热门内容

今日:


总体:


最近浏览：


x

[Azure AI Studio]如何为Azure AI Studio中心配置私有链接

Chinese, Simplified
SEO Title
Azure AI Studio - How to configure a private link for Azure AI Studio hubs

category

重要事项
本文中描述的一些功能可能仅在预览版中可用。此预览版没有服务级别协议，我们不建议将其用于生产工作负载。某些功能可能不受支持或功能受限。有关详细信息，请参阅Microsoft Azure预览版的补充使用条款。


我们有两个网络隔离方面。一个是访问Azure AI Studio中心的网络隔离。另一个是集线器和项目中计算资源的网络隔离，如计算实例、无服务器和托管在线端点。本文解释了图中突出显示的前者。您可以使用私有链接建立与集线器及其默认资源的私有连接。本文适用于Azure AI Studio（中心和项目）。有关Azure AI服务的信息，请参阅Azure AI服务文档。

您的资源组中有几个中心默认资源。您需要配置以下网络隔离配置。

  • 禁用中心默认资源（如Azure存储、Azure密钥库和Azure容器注册表）的公共网络访问。
  • 建立与集线器默认资源的专用端点连接。默认存储帐户需要同时具有blob和文件专用终结点。
  • 管理身份配置，允许集线器访问您的私有存储帐户。
  • Azure AI搜索应该是公开的。

Prerequisites

  • You must have an existing Azure Virtual Network to create the private endpoint in.

    Important

    We do not recommend using the 172.17.0.0/16 IP address range for your VNet. This is the default subnet range used by the Docker bridge network or on-premises.

  • Disable network policies for private endpoints before adding the private endpoint.

Create a hub that uses a private endpoint

Use one of the following methods to create a hub with a private endpoint. Each of these methods requires an existing virtual network:

  1. From the Azure portal, go to Azure AI Studio and choose + New Azure AI.
  2. Choose network isolation mode in Networking tab.
  3. Scroll down to Workspace Inbound access and choose + Add.
  4. Input required fields. When selecting the Region, select the same region as your virtual network.

Add a private endpoint to a hub

Use one of the following methods to add a private endpoint to an existing hub:

  1. From the Azure portal, select your hub.
  2. From the left side of the page, select Networking and then select the Private endpoint connections tab.
  3. When selecting the Region, select the same region as your virtual network.
  4. When selecting Resource type, use azuremlworkspace.
  5. Set the Resource to your workspace name.

Finally, select Create to create the private endpoint.

Remove a private endpoint

You can remove one or all private endpoints for a hub. Removing a private endpoint removes the hub from the Azure Virtual Network that the endpoint was associated with. Removing the private endpoint might prevent the hub from accessing resources in that virtual network, or resources in the virtual network from accessing the workspace. For example, if the virtual network doesn't allow access to or from the public internet.

Warning

Removing the private endpoints for a hub doesn't make it publicly accessible. To make the hub publicly accessible, use the steps in the Enable public access section.

To remove a private endpoint, use the following information:

  1. From the Azure portal, select your hub.
  2. From the left side of the page, select Networking and then select the Private endpoint connections tab.
  3. Select the endpoint to remove and then select Remove.

Enable public access

In some situations, you might want to allow someone to connect to your secured hub over a public endpoint, instead of through the virtual network. Or you might want to remove the workspace from the virtual network and re-enable public access.

Important

Enabling public access doesn't remove any private endpoints that exist. All communications between components behind the virtual network that the private endpoint(s) connect to are still secured. It enables public access only to the hub, in addition to the private access through any private endpoints.

To enable public access, use the following steps:

  1. From the Azure portal, select your hub.
  2. From the left side of the page, select Networking and then select the Public access tab.
  3. Select Enabled from all networks, and then select Save.

Managed identity configuration

A manged identity configuration is required if you make your storage account private. Our services need to read/write data in your private storage account using Allow Azure services on the trusted services list to access this storage account with following managed identity configurations. Enable the system assigned managed identity of Azure AI Service and Azure AI Search, then configure role-based access control for each managed identity.

Role Managed Identity Resource Purpose Reference
Storage File Data Privileged Contributor Azure AI Studio project Storage Account Read/Write prompt flow data. Prompt flow doc
Storage Blob Data Contributor Azure AI Service Storage Account Read from input container, write to pre-process result to output container. Azure OpenAI Doc
Storage Blob Data Contributor Azure AI Search Storage Account Read blob and write knowledge store Search doc.

Custom DNS configuration

See Azure Machine Learning custom DNS article for the DNS forwarding configurations.

If you need to configure custom DNS server without DNS forwarding, use the following patterns for the required A records.

  • <AI-STUDIO-GUID>.workspace.<region>.cert.api.azureml.ms

  • <AI-PROJECT-GUID>.workspace.<region>.cert.api.azureml.ms

  • <AI-STUDIO-GUID>.workspace.<region>.api.azureml.ms

  • <AI-PROJECT-GUID>.workspace.<region>.api.azureml.ms

  • ml-<workspace-name, truncated>-<region>-<AI-STUDIO-GUID>.<region>.notebooks.azure.net

  • ml-<workspace-name, truncated>-<region>-<AI-PROJECT-GUID>.<region>.notebooks.azure.net

    Note

    The workspace name for this FQDN might be truncated. Truncation is done to keep ml-<workspace-name, truncated>-<region>-<workspace-guid> at 63 characters or less.

  • <instance-name>.<region>.instances.azureml.ms

    Note

    • Compute instances can be accessed only from within the virtual network.
    • The IP address for this FQDN is not the IP of the compute instance. Instead, use the private IP address of the workspace private endpoint (the IP of the *.api.azureml.ms entries.)

  • <instance-name>.<region>.instances.azureml.ms - Only used by the az ml compute connect-ssh command to connect to computes in a managed virtual network. Not needed if you are not using a managed network or SSH connections.

  • <managed online endpoint name>.<region>.inference.ml.azure.com - Used by managed online endpoints

To find the private IP addresses for your A records, see the Azure Machine Learning custom DNS article. To check AI-PROJECT-GUID, go to the Azure portal, select your project, settings, properties, and the workspace ID is displayed.

Limitations

  • Private Azure AI Services and Azure AI Search aren't supported.
  • The "Add your data" feature in the Azure AI Studio playground doesn't support private storage account.
  • You might encounter problems trying to access the private endpoint for your hub if you're using Mozilla Firefox. This problem might be related to DNS over HTTPS in Mozilla Firefox. We recommend using Microsoft Edge or Google Chrome.

Next steps

本文地址
https://architect.pub
发布日期
星期一, 八月 12, 2024 - 10:54
最后修改
星期一, 八月 12, 2024 - 10:54

Tags

Article
Read more

最新内容

↑