Accessing a Real-Time Service Through a Private Network

Context

During enterprise-grade application development, when developers need to access the real-time inference service provided by ModelArts from the enterprise intranet, access obstacles may occur due to network isolation, affecting development efficiency and security. ModelArts supports accessing real-time services via private networks.

Private network access is suitable for scenarios requiring high security and low latency. For private network connection to real-time services, creating a VPCEP within one's own VPC or resource pool VPC offers a convenient, secure, and private channel to connect to the real-time inference service. ModelArts facilitates private network connectivity; by initiating a private network connection request, it automatically creates a VPCEP, establishing a direct private network connection between the VPC and the real-time inference service, thereby enabling efficient and secure access to the real-time inference service over the private network.

Permissions

When using the private network connection function, you must have the following permissions:

You also need to grant the agency permissions below to ModelArts. For details about how to add ModelArts authorization, see Configuring Agency Authorization for ModelArts with One Click.

Constraints

• In the user network scenario, private network connection is VPC-based. You can create only one private network connection for a service in the same VPC. You can only select your own VPC network to access the private network.
• In the resource pool network scenario, private network connection is resource pool network-based. You can create only one private network connection for a resource pool in the same resource pool network.

Prerequisites

• The real-time service is running properly.
• You have obtained the real-time service ID on the service details page by clicking the service name in the inference service list.
  Figure 1 Obtaining the real-time service ID
  

• To enable the private network connection between your VPC and inference service, create a VPC and subnet first. For details, see Creating a VPC with a Subnet.
• To enable the private network connection between your resource pool and inference service, create a dedicated resource pool first. For details, see Creating a Dedicated Resource Pool.

Creating a Private Network Connection

1. Log in to the ModelArts console. In the navigation pane, choose Model Inference > Real-Time Inference.
2. Click Private Network Connections.
3. Click the My Requests tab. Then, click Create.
4. Set parameters and click OK.

   Check the request status in the My Requests tab. If the request status is Connection succeeded, the request is approved. Record the Access Address. If Auto-approved Private Network Connection is selected during service information configuration, the requests from third-party users will be approved automatically.

   When the request is in the Abnormal state and the reason is "Connection failed. Try again", click Retry in the Operation column to create the private network connection again.

   After the private network connection request is approved, if the request scenario is user network, see Accessing a Real-Time Service Using Your VPC. If the request scenario is resource pool network, see Accessing a Real-Time Service Using a Resource Pool Network.

   Table 3 Parameters for private network connection request

   Parameter	Description
   Service ID	ID of the inference service that needs to be accessed through the private network. Enter the inference service ID obtained in Prerequisites.
   Network Type	Scenario for the private network connection request. User network: Connect the private network between your VPC and inference service. Resource pool network: Connect the private network between your resource pool and inference service.
   VPC	When you select User network, choose a VPC for private network connection. If you have not created any VPC and subnet, go to the VPC console to create them. For details, see Creating a VPC with a Subnet.
   Subnet	When you select User network, choose a subnet for private network connection.
   Resource Pool	When you select Resource pool network, choose a resource pool for private network connection. If you have not created any dedicated resource pool, go to the ModelArts console to create one. For details, see Creating a Dedicated Resource Pool.
   Custom Access Address	You can add custom domain names for service calls within your network. Make sure the address is correct to avoid access issues. Click Add, select Protocol, and enter Domain Name (Host) and Path. You can select the default or custom path. Each private network connection instance supports up to 10 custom URLs.

Accessing a Real-Time Service Using Your VPC

1. Before accessing a real-time service using your VPC, create a private network connection for the service and choose User network as the scenario. For details, see Creating a Private Network Connection. After the request status is Connection succeeded, the request is approved.

2. Go to the Buy ECS page to purchase an ECS. Select the VPC in Creating a Private Network Connection. For details about more parameters, see Purchasing an ECS.

3. Log in to the ECS and call the access address and API of the inference service displayed in the private network connection list on the ECS. For details about how to log in to an ECS, see Logging In to an ECS.

Accessing a Real-Time Service Using a Resource Pool Network

1. Before accessing a real-time service using your VPC, create a private network connection for the service and choose Resource pool network as the scenario. For details, see Creating a Private Network Connection. After the request status is Connection succeeded, the request is approved.
2. In the Resource Management > Resource Pools list, click the name of the target resource pool. On the resource pool details page that is displayed, obtain the ID of the resource pool.

   Old navigation path: In the Resource Management > Dedicated Resource Pool list, click the name of the target resource pool. On the resource pool details page that is displayed, obtain the ID of the resource pool.

3. Go to the CCE console. Locate the cluster corresponding to the resource pool based on the resource pool ID, and click the cluster name to access the cluster.
4. Choose Workloads on the left, select the corresponding namespace, and view the workload list.
5. Click the workload name to access the desired workload and remotely log in to the container.
6. After accessing the container, run the curl command to access the API. The address is the access address displayed after the private network connection is successfully created.
   Figure 2 Accessing a real-time service
   

FAQs

What should I do if the address displayed in the private network connection list is unreachable after I purchase an ECS?

Check whether the ECS security group is open.

Managing Private Network Connections

• Deleting a private network connection request

  If a private network connection is not required anymore, delete it.

  1. Log in to the ModelArts console. In the navigation pane, choose Model Inference > Real-Time Inference.
  2. Click Private Network Connections.
  3. Switch to the My Requests tab and click Delete in the Operation column.
  4. In the displayed dialog box, confirm the information, enter DELETE, and click OK.
• Approving or rejecting a pending private network connection request

  If you are the private network connection request approver, you can approve or reject requests submitted by third parties in My Approvals.

  1. Log in to the ModelArts console. In the navigation pane, choose Model Inference > Real-Time Inference.
  2. Click Private Network Connections.
  3. In the My Approvals tab, click Approve in the Operation column to approve the private network connection request. Click Reject in the Operation column to reject the request.
• Canceling authorization

  If you are the private network connection request approver, you can cancel the authorization to reject the request again.

  1. Log in to the ModelArts console. In the navigation pane, choose Model Inference > Real-Time Inference.
  2. Click Private Network Connections.
  3. In the My Approvals tab, click Revoke Authorization in the Operation column. In the displayed dialog box, click OK.