WilliamLam.com

Configuring OIDC with PKCE in Keycloak for VCF Private AI Services

by // Leave a Comment

I have taken a short hiatus from playing with my NVIDIA RTX 4000, which fits perfectly inside a Minisforum MS-A2 and is what I use to run VMware Cloud Foundation (VCF) 9.1. While redeploying my environment to test an upcoming release of VCF Private AI Services (PAIS), I was reminded that the deployment requires an OIDC provider that supports the Authorization Code grant flow with PKCE (Proof Key for Code Exchange).

When I originally deployed PAIS with VCF 9.0, I used Authentik as my identity provider (IdP). With my VCF Infrastructure Services (VIS) Appliance which provides a number of services including Keycloak as an OIDC provider, I wanted to figure out the required Keycloak configuration to satisfy the PAIS OIDC requirements, especially as this can help accelerate Lab/PoC deployments.

After some trial and error, and with the help of OpenAI Codex to debug my live environment, I now have Keycloak successfully configured with PAIS, along with a script to generate the access token required to interact with a PAIS Model Endpoint! 🥳

[Read more...]

VCF 9.1 - Understanding VCF Converge & Import Scenarios for vCenter Server Without NSX

by // 2 Comments

When converging or importing a vCenter Server environment that does not already include NSX, VMware Cloud Foundation (VCF) will automatically deploy NSX as part of the converge or import workflow. While the deployed NSX version will be compatible with the existing environment, it may have implications for future VCF upgrade paths.

The current behavior in VCF 9.1.0 is to deploy the latest NSX version that is compatible with the source vCenter Server version. However, depending on when the converge or import workflow is performed, that NSX version could be a back-in-time release that does not have a direct upgrade path to the current version of VCF.

Below is an example to help illustrate the current behavior. Let us assume we are starting with a vCenter Server 8.0 Update 3c environment. As of this blog post, the Interoperability Matrix, which is the source used to determine component compatibility, shows NSX 4.2.4.1 as the latest compatible version.


Reference: https://interopmatrix.broadcom.com/Interoperability?col=912,&row=2,18560&isHidePatch=false&isHideLegacyReleases=false

[Read more...]

VCF 9.1 - Configuring Harbor to use VCF Identity Broker (IDB) for External Identity Federation

by // 1 Comment

Similar to Configuring vSphere Supervisor to use VMware Cloud Foundation (VCF) Identity Broker (IDB) for external identity federation, Harbor also supports OpenID Connect (OIDC) identity providers (IdPs). This would allow Harbor or any components that support OIDC-based IdP to leverage our existing VCF IDB instance that is already integrated with VCF Single Sign-On (SSO), reducing the need to create an additional OIDC client configurations from the IdP itself.

Since I already had VCF Single Sign-On (SSO) configured with Keycloak using my VCF Infrastructure Services (VIS) Appliance Fling, it was easy for me to validate and demonstrate this integration after coming across a question about it this morning in one of our internal Google channels 🙂

[Read more...]