AI Governance Center in Microservices Engine (MSE) supports public network access to workspaces. After you add a public access point, the system assigns a public domain name to the workspace. You can configure an IP address whitelist to control which IP addresses can access the workspace over the public network.
Prerequisites
You have created workspace in AI Registry.
You have obtained the public egress IP address of your machine. Run
curl ifconfig.meorcurl ip.sbto query your public IP address.
Configurations
Step 1: Add a public access point
Log on to the MSE console. In the left-side navigation pane, choose .
Click the Public Access tab.
In the upper-right corner, click Add Access Point.
In the dialog box, configure the following parameters:
Workspace: Select the workspace for which you want to enable public network access.
IP Whitelist: Enter the CIDR addresses that are allowed to access the workspace. Example:
192.168.0.1/32. If you leave this field empty, the default value127.0.0.1/32is used, which rejects all external access.
Click Confirm. After the access point is added, the system generates a public access point domain name for the workspace.
Step 2: Obtain the access point domain name
In the public access list, find the workspace you added and copy the value in the Access Point Domain column.
Step 3: Verify connectivity
Make sure you can access AI registry through the public domain name:
# Replace {access-point-domain} and {workspace-id} with your actual values
curl -sS "http://{access-point-domain}/nacos/v3/admin/ai/skills/list?namespaceId={workspace-id}&pageNo=1&pageSize=20"Check the response to determine the access status:
{"code":403,"message":"Forbidden: IP not in whitelist"}— The request reached the gateway, but your public egress IP address is not in the IP address whitelist. Add your public egress IP address to the whitelist and try again.{"code":10001,"message":"access denied","data":"Check Signature failed: ..."}— Your public egress IP address passed the whitelist check and the request reached the backend service. This error is expected when the curl request does not carry an authentication signature. For production calls, use the CLI or SDK, or send signed requests as required by the API authentication specification.
Modify the IP address whitelist
In the public access list, find the target workspace and click Modify IP Whitelist in the Actions column.
Modify the CIDR addresses and submit the changes.
Delete a public access point
In the public access list, find the target workspace and click Delete in the Actions column.
Confirm the deletion. After you delete a public access point, the public domain name becomes invalid and all configurations, including the IP address whitelist, are cleared.
IP address whitelist
Item | Description |
Format | CIDR notation. Example: |
Subnet mask limit | The subnet mask must be 16 or greater. CIDR blocks such as |
Default value |
|
Multiple addresses | Separate multiple addresses with commas. Example: |
Obtain your public IP address | Run |
FAQ
Why do I still receive a 403 error after adding my IP address to the whitelist?
Make sure the IP address in the whitelist is your public egress IP address, not a private IP address. On-premises networks typically use NAT translation, so the actual egress IP address differs from what ifconfig shows. Run curl ifconfig.me to obtain your actual public egress IP address.
Can I use public network access and VPC access at the same time?
Yes. Public network access and VPC access work independently. You can enable public network access and associate multiple VPCs with the same workspace.