VCF 9.1.1: How to Deploy Your Own Models with VCF Private AI Services (PAIS) 3.0

# Quick summary

# What you need before you begin

• vSphere Supervisor configured with VPC networking (Centralized or Distributed Transit Gateway).
• PAIS Supervisor Service enabled.
• VCF Consumption CLI, Docker client, and Hugging Face (HF) CLI on your workstation.
• NVIDIA GPU available via ESXi DirectPath I/O or vGPU.
• Access to a local Harbor registry (VCF Infrastructure Services (VIS) Fling can be used for PoC).

# Model download and registry push

1. 1Download model files with the HF CLI into a local directory. Example models used in the walkthrough: Gemma 4 26B GGUF and Qwen3.8 27B GGUF.
2. 2Change into each model folder and push to your Harbor project (models) using the VCF Consumption CLI: vcf pais models push --modelName / --modelStore: /models -t
3. 3The full model URI is the registry path plus tag, for example vis.vcf.lab:9443/models/unsloth/qwen3.8-27b-gguf:v1.0. Keep this URI for deployment.

# ESXi and vSphere namespace setup

• Enable DirectPath I/O on the ESXi host that hosts the physical NVIDIA GPU. DirectPath requires reserved memory in the VM configuration.
• Create a vSphere Namespace for PAIS (example name: pais). Choose a Storage Policy and create a VM Class that includes the DirectPath I/O device, vCPU and reserved memory appropriate for the model runtime (example VM Class: nvidia-a2000-rtx with 8 vCPUs and 32GB reserved memory).
• For the VKS control plane VMs that PAIS provisions, use at least a best-effort-medium VM Class or larger depending on expected workload.

# Deploying PAIS and model runtime

• In vCenter, open Supervisor Management > Namespaces > Namespace > Resources and use the Local Consumption UI to deploy PAIS. Choose Model Runtime Only and select the Storage Class and VM Class for the VKS control plane.
• Configure how users will authenticate to PAIS: connect an OIDC provider that supports Authorization Code with PKCE, or use PAIS 3.0 local user accounts. Note a UI requirement: the Issuer Base URL field requires a valid HTTPS URL even when using local user accounts.

# Notes and practical tips

• Use Harbor project organization (for example, models) so PAIS can consistently reference artifacts.

• For air-gapped environments, mirror artifacts into your local registry before pushing to Harbor.

# Next steps

• Deploy the model runtime using the model URI and verify the OpenAI-compatible endpoint.
• Optionally connect the PAIS model endpoint to AI Assistant for VCF or other local consumers that support OpenAI-compatible APIs.