SSL for model endpoints in Azure machine learning studio

Question

SSL for model endpoints in Azure machine learning studio

Aryan Rastogi 60

I have a multidomain SSL for my dev, uat and prod environment. I have a pre-existing azure kubernetes service and was trying to install azure ml extension on it using UI. Now a endpoint is already deployed using SDKv1 and I am trying to migrate from v1 to v2. So when add azureml extension to my AKS how do i ensure that the domain name used for endpoints on that cluster stays intact as i have 3 domain names associated to SSL certificate.
dev-abc.com
uat-abc.com
abc.com
these 3 corresponds to different IP address i.e IPs of my AKS load balancer. But on installing azureml extension how do i make sure that in dev aks cluster endpoints are deployed with dev-abc.com uri

SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-15T11:59:52.9166667+00:00

Hello @Aryan Rastogi,

To ensure your existing domain names continue to work correctly with endpoints on Azure Kubernetes Service (AKS) after installing the Azure Machine Learning (Azure ML) extension and migrating from SDK v1 to v2, you'll need to follow a structured configuration approach.

Here’s what you need to do:

Before installing the Azure ML extension, verify that your DNS records for dev-abc.com, uat-abc.com, and abc.com are correctly pointing to the external IP addresses of their respective AKS cluster load balancers. This ensures each domain routes traffic to the intended environment (Dev, UAT, or Prod).

When installing the Azure ML extension, use the available configuration options (via Azure CLI or UI) to define the custom domain (FQDN) that your environment should use. You must explicitly set this so that deployed endpoints will reflect the desired domain name rather than using a default or auto generated one.

Since you're using a multidomain SSL certificate, ensure it includes all required domains through Subject Alternative Names (SANs). The certificate must be securely uploaded as a Kubernetes TLS secret in the relevant namespace (e.g., azureml). During the extension installation, provide the TLS configuration parameters either through secret references or certificate file paths to bind the correct SSL certificate to each domain.

Post-extension installation, make sure TLS termination is properly configured for your AKS endpoints. This allows secure HTTPS traffic handling at the ingress layer. If you're managing AKS via the Azure ML SDK, this can be handled using methods like AksCompute.provisioning_configuration() and attach_configuration() to ensure TLS is properly set up for all endpoint traffic.

Please refer this for detailed guidence Configure a secure online endpoint with TLS/SSL,

Configure TLS/SSL in the Azure Machine Learning extension.

I Hope this helps. Do let me know if you have any further queries.

Thank you!
Aryan Rastogi 60 Reputation points

2025-05-15T15:44:58.4266667+00:00

Akscompute is from SDKv1 and I am currently migrating my code from v1 to v2 and I couldn't find anything equivalent to attach_configuration in sdkv2 for SSL. Could you please share some links?

When installing azureml extension we use

--config-protected sslCertPemFile=cert.pem sslKeyPemFile=key.pem
does this mean any endpoint deployed over this aks cluster will have SSL enabled??

When installing the Azure ML extension, use the available configuration options (via Azure CLI or UI) to define the custom domain (FQDN) that your environment should use. You must explicitly set this so that deployed endpoints will reflect the desired domain name rather than using a default or auto generated one.

az k8s-extension create --name azureml-training-extension --extension-type Microsoft.AzureML.Kubernetes --config enableTraining=True enableInference=True inferenceRouterServiceType=LoadBalancer sslCname=abc.com --config-protected sslCertPemFile=cert.pem sslKeyPemFile=key.pem --cluster-type managedClusters --cluster-name clustername --resource-group rgname --scope cluster
Should i change my sslCname for doing what you have mentioned above??
SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-16T11:35:24.8866667+00:00

Hi @Aryan Rastogi,

You're absolutely right in Azure Machine Learning SDK v2, SSL/TLS configuration is no longer managed via the AksCompute class or attach_configuration() as in SDK v1. Instead, it is now handled during the Azure ML extension installation on your AKS cluster.

By using the --config-protected sslCertPemFile=cert.pem sslKeyPemFile=key.pem flags, you are correctly enabling SSL for all endpoints deployed over that cluster. This setup configures TLS termination at the inference router (typically NGINX) level and requires that your PEM-encoded certificate includes all necessary domain names via Subject Alternative Names (SANs).

Additionally, the --config sslCname=<your.domain.com> parameter is used to define the fully qualified domain name (FQDN) that will be used for the endpoint URLs.

So yes, to ensure your endpoints reflect the correct environment-specific domain (e.g., dev-abc.com for Dev, uat-abc.com for UAT, and abc.com for Prod), you should update the sslCname value accordingly during installation. Just make sure the corresponding DNS A records point to the external IP of your AKS load balancer and that the correct SSL certificate and key are used per environment. Also, ensure that allowInsecureConnections is set to False for SSL enforcement.

I Hope you understand. Do let me know if you have any further queries.

Thank you!
SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-19T06:42:34.46+00:00

Hi @Aryan Rastogi

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Thank you!
SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-20T12:14:16.91+00:00

Hi @Aryan Rastogi,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you!

Your answer

Aryan Rastogi 60 Reputation points

2025-05-15T15:44:58.4266667+00:00

Akscompute is from SDKv1 and I am currently migrating my code from v1 to v2 and I couldn't find anything equivalent to attach_configuration in sdkv2 for SSL. Could you please share some links?

When installing azureml extension we use

--config-protected sslCertPemFile=cert.pem sslKeyPemFile=key.pem
does this mean any endpoint deployed over this aks cluster will have SSL enabled??

When installing the Azure ML extension, use the available configuration options (via Azure CLI or UI) to define the custom domain (FQDN) that your environment should use. You must explicitly set this so that deployed endpoints will reflect the desired domain name rather than using a default or auto generated one.

az k8s-extension create --name azureml-training-extension --extension-type Microsoft.AzureML.Kubernetes --config enableTraining=True enableInference=True inferenceRouterServiceType=LoadBalancer sslCname=abc.com --config-protected sslCertPemFile=cert.pem sslKeyPemFile=key.pem --cluster-type managedClusters --cluster-name clustername --resource-group rgname --scope cluster
Should i change my sslCname for doing what you have mentioned above??
SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-16T11:35:24.8866667+00:00

Hi @Aryan Rastogi,

You're absolutely right in Azure Machine Learning SDK v2, SSL/TLS configuration is no longer managed via the AksCompute class or attach_configuration() as in SDK v1. Instead, it is now handled during the Azure ML extension installation on your AKS cluster.

By using the --config-protected sslCertPemFile=cert.pem sslKeyPemFile=key.pem flags, you are correctly enabling SSL for all endpoints deployed over that cluster. This setup configures TLS termination at the inference router (typically NGINX) level and requires that your PEM-encoded certificate includes all necessary domain names via Subject Alternative Names (SANs).

Additionally, the --config sslCname=<your.domain.com> parameter is used to define the fully qualified domain name (FQDN) that will be used for the endpoint URLs.

So yes, to ensure your endpoints reflect the correct environment-specific domain (e.g., dev-abc.com for Dev, uat-abc.com for UAT, and abc.com for Prod), you should update the sslCname value accordingly during installation. Just make sure the corresponding DNS A records point to the external IP of your AKS load balancer and that the correct SSL certificate and key are used per environment. Also, ensure that allowInsecureConnections is set to False for SSL enforcement.

I Hope you understand. Do let me know if you have any further queries.

Thank you!
SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-19T06:42:34.46+00:00

Hi @Aryan Rastogi

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Thank you!
SriLakshmi C 6,010 Reputation points Microsoft External Staff Moderator

2025-05-20T12:14:16.91+00:00

Hi @Aryan Rastogi,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you!

Share via

SSL for model endpoints in Azure machine learning studio

Your answer