You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article shows you how to secure a that's deployed through Azure Machine Learning.
20
+
This article shows you how to secure a web service that's deployed through Azure Machine Learning.
21
21
22
-
You use [HTTPS](https://en.wikipedia.org/wiki/HTTPS) to restrict access to s and secure the data that clients submit. HTTPS helps secure communications between a client and a by encrypting communications between the two. Encryption uses [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security). TLS is sometimes still referred to as *Secure Sockets Layer* (SSL), which was the predecessor of TLS.
22
+
You use [HTTPS](https://en.wikipedia.org/wiki/HTTPS) to restrict access to web services and secure the data that clients submit. HTTPS helps secure communications between a client and a web service by encrypting communications between the two. Encryption uses [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security). TLS is sometimes still referred to as *Secure Sockets Layer* (SSL), which was the predecessor of TLS.
23
23
24
24
> [!TIP]
25
-
> The Azure Machine Learning SDK uses the term "SSL" for properties that are related to secure communications. This doesn't mean that your doesn't use *TLS*. SSL is just a more commonly recognized term.
25
+
> The Azure Machine Learning SDK uses the term "SSL" for properties that are related to secure communications. This doesn't mean that your web service doesn't use *TLS*. SSL is just a more commonly recognized term.
26
26
27
27
TLS and SSL both rely on *digital certificates*, which help with encryption and identity verification. For more information on how digital certificates work, see the Wikipedia topic [Public key infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure).
28
28
29
29
> [!WARNING]
30
-
> If you don't use HTTPS for your , data that's sent to and from the service might be visible to others on the internet.
30
+
> If you don't use HTTPS for your web service, data that's sent to and from the service might be visible to others on the internet.
31
31
>
32
32
> HTTPS also enables the client to verify the authenticity of the server that it's connecting to. This feature protects clients against [man-in-the-middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attacks.
33
33
34
-
This is the general process to secure a :
34
+
This is the general process to secure a web service:
35
35
36
36
1. Get a domain name.
37
37
38
38
2. Get a digital certificate.
39
39
40
-
3. Deploy or update the with SSL enabled.
40
+
3. Deploy or update the web service with SSL enabled.
41
41
42
-
4. Update your DNS to point to the .
42
+
4. Update your DNS to point to the web service.
43
43
44
44
> [!IMPORTANT]
45
45
> If you're deploying to Azure Kubernetes Service (AKS), you can purchase your own certificate or use a certificate that's provided by Microsoft. If you use a certificate from Microsoft, you don't need to get a domain name or SSL certificate. For more information, see the [Enable SSL and deploy](#enable) section of this article.
@@ -48,7 +48,7 @@ There are slight differences when you secure s across [deployment targets](how-t
48
48
49
49
## Get a domain name
50
50
51
-
If you don't already own a domain name, purchase one from a *domain name registrar*. The process and price differ among registrars. The registrar provides tools to manage the domain name. You use these tools to map a fully qualified domain name (FQDN) (such as www\.contoso.com) to the IP address that hosts your .
51
+
If you don't already own a domain name, purchase one from a *domain name registrar*. The process and price differ among registrars. The registrar provides tools to manage the domain name. You use these tools to map a fully qualified domain name (FQDN) (such as www\.contoso.com) to the IP address that hosts your web service.
52
52
53
53
## Get an SSL certificate
54
54
@@ -57,7 +57,7 @@ There are many ways to get an SSL certificate (digital certificate). The most co
57
57
* A **certificate**. The certificate must contain the full certificate chain, and it must be "PEM-encoded."
58
58
* A **key**. The key must also be PEM-encoded.
59
59
60
-
When you request a certificate, you must provide the FQDN of the address that you plan to use for the (for example, www\.contoso.com). The address that's stamped into the certificate and the address that the clients use are compared to verify the identity of the . If those addresses don't match, the client gets an error message.
60
+
When you request a certificate, you must provide the FQDN of the address that you plan to use for the web service (for example, www\.contoso.com). The address that's stamped into the certificate and the address that the clients use are compared to verify the identity of the web service. If those addresses don't match, the client gets an error message.
61
61
62
62
> [!TIP]
63
63
> If the certificate authority can't provide the certificate and key as PEM-encoded files, you can use a utility such as [OpenSSL](https://www.openssl.org/) to change the format.
@@ -72,7 +72,7 @@ To deploy (or redeploy) the service with SSL enabled, set the *ssl_enabled* para
72
72
### Deploy on AKS and field-programmable gate array (FPGA)
73
73
74
74
> [!NOTE]
75
-
> The information in this section also applies when you deploy a secure for the designer. If you aren't familiar with using the Python SDK, see [What is the Azure Machine Learning SDK for Python?](https://docs.microsoft.com/python/api/overview/azure/ml/intro?view=azure-ml-py).
75
+
> The information in this section also applies when you deploy a secure web service for the designer. If you aren't familiar with using the Python SDK, see [What is the Azure Machine Learning SDK for Python?](https://docs.microsoft.com/python/api/overview/azure/ml/intro?view=azure-ml-py).
76
76
77
77
When you deploy to AKS, you can create a new AKS cluster or attach an existing one. For more information on creating or attaching a cluster, see [Deploy a model to an Azure Kubernetes Service cluster](how-to-deploy-azure-kubernetes-service.md).
78
78
@@ -141,7 +141,7 @@ For more information, see [AciWebservice.deploy_configuration()](https://docs.mi
141
141
142
142
## Update your DNS
143
143
144
-
Next, you must update your DNS to point to the .
144
+
Next, you must update your DNS to point to the web service.
145
145
146
146
+**For Container Instances:**
147
147
@@ -156,7 +156,7 @@ Next, you must update your DNS to point to the .
156
156
157
157
Update the DNS of the Public IP Address of the AKS cluster on the **Configuration** tab under **Settings**in the left pane. (See the following image.) The Public IP Address is a resource type that's created under the resource group that contains the AKS agent nodes and other networking resources.
Copy file name to clipboardExpand all lines: articles/machine-learning/service/how-to-troubleshoot-deployment.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -159,12 +159,12 @@ To avoid this problem, we recommend one of the following approaches:
159
159
160
160
## Debug locally
161
161
162
-
If you encounter problems deploying a model to ACI or AKS, try deploying it as a local . Using a local makes it easier to troubleshoot problems. The Docker image containing the model is downloaded and started on your local system.
162
+
If you encounter problems deploying a model to ACI or AKS, try deploying it as a local web service. Using a local web service makes it easier to troubleshoot problems. The Docker image containing the model is downloaded and started on your local system.
163
163
164
164
> [!WARNING]
165
-
> Local deployments are not supported for production scenarios.
165
+
> Local web service deployments are not supported for production scenarios.
166
166
167
-
To deploy locally, modify your code to use `LocalWebservice.deploy_configuration()` to create a deployment configuration. Then use `Model.deploy()` to deploy the service. The following example deploys a model (contained in the `model` variable) as a local :
167
+
To deploy locally, modify your code to use `LocalWebservice.deploy_configuration()` to create a deployment configuration. Then use `Model.deploy()` to deploy the service. The following example deploys a model (contained in the `model` variable) as a local web service:
168
168
169
169
```python
170
170
from azureml.core.model import InferenceConfig, Model
# Display the port that the web service is available on
186
186
print(service.port)
187
187
```
188
188
@@ -292,7 +292,7 @@ There are two things that can help prevent 503 status codes:
292
292
> [!IMPORTANT]
293
293
> This change does not cause replicas to be created *faster*. Instead, they are created at a lower utilization threshold. Instead of waiting until the service is 70% utilized, changing the value to 30% causes replicas to be created when 30% utilization occurs.
294
294
295
-
If the is already using the current max replicas and you are still seeing 503 status codes, increase the `autoscale_max_replicas` value to increase the maximum number of replicas.
295
+
If the web service is already using the current max replicas and you are still seeing 503 status codes, increase the `autoscale_max_replicas` value to increase the maximum number of replicas.
296
296
297
297
* Change the minimum number of replicas. Increasing the minimum replicas provides a larger pool to handle the incoming spikes.
298
298
@@ -328,7 +328,7 @@ In some cases, you may need to interactively debug the Python code contained in
328
328
> [!IMPORTANT]
329
329
> This method of debugging does not work when using `Model.deploy()`and`LocalWebservice.deploy_configuration` to deploy a model locally. Instead, you must create an image using the [ContainerImage](https://docs.microsoft.com/python/api/azureml-core/azureml.core.image.containerimage?view=azure-ml-py) class.
330
330
331
-
Local deployments require a working Docker installation on your local system. For more information on using Docker, see the [Docker Documentation](https://docs.docker.com/).
331
+
Local web service deployments require a working Docker installation on your local system. For more information on using Docker, see the [Docker Documentation](https://docs.docker.com/).
0 commit comments