Skip to main content
Version: Next

Connect to H2O MLOps

This page describes three recommended methods for connecting to H2O MLOps with the Python Client. Select one of the following methods based on how your H2O Cloud is set up and where you are connecting from.

  1. From H2O Notebook Labs in an H2O Cloud with Discovery Service
  2. From outside the H2O Cloud with Discovery Service
  3. From H2O Cloud without Discovery Service

Prerequisites​

Before you connect to H2O MLOps, make sure you have the values for the following constants. Contact your administrator to obtain deployment specific values.

In some cases, you might also need a custom certificate file to verify the peer’s SSL/TLS certificate.

ConstantValueDescription
H2O_MLOPS_GATEWAY_URLUsually: https://mlops-api.my.domainDefines the URL for the MLOps Gateway component. You can verify the correct URL by navigating to the API URL in your browser. It should provide a page with a list of available routes.
TOKEN_ENDPOINT_URLExample URLDefines the token endpoint URL of the Identity Provider. This uses Keycloak as the Identity Provider. Keycloak Realm should be provided. Replace <realm> with your specific realm name.
REFRESH_TOKEN<your-refresh-token>Defines the user's refresh token
CLIENT_ID<your-client-id>Sets the client id for authentication. This is the client you will be using to connect to MLOps.
H2O_CLOUD_URL<h2o-cloud-url>Defines the full URL required to connect to H2O Cloud
Note

To connect to an environment that uses a private certificate, you need to configure the environment variable MLOPS_AUTH_CA_FILE_OVERRIDE.

This variable must point to the path of the certificate file that the client should use for secure communication. For example:

export MLOPS_AUTH_CA_FILE_OVERRIDE=/path/to/your/ca_certificate.pem

The H2O MLOps Python Client also supports the following SSL settings via the Client Constructor:

  • verify_ssl: If set to True (the default value), the client will check that the server's SSL certificate is valid.
  • ssl_cacert: A path to a custom CA (Certificate Authority) certificate or bundle in .pem, or .crt format.

Note that setting the ssl_cacert argument overrides the value of the MLOPS_AUTH_CA_FILE_OVERRIDE environment variable.

You can connect to the H2O MLOps client with SSL verification either enabled or disabled. Use one of the following examples based on your SSL configuration preferences.

import ssl
import h2o_authn
import h2o_mlops

token_provider = h2o_authn.TokenProvider(
    refresh_token=...,
    client_id=...,
    client_secret=...,
    issuer_url=...,
    http_ssl_context=ssl.create_default_context(
        cafile="/abs/path/to/cert-chain.pem",
    ),
)

mlops_client = h2o_mlops.Client(
    gateway_url=...,
    token_provider=token_provider,
    verify_ssl=True,    # Optional
    ssl_cacert="/abs/path/to/cert-chain.pem",
)

Connect from H2O Cloud with Discovery Service​

From H2O Notebook Labs​

H2O Notebook Labs in the H2O Cloud will detect your user and automatically connect to H2O MLOps. For more information on H2O Notebook Labs, see the H2O Notebook Labs documentation.

Input:

import h2o_mlops

mlops = h2o_mlops.Client()

From outside of H2O Cloud​

To connect to H2O MLOps from outside the H2O Cloud, a h2o_cloud_url and refresh_token are required:

  • h2o_cloud_url: This is the same URL used to access the H2O Cloud homepage.

  • refresh_token: For information on how to retrieve your refresh token (also known as a platform token), see API authentication.

Input:

import h2o_mlops

mlops = h2o_mlops.Client(
   h2o_cloud_url=h2o_cloud_url, 
   refresh_token=refresh_token
)

The Python client will also check environment variables and automatically use them if no arguments are supplied:

  • h2o_cloud_url: H2O_CLOUD_ENVIRONMENT

  • refresh_token: H2O_CLOUD_CLIENT_PLATFORM_TOKEN

Connect from H2O Cloud without Discovery Service​

To connect to an H2O Cloud from outside the cloud, a gateway_url and token_provider are required.

  • gateway_url: is similar to the URL used to access the H2O Cloud homepage, except mlops-api. is prepended to the host. For example, if the H2O Cloud homepage is at https://cloud.h2o.ai, then the gateway_url is https://mlops-api.cloud.h2o.ai.

  • token_provider: For information on how to create a token_provider using the h2o_authn library, see Authenticate using the h2o-authn package.

Input:

import h2o_authn
import h2o_mlops

token_provider = h2o_authn.TokenProvider(
   refresh_token=...,
   client_id=...,
   token_endpoint_url=...
)

mlops = h2o_mlops.Client(
   gateway_url=gateway_url,
   token_provider=token_provider
)

Verify the connection​

After establishing the connection, verify it by checking your user information.

Input:

mlops.users.get_me()

Output:

<class 'h2o_mlops._users.MLOpsUser(
   uid='1234-5678-91011',
   username='user',
   email='user@example.com',
   created_time=datetime.datetime(2024, 9, 19, 6, 54, 10, 804414, tzinfo=tzutc()),
)'>
Feedback