deployment Models 
  • Multiple VCF SSO Identity Providers for VMware Cloud Foundation (VCF) Fleet?
  • How many VMware Cloud Foundation (VCF) Instances can a VCF Fleet support?

VCF Operations

  • Automating VCF 9.0 Single Sign-On (SSO) with OIDC-based Identity Provider
  • Simplify License Management across VCF Operations Fleet & Standalone Deployment for Monitoring
  • Automated Initial Configuration of VCF Operations 9 using CASA API
  • Automated Deployment of VCF Operations 9 OVA
  • Quick Tip - Reset vCenter Server from previously managed VCF Operations for VCF Single Sign-On (SSO)
  • Automating License Entitlement Workflows between VCF Operations & VCF Business Service Console (BSC)
  • Automating VCF Operations Objects & Metrics Reporting
  • Import vCenter Server with Single ESX Host as new VCF Workload Domain?
  • Capturing Kasa Smart Plug Power Metrics using VCF Operations Management Pack Builder
  • Automating VCF Operations Active Directory over LDAP Sync for VCF SSO
  • Automating VCF 9.0 Operations License Registration & Import for Air-Gapped Environments
  • VCF Single Sign-On (SSO) with Keycloak IdP
  • Applying 1st ESX Live Patch using VCF 9.0 Operations

VCF Automation

  • Managing Storage for VCF Automation (VCFA) Content Library Transfer Spooling Area
  • Enabling new vSphere Kubernetes Service (VKS) Cluster Management for VCF Automation (VCFA)
  • Configuring VCF Automation (VCFA) Organization Portal OIDC IdP using Terraform Provider for VCFA
  • Automating VCF Automation (VCFA) Configuration using VCFA Terraform Provider
  • Quick Tip - Workaround for High CPU usage for ccs-k3s-app in VCF 9.0 Automation
  • VCF Automation Provider Organization as an OIDC Identity Provider for VCFA Tenant Organizations?

NSX

  • Improved Workaround for NSX Edge Deployment & Upgrade to VCF 9.0.2 running AMD Ryzen CPUs
  • Quick Tip: Workaround for NSX Edge Upgrade to VCF 9.0.1 running AMD Ryzen CPUs
  • PowerCLI remediation script for running NSX Edge on AMD Ryzen for VCF 9.0

vSphere Supervisor

  • Quick Tip - Downloading VMware Cloud Foundation (VCF) Consumption CLI for Air-Gapped Environments
  • Quick Tip - Using VCF CLI to login to vSphere Supervisor when configured with VCF Automation
  • Quick Tip - vSphere Supervisor fails to complete due to vSAN Health Check Alerts
  • Quick Tip - Disable ESX Live Patching enforcement to enable vSphere Supervisor
  • Quick Tip - Configuring vSphere Supervisor Services with self-signed container registry

vSphere Kubernetes Service (VKS)

  • Dynamically Rebalance or Evacuate VKS Control Plane / Worker Nodes across vSphere Zones in VCF 9.0
  • Quick Tip - Configuring vSphere Kubernetes Service (VKS) Cluster with self-signed container registry

Data Services Manager (DSM)

  • Quick Tip - Workaround for failed VCFABinding for connecting VCF 9.0 Automation to Data Services Manager (DSM)

Private AI Services (PAIS)

  • Deploying Model Endpoint with DirectPath I/O using VMware for Private AI Services (PAIS)
  • Installing VMware Private AI Services (PAIS)
  • Configuring Data Services Manager (DSM) for VMware Private AI Services (PAIS)
  • Configuring Authentik Identity Provider VMware for Private AI Services (PAIS)
  • Configuring Model Store using Harbor for VMware for Private AI Services (PAIS)
  • Deploying VMware Private AI Services (PAIS)
  • Quick Tip - When using self-signed TLS Certificates with VCF Private AI Services (PAIS)

MS-A2 VCF 9.0 Lab: Deploying Model Endpoint with DirectPath I/O using VMware for Private AI Services (PAIS)

10.07.2025 by William Lam // Leave a Comment

In this final blog post, we will now deploy several AI model endpoints (downloaded from Hugging Face), configure our private data source which can be a shared location (Google Drive, Confluence, Microsoft Sharepoint, or S3-compatible endpoint) or using local files and then consuming them using an AI Agent that is built using VMware for Private AI Services (PAIS).

As mentioned in the very first blog post of this mini-series, my goal was to get hands experience with PAIS but without the need to have an NVIDIA GPU capable of vGPU, which would also require an NVIDIA AI for Enterprise (NVAIE) license.

Luckily, we can use an NVIDIA GPU via DirectPath I/O, thanks to the backend plumbing the PAIS Engineering team have built and had shared with me 😊

For my proof of concept, I am using an ASUS NUC 14 Performance, which has an NVIDIA GeForce RTX 4070 mobile GPU (8GB VRAM). The ASUS NUC 14 is running alongside my Minisforum MS-A2 setup, is only used to deploy the completions model endpoint. The use of the ASUS NUC 14 is purely for prototyping and experimentation purposes to demonstrate that anyone can play with PAIS within their lab environment. I plan to use a more powerful NVIDIA GPU setup, which I will share more details at a later point for those interested.

References:

  • Running Completion or Embedding Models by Using Model Endpoints
  • Adding Context to Model Responses by Using Knowledge Bases
  • Deploy an Agent for a Generative AI Application

Requirements:

  • VCF Automation (VCFA) Organization configured with Namespace
  • VMware Private AI Services (PAIS) enabled
  • Data Services Manager (DSM) configured with VCFA
  • Authentik IdP configured with OIDC Public Client Application
  • Harbor instance configured for AI model store 
  • PAIS instance deployed

[Read more...]

Categories // Private AI Services, VMware Cloud Foundation Tags // VCF 9.0

  • « Previous Page
  • 1
  • 2
  • 3
  • 4
  • 5
  • Next Page »

Search

Thank Author

Author

William is Distinguished Platform Engineering Architect in the VMware Cloud Foundation (VCF) Division at Broadcom. His primary focus is helping customers and partners build, run and operate a modern Private Cloud using the VMware Cloud Foundation (VCF) platform.

Connect

  • Bluesky
  • Email
  • GitHub
  • LinkedIn
  • Reddit
  • RSS
  • Twitter
  • Vimeo

Recent

  • Using VCF Download Tool (VCFDT) with a Kerberos-Authenticated HTTPS Proxy 09/21/2026
  • VCF 9.1.1 - Connecting Pi Coding Agent to VCF Private AI Services (PAIS) 09/17/2026
  • Quick Tip - Automating vDefend Security Services Platform (SSP) 5.2.0 Installer OVA Deployment 09/16/2026
  • VCF 9.1.1 - Simplified vSphere Kubernetes Service (VKS) using VLAN-Backed VPCs without NSX Tunnel Endpoints (TEPs) 09/15/2026
  • VCF 9.1.1 - Using VCF Private AI Services (PAIS) Models with AI Assistant for VCF 09/11/2026
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.

To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2026