WilliamLam.com

10 Exciting Enhancements in VMware Cloud Foundation 9.1.1

by // 15 Comments

This has been an exciting week as VMware Explore 2026 takes place in Las Vegas, where I have been meeting with customers and partners while delivering several technical breakout sessions and workshops. To coincide with the event, we have also announced the general availability of VMware Cloud Foundation (VCF) 9.1.1, the first maintenance release for VCF 9.1! 🥳

Note: While there is no defined patch sequence for maintenance and EPs, there is a special exception that you should be aware specifically for VCF 9.1.1 release which will have a couple of specific sequence that must be followed (pre-checks already built into the release). These exceptions will be removed in a future maintenance release, but just something to be aware of

  • Fleet LCM must be patched to 9.1.1 before updating other VCF components to 9.1.1
  • VCFMS must be updated to 9.1.1 before updating Identity broker, Salt Master/RaaS component to 9.1.1
  • VCF Automation (VCFA) must be updated to 9.1.1 before updating VCD Migrator component to 9.1.1

As a maintenance release, it includes all cumulative bug fixes and security updates from previous Express Patches (EPs), along with platform stability improvements and enhancements that simplify the journey to VCF 9.1.

While there are many improvements in this release, here are ten that I think are worth highlighting.

[Read more...]

Configuring OIDC with PKCE in Keycloak for VCF Private AI Services

by // Leave a Comment

I have taken a short hiatus from playing with my NVIDIA RTX 4000, which fits perfectly inside a Minisforum MS-A2 and is what I use to run VMware Cloud Foundation (VCF) 9.1. While redeploying my environment to test an upcoming release of VCF Private AI Services (PAIS), I was reminded that the deployment requires an OIDC provider that supports the Authorization Code grant flow with PKCE (Proof Key for Code Exchange).

When I originally deployed PAIS with VCF 9.0, I used Authentik as my identity provider (IdP). With my VCF Infrastructure Services (VIS) Appliance which provides a number of services including Keycloak as an OIDC provider, I wanted to figure out the required Keycloak configuration to satisfy the PAIS OIDC requirements, especially as this can help accelerate Lab/PoC deployments.

After some trial and error, and with the help of OpenAI Codex to debug my live environment, I now have Keycloak successfully configured with PAIS, along with a script to generate the access token required to interact with a PAIS Model Endpoint! 🥳

[Read more...]

VCF 9.1 - Understanding VCF Converge & Import Scenarios for vCenter Server Without NSX

by // 2 Comments

When converging or importing a vCenter Server environment that does not already include NSX, VMware Cloud Foundation (VCF) will automatically deploy NSX as part of the converge or import workflow. While the deployed NSX version will be compatible with the existing environment, it may have implications for future VCF upgrade paths.

The current behavior in VCF 9.1.0 is to deploy the latest NSX version that is compatible with the source vCenter Server version. However, depending on when the converge or import workflow is performed, that NSX version could be a back-in-time release that does not have a direct upgrade path to the current version of VCF.

Below is an example to help illustrate the current behavior. Let us assume we are starting with a vCenter Server 8.0 Update 3c environment. As of this blog post, the Interoperability Matrix, which is the source used to determine component compatibility, shows NSX 4.2.4.1 as the latest compatible version.


Reference: https://interopmatrix.broadcom.com/Interoperability?col=912,&row=2,18560&isHidePatch=false&isHideLegacyReleases=false

[Read more...]