After you create a Ray application, the application cannot be accessed from external sources by default, nor can it access the public network from within. This may cause issues such as connection failures or the inability to call external APIs when you develop and run your Ray application. This document guides you through the basic configuration of a Ray application, including setting security configurations, obtaining connection addresses and application parameters, and enabling public network access, to help you use your Ray application securely and efficiently.
Security configuration
To ensure application security, newly created Ray applications block access from all external IP addresses by default. You need to configure an IP whitelist or an ECS security group to grant your development environment or application server access to the Ray application.
The application whitelist and the cluster whitelist are independent of each other and must be configured separately.
Before you begin, go to the management page of the target Ray application:
Log on to the PolarDB console. On the cluster details page, click in the navigation pane on the left.
On the AI Applications page, click your Application ID/Name to go to the application details page. Configure the settings on the Whitelist tab.
IP Whitelists
Use an IP whitelist when you need to access the Ray application from a fixed public IP address (such as a local development machine or office egress IP) or a specific IP address within a VPC.
If your ECS instance needs to access the application, find the IP address of the ECS instance on its instance details page and add it to the IP whitelist.
If the ECS instance and the application are in the same VPC, you can enter the private IP address of the ECS instance or its VPC CIDR block.
If the ECS instance and the application are not in the same VPC, you can enter the public IP address of the ECS instance or add the security group to which the ECS instance belongs.
If your local server, computer, or other cloud server needs to access the application, add its public IP address to the IP whitelist.
Steps
Click Add Whitelist or Configure an existing IP whitelist group. The rules are as follows:
Group name requirements: The name must be 2 to 120 characters in length and can contain only lowercase letters, digits, and underscores (_). It must start with a letter and end with a letter or digit.
IP format: A single IP address (such as
192.168.0.1) or an IP segment in CIDR format (such as192.168.0.0/24) is supported. Separate multiple IP addresses with commas (,). For example:192.168.0.1,192.168.0.0/24.Default rule: The application includes a default group named
defaultwith the IP address set to127.0.0.1, which blocks access from all IP addresses.High-risk setting: Setting the IP address to
0.0.0.0/0allows any IP address to access your cluster, which poses a security risk. Use this setting with caution only for testing or special scenarios.
Security Groups
When you need to grant all ECS instances within the same security group (especially Auto Scaling groups whose IP addresses may change dynamically) access to the Ray application, we recommend using ECS security groups. This approach simplifies centralized management and dynamic authorization.
For more information about ECS security groups and how to configure them in ECS, see ECS security groups.
You can also configure ECS IP addresses in the IP Whitelists. ECS instances in both the IP list and the security groups can access the Ray application.
Steps
Click Select Security Groups to associate the required ECS security group with the Ray application.
Obtain Ray application endpoints
After a Ray application is created, a VPC private endpoint is provided by default to ensure secure and efficient communication between cloud resources. When you need to debug code in a local development environment or connect to the Ray application using external tools, you can apply for a public endpoint to enable access from the public network.
Steps
Log on to the PolarDB console. On the cluster details page, click in the navigation pane on the left.
On the AI Applications page, click your Application ID/Name to go to the application details page. On the Basic Information tab, find the Topology area and view the Application Link for the Public network address or Private network address.
NoteThe Public network address must be applied for separately. Click the Application button to submit an application.
The Public network address provides only an IP address and a port, not a domain name. If you need a domain name, you can associate one yourself.
Application endpoint descriptions
Dashboard: The endpoint for the Ray Dashboard.
Jupyter (Notebook): The endpoint for the Ray Notebook. For usage instructions, see Using Ray Notebook.
Obtain Ray application configuration information
The configuration information of a Ray application includes the Dashboard logon username and password, the Jupyter Notebook logon password, and more. You can view and modify these settings on the Configure page as needed.
Steps
Log on to the PolarDB console. On the cluster details page, click in the navigation pane on the left.
On the AI Applications page, click your Application ID/Name to go to the application details page. Configure the settings on the Configure tab.
(Optional) To modify parameter values, click the Modify button in the upper-left corner.
Modifying some parameters automatically restarts the Ray application. We recommend performing this operation during off-peak hours.
Parameter descriptions
Parameter | Description |
| The logon username for the Ray Dashboard. |
| The logon password for the Ray Dashboard. |
| The token used to log on to Jupyter Notebook and make API calls. |
| Controls whether JWT (JSON Web Token) authentication is enabled when submitting jobs to the Ray application. |
| The key to access the Ray application. |
| The anonymous key to access the Ray application. |
Enable public network access
By default, a Ray application cannot access external networks. To enable this capability, you need to configure a NAT gateway for the VPC where the Ray application's cluster resides.
Steps
Create an Internet NAT gateway: Go to the NAT Gateway - Internet NAT Gateway purchase page to create one. During creation, ensure that you select the same VPC and vSwitch as your PolarDB for PostgreSQL cluster.
Configure an SNAT entry: Go to the Internet NAT Gateway page. In the Actions column of the target gateway, click Configure SNAT , and then click Create SNAT Entry. Configure the parameters as follows:
SNAT Entry: Select Specify VPC.
Select EIP: Select the EIP that provides public network access from the drop-down list.
Enabling public network access incurs costs for the Internet NAT gateway and public network traffic. For more information about billing, see NAT Gateway billing.