Browsing: Guides & Tutorials

TL;DR Deploying VMware Private AI Foundation with NVIDIA on VCF 9.1 is not a single-product installation. It is an integrated platform deployment spanning the VCF workload domain, GPU-enabled ESXi hosts, NVIDIA drivers and licensing, vSphere Supervisor, namespaces, Private AI Services, Harbor, identity, networking, certificates, and the AI consumption model. The most important design decision happens before Private AI Services is installed: determine whether users need individually managed Deep Learning VMs, cloud-native VKS clusters, or both. That decision influences GPU allocation, networking, storage, automation, lifecycle management, and recovery. For environments that require VCF Automation, multi-tenancy, self-service networking, and governed AI catalogs,…

Introduction Enterprise AI architecture is often drawn from the compute layer outward. The GPU cluster sits in the middle, Kubernetes or virtual machines surround it, and storage appears as one cylinder at the bottom labeled data. That drawing is convenient, but it hides the design problem that causes many AI platforms to underperform or become expensive to operate. An AI factory is not one workload. It is a data pipeline that repeatedly lands, transforms, shares, reads, rewrites, versions, serves, observes, protects, and eventually retires data. The raw corpus entering the platform does not behave like a vector database. A model…

VMware Cloud Foundation 9.1 became available on May 12, 2026, as build 25377994. The release covers infrastructure efficiency, Kubernetes operations, private AI, cyber resilience, platform scale, and lifecycle improvements. The headline features are significant, but they are not the whole story. [A] The more consequential change is architectural. VCF 9.1 consolidates more fleet lifecycle, software-depot, identity, logging, and operational functions into a common management-services model. It also introduces centralized license services and changes how several existing appliances and integrations fit into the platform. That means this is not simply an ESX, vCenter, NSX, and vSAN version update. It changes what…

TL;DR Do not create a VMware Cloud Foundation workload domain every time a tenant, business unit, application, or security team asks for separation. In VCF 9.1, the correct design is usually to choose the smallest boundary that satisfies the strongest verified requirement. A subnet or segment separates network attachment. An NSX VPC separates application networking, routing, addressing, and delegated policy. An NSX project creates a broader tenant and administrative scope for quotas, shared services, and multiple VPCs. A dedicated cluster creates a physical compute, maintenance, capacity, and failure boundary. A workload domain creates a separate vCenter-centered inventory and lifecycle boundary,…

Introduction NVIDIA NIM can operate without Internet access, but that statement is easy to oversimplify. The container does not become air-gap ready merely because an administrator pulled it once. A production NIM service depends on a complete software and artifact chain: the OCI image, model weights, model profiles, runtime manifests, GPU drivers, container runtime integration, Kubernetes operators, storage classes, certificates, secrets, and a repeatable update process. If any one of those dependencies still points to a public registry or model repository, the deployment is disconnected only until the next cold start, node replacement, scaling event, or security patch. NVIDIA’s current…

TL;DR An AI agent should never authenticate to enterprise tools by borrowing a human password, copying a browser session, or carrying one broadly privileged user token through an entire workflow. The stronger pattern combines a dedicated workload identity for the agent, explicit delegated authority when a user is involved, token exchange for each downstream resource, short-lived credentials, per-tool permissions, and audit records that preserve both the requesting subject and the acting agent. The central design principle is simple: The agent must have its own identity, even when it is acting with someone else’s authority. Introduction The moment an AI agent…

Prompt libraries are useful because they standardize intent. They give teams a repeatable way to ask for summaries, analysis, troubleshooting help, change planning, architecture review, customer response drafts, and operational recommendations. A good prompt library reduces randomness. It gives engineers, architects, operators, and technical leaders a shared starting point. But prompt maturity creates a new problem. Once an AI system moves beyond answering questions and starts touching tools, workflows, tickets, repositories, logs, identity data, cloud APIs, or change records, the prompt library is no longer enough. The prompt may describe how the agent should behave. Policy has to define what…

TL;DR Treat every production AI change as a versioned behavior release, not as an isolated model, prompt, or tool edit. Package the model identifier, prompt content, tool schemas, retrieval settings, policy, runtime code, and evaluation thresholds into one immutable release bundle. Prove the candidate offline, replay production traffic in shadow mode without side effects, move a sticky cohort through a measured canary, compare complete traces against the stable release, and automatically roll back when a hard safety, correctness, reliability, or cost threshold is breached. The rollback target must be the last known-good bundle. Reverting only the model while leaving a…

TL;DR The NVIDIA GPU Operator automates the software stack required to make GPUs usable by Kubernetes workloads. It can deploy and manage NVIDIA drivers, the NVIDIA Container Toolkit, the Kubernetes device plugin, GPU Feature Discovery, DCGM Exporter, MIG Manager, and validation components. A successful installation requires more than running a Helm command. The GPU hardware must be visible to the operating system, the Kubernetes and Linux versions must be supported, the driver ownership model must be decided, the container runtime must be compatible, and the device plugin must successfully advertise nvidia.com/gpu resources to Kubernetes. This guide installs a pinned GPU…

Teams are giving AI agents access to tools faster than they are defining the security boundaries between the agent, the protocol, the tool, and the user. That is the part that matters. Most early agent projects start with a simple integration question: “How do I let this agent query a database, call an API, open a ticket, or delegate work to another agent?” That question quickly turns into a control-plane problem. Which identity is being used? Which tool was discovered? Who authorized the action? Can the request be inspected? Can the response leak sensitive data? Can a compromised tool description…