Deploy an EAS service with a dedicated gateway-Platform For AI(PAI)-阿里云帮助中心

Billing

Fees come from the associated ALB instances. Enabling private and public network access creates one ALB instance each. If you enable both, two instances are created, and the fees are cumulative. ALB billing rules.

Network planning

Plan your network before configuration to avoid rework and extra costs.

Important

The public network ALB, private network ALB, and EAS service must be in the same VPC. The VPC of an ALB instance cannot be changed after creation. If you misconfigure the VPC, you must delete and recreate the instance.

Before you begin:

Identify the VPC ID and zones that you plan to use.
Ensure that at least two vSwitches in different zones are available in the VPC.
Decide whether to enable public network access, private network access, or both.

Procedure

Step 1: Create a gateway configuration

Create a logical gateway configuration. This step does not create cloud resources or incur fees.

Log on to the PAI console. Select a region on the top of the page. Then, select the desired workspace and click Elastic Algorithm Service (EAS).
On the Inference Gateway tab, click Create Dedicated Gateway and select Application Load Balancer.
The system checks your service-linked role permissions. If prompted, follow the on-screen instructions to grant the required permissions.
Enter a name for the gateway and click Submit.

Note

You can set a dedicated gateway as the default gateway. The system then automatically selects it when you deploy a service.

Step 2: Enable network access

Enable private or public network access. Each access type creates a separate ALB instance.

Important

The VPC must match the VPC you configure for the service. If you enable both access types, the VPC must be the same for both.

In the list on the Inference Gateway tab, click the name of the ALB gateway to open its details page.
In the Gateway Access Control section, enable private network access, public network access, or both, as needed.
Private network
1. On the VPC tab, click Add VPC.
2. In the configuration drawer, select a VPC and vSwitches. The VPC must match the VPC you configure for the service. For high availability, select vSwitches from at least two zones. You can select only one vSwitch per zone.
  
  Important
  If public network access is already enabled, the VPC must match the one used for public network access.
3. Click OK. The system begins creating the private network ALB instance.
4. Wait for the ALB instance to be created and its status to become "Running".
Public network
1. Switch to the Internet tab and click Enable Public Network.
2. In the configuration drawer, select a VPC and vSwitches. The VPC must match the VPC you configure for the service. For high availability, select vSwitches from at least two zones. You can select only one vSwitch per zone.
  
  Important
  If private network access is already enabled, the VPC must match the one used for private network access.
3. Click OK. The system begins creating the public network ALB instance.
4. Wait for the ALB instance to be created and its status to become "Running".

Step 3: Deploy a service and bind the gateway

The following example deploys a new service with Custom Deployment. To change the gateway of an existing service, update the service configuration.

Log on to the PAI console. Select a region on the top of the page. Then, select the desired workspace and click Elastic Algorithm Service (EAS).
On the Inference Service tab, click Deploy Service. In the Custom Model Deployment section, click Custom Deployment.
In the Network Information section, select Dedicated Gateway, and then select the gateway that you created from the drop-down list.
Configure the VPC for the service.

Important
The service VPC must match the dedicated gateway VPC.
Complete the other settings and click Deploy.

Step 4: Test basic connectivity

After enabling network access, test the service to verify the gateway configuration.

4.1 Get invocation information

On the Inference Service tab, find the target service and click Invocation Method in the Service Type column.
On the Dedicated Gateway tab, retrieve the endpoint and Token. Depending on the network access type you enabled, you can find the Internet Endpoint (if public network access is enabled), VPC Endpoint (if private network access is enabled), and Token.

4.2 Test service invocation

Test the service based on the access type you enabled.

Test public invocation (if public network access is enabled): Run the following command on any machine with Internet access.
```
curl <Public Endpoint> -H'Authorization:<Token>'
```
Verify the response is correct. The following figure shows a GET request test with no parameters. The expected response is True.
Test private invocation (if private network access is enabled): Run the following command from a terminal within the VPC.
```
curl <VPC Endpoint> -H'Authorization:<Token>'
```
Verify that the response data is correct.

4.3 Troubleshooting

If the test fails, check the following:

Cannot access the service or connection times out: Check whether the service VPC and the gateway VPC are the same. Confirm that the status of the ALB instance is "Running".
Authentication fails: Check whether the Token is correct. Confirm that the Authorization header is correctly included in the request.
Network is unreachable: For private network access, confirm that the test machine is in the correct VPC. For public network access, confirm that the machine can access the public network.

Step 5: (Optional) Configure a custom domain name

Configure a custom domain name for the gateway to access services through your own domain. Changes take effect in about 5 minutes.

5.1 Prepare SSL certificate

Public custom domain names require HTTPS. Private custom domain names support HTTP or HTTPS. To use HTTPS, obtain an SSL certificate first.

Log in to the Certificate Management Service console and select SSL Certificate Management.
Purchase an SSL certificate or upload an existing one.

5.2 Configure custom domain name

On the dedicated gateway details page, switch to the Domain Name tab and click Create Domain Name.
In the dialog box that appears, configure the domain name information:
- Access Method: Select VPC or Internet.
- Domain Name: Enter the custom domain name.
- Certificate: Internet access requires HTTPS with an SSL certificate. VPC access supports HTTP or HTTPS (for HTTPS, select an SSL certificate).
Click OK. The system begins configuring the custom domain name.
Configure DNS resolution: Add a CNAME record for the custom domain name and point it to the dedicated gateway domain name.
1. On the gateway details page, find the public or private domain name of the dedicated gateway.
2. Add a CNAME record for the custom domain name, and set the record value to the public or private domain name of the gateway.
Alibaba Cloud DNS: Add a public DNS record and Private domain name resolution.
Verify the configuration: Wait about 5 minutes, then check the service invocation information to confirm the endpoint shows your custom domain name. Test the service using the custom domain name.

Monitoring and alerts

Manage advanced network configuration and monitoring in the ALB console.

Usage notes

With a dedicated gateway, Auto Scaling does not support scaling from zero replicas. Set the minimum replica count to at least 1.

Use a dedicated gateway