MaaS Access Through a Private Network

How the VPCEP Private Network Channel Works

The following figure shows the different paths and processing methods for accessing MaaS through the public network and private network.

Figure 1 Public network access and private network access

Create a VPC endpoint in your VPC to establish a unidirectional private network connection with MaaS. Resources in the VPC access MaaS through the VPCEP. The traffic is transmitted within the Huawei Cloud private network and does not pass through the public network. MaaS cannot access your VPC resources through this connection.

• Unidirectional access: The network ACL policy allows you to access MaaS only in one direction. MaaS cannot access your VPC in return.
• Dual-channel access: MaaS provides dual-channel access. You need to create two VPC endpoints, and the private network DNS resolves the two VPC endpoints to ensure high availability.
• Supported regions: CN-Hong Kong.
• VPC endpoints cannot be accessed from the public network and cannot be bound to EIPs.

Procedure

To access MaaS through the VPC private network, perform the following steps:

1. Create a VPC endpoint.
   

   • The region where the VPC is located is the same as the region where the MaaS service is deployed.
   • To ensure high reliability, you must create two VPC endpoints. MaaS provides two VPCEP service IDs. You need to create a VPC endpoint for each service ID.
   • VPC endpoints are billed based on the subscription duration.
   1. Go to the VPC Endpoint console and click Buy VPC Endpoint.
   2. Configure the parameters by referring to Buying a VPC Endpoint. When configuring the service name, select the VPCEP service ID provided by MaaS. (The service ID can be obtained by submitting a service ticket.)

      

   3. After the creation is successful, record the VPCEP IP address.

      

   4. Repeat steps 1 and 2 to create the second VPC endpoint.

2. Configure private DNS resolution.
   1. Log in to the DNS console and click Private Zones.
   2. Create a private zone (api-ap-southeast-1.modelarts-maas.com) by referring to Creating a Private Zone. After the private zone is created, it is displayed on the list page.
      

      • The private domain name must be the domain name specified in this document.
      • You must select Recursive resolution proxy for subdomains. Otherwise, services will be interrupted before the record is added.
      • When associating a VPC, ensure that the selected region and VPC are the same as those used during VPC endpoint creation.
      Figure 2 Creating a private zone for accessing MaaS
      
      Figure 3 Private zone list
      Figure 4 Private zone list
      

   3. Click the domain name. The record sets page is displayed by default. Click Add Record Set. In the displayed dialog box, configure the parameters according to the following table and click OK. After the configuration is successful, the added record set is displayed in the record set list.

      Table 1 Parameters for adding a record set

      Parameter	Example Value
      Type	A – Map the domain name to the IPv4 address.
      TTL (s)	300s by default
      Value	Enter the IP addresses of the two VPC endpoints created in 1.

      Figure 5 Record set list
      

3. Call the MaaS model API.
   1. Log in to the node where the service is deployed.
   2. Run the following command to verify the private network connectivity:

      ping api-ap-southeast-1.modelarts-maas.com

   3. Run the following code to call the MaaS model API. If the request is successful, the private network link is connected.

      curl -X POST "https://api-ap-southeast-1.modelarts-maas.com/v2/chat/completions" \
        -H "Content-Type: application/json" \
        -H "Authorization: Bearer $MAAS_API_KEY" \
        -d '{
          "model": "glm-5.2",
          "messages": [
            {"role": "system", "content": "You are a helpful assistant."},
            {"role": "user", "content": "Introduce yourself."}
          ]
        }'