Partner Highlight: Broadcom's VMware Cloud Foundation (VCF)

Running AI privately answered a question about where your data goes. Agents raise a harder set. An agent acts: it reasons over confidential data, calls tools wired into production systems, and takes those actions on someone's behalf. Every answer you already have for models needs a matching answer for agents, and it has to hold at runtime, on every call.

‍

VMware Cloud Foundation is where that infrastructure already lives. One platform and one control plane across VMs and containers, with VMware vSphere Kubernetes Service (VKS) providing the Kubernetes runtime built directly into it. With CNCF certified Kubernetes, VKS enables platform engineers to deploy and manage Kubernetes clusters while leveraging a comprehensive set of cloud services in VCF.

‍

Private AI Services adds the AI layer: a curated model gallery and runtime, vector search and retrieval for RAG, a governed MCP tools registry, and observability spanning models and GPUs. It installs into fully disconnected environments. Your teams choose the models, run them on hardware you own, and keep the data inside your boundary.

‍

Kagent and agentgateway extend that same control to agents. Kagent makes agents first-class workloads on the clusters you already operate, declarative and managed through the kubectl and GitOps workflows your teams use for everything else, with lifecycle control, agent-level RBAC, and human approval on sensitive actions. Agentgateway sits underneath as one policy and telemetry plane across every model call, every tool call over MCP, and every exchange between agents. Each agent sees only the tools it is authorized to use, identity carries through the call chain, and every action lands in an audit trail. Both run in-cluster, with no vendor control plane in the path and no agent traffic leaving your perimeter.

‍

Solo Enterprise for Istio is now validated on VKS. It adds the service network on top of VKS: mutual TLS, workload identity, and L7 traffic policy for every service. It runs in ambient mode, so there is nothing to inject into application pods and nothing to restart.

‍

The joint reference architecture covers two VKS clusters peered into a single mesh through east-west gateways, with mesh certificates issued by the VKS cert-manager add-on from a shared root CA. Services marked global are reachable from either cluster. Traffic stays local while local endpoints are healthy, and fails over to the other cluster with no change to the client. The Solo UI shows every cluster, workload, and policy in one place, with request rate, latency, and error metrics collected from ztunnel without touching the applications.