WilliamLam.com

VCF 9.1.1 - Simplified vSphere Kubernetes Service (VKS) using VLAN-Backed VPCs without NSX Tunnel Endpoints (TEPs)

by // 1 Comment

As part of the VMware Cloud Foundation (VCF) 9.1.1 release, consuming NSX Virtual Private Cloud (VPC) has gotten simpler, especially for environments using traditional VLAN-backed networks. In VCF 9.1.0, users already had the ability to configure a VPC using a Distributed Transit Gateway (DTGW) and Distributed VLAN through the NSX Virtual Network Appliance (VNA), but this still required configuring NSX Tunnel Endpoints (TEPs) on each ESX host.

With VCF 9.1.1, the networking workflow has been further simplified with a new VLAN-backed VPC option. While it still uses DTGW and VNA, TEPs are no longer required, removing additional network requirements such as a larger MTU. As a result, environments that previously could not meet the networking requirements to configure a VPC can now deploy and consume services such as vSphere Kubernetes Service (VKS) and VCF Automation (VCFA).

It is also important to understand the different VPC consumption options and their constraints. The following table summarizes the capabilities and limitations of each option.


Note: DTGW with TEP was possible with VCF 9.0.0 but there was no support for VCFA until VCF 9.1.0.

[Read more...]

10 Exciting Enhancements in VMware Cloud Foundation 9.1.1

by // 18 Comments

This has been an exciting week as VMware Explore 2026 takes place in Las Vegas, where I have been meeting with customers and partners while delivering several technical breakout sessions and workshops. To coincide with the event, we have also announced the general availability of VMware Cloud Foundation (VCF) 9.1.1, the first maintenance release for VCF 9.1! 🥳

Note: While there is no defined patch sequence for maintenance and EPs, there is a special exception that you should be aware specifically for VCF 9.1.1 release which will have a couple of specific sequence that must be followed (pre-checks already built into the release). These exceptions will be removed in a future maintenance release, but just something to be aware of

  • Fleet LCM must be patched to 9.1.1 before updating other VCF components to 9.1.1
  • VCFMS must be updated to 9.1.1 before updating Identity broker, Salt Master/RaaS component to 9.1.1
  • VCF Automation (VCFA) must be updated to 9.1.1 before updating VCD Migrator component to 9.1.1

As a maintenance release, it includes all cumulative bug fixes and security updates from previous Express Patches (EPs), along with platform stability improvements and enhancements that simplify the journey to VCF 9.1.

While there are many improvements in this release, here are ten that I think are worth highlighting.

[Read more...]

Configuring OIDC with PKCE in Keycloak for VCF Private AI Services

by // Leave a Comment

I have taken a short hiatus from playing with my NVIDIA RTX 4000, which fits perfectly inside a Minisforum MS-A2 and is what I use to run VMware Cloud Foundation (VCF) 9.1. While redeploying my environment to test an upcoming release of VCF Private AI Services (PAIS), I was reminded that the deployment requires an OIDC provider that supports the Authorization Code grant flow with PKCE (Proof Key for Code Exchange).

When I originally deployed PAIS with VCF 9.0, I used Authentik as my identity provider (IdP). With my VCF Infrastructure Services (VIS) Appliance which provides a number of services including Keycloak as an OIDC provider, I wanted to figure out the required Keycloak configuration to satisfy the PAIS OIDC requirements, especially as this can help accelerate Lab/PoC deployments.

After some trial and error, and with the help of OpenAI Codex to debug my live environment, I now have Keycloak successfully configured with PAIS, along with a script to generate the access token required to interact with a PAIS Model Endpoint! 🥳

[Read more...]