用户定义的 Azure Databricks 路由设置User-defined route settings for Azure Databricks

• 01/05/2021
• • m

如果将 Azure Databricks 工作区部署到你自己的虚拟网络 (VNet)，则可使用自定义路由（也称用户定义路由 (UDR)），确保为工作区正确路由网络流量。If your Azure Databricks workspace is deployed to your own virtual network (VNet), you can use custom routes, also known as user-defined routes (UDR), to ensure that network traffic is routed correctly for your workspace. 例如，如果将虚拟网络连接到本地网络，则流量可能通过本地网络路由，无法到达 Azure Databricks 控制平面。For example, if you connect the virtual network to your on-premises network, traffic may be routed through the on-premises network and unable to reach the Azure Databricks control plane. 用户定义路由可以解决该问题。User-defined routes can solve that problem.

对于 VNet 的每种类型的出站连接，你都需要一个 UDR。You need a UDR for every type of outbound connection from the VNet. 详细信息取决于是否为工作区启用了安全群集连接 (SCC)：The details vary based on whether secure cluster connectivity (SCC) is enabled for the workspace:

• 如果为工作区启用了安全群集连接，则你需要一个 UDR 来允许群集连接到控制平面中的安全群集连接中继。If secure cluster connectivity is enabled for the workspace, you need an UDR to allow the clusters to connect to the secure cluster connectivity relay in the control plane. 请务必为你的区域包括标记为“SCC 中继 IP”的系统。Be sure to include the systems marked as SCC relay IP for your region.
• 如果为工作区禁用了安全群集连接，则存在来自控制平面 NAT 的入站连接，但从技术上讲，该连接的低层 TCP SYN-ACK 是需要 UDR 的出站数据。If secure cluster connectivity is disabled for the workspace, there is an inbound connection from the Control Plane NAT, but the low-level TCP SYN-ACK to that connection technically is outbound data that requires a UDR. 请务必为你的区域包括标记为“控制平面 NAT IP”的系统。Be sure to include the systems marked as Control Plane NAT IP for your region.

用户定义路由应遵守以下规则，并将路由表与虚拟网络的公共子网和专用子网相关联。Your user-defined routes should use the following rules and associate the route table to your virtual network’s public and private subnets.

IP 地址IP addresses

若要获取用户定义路由所需的 IP 地址，请使用下表和说明。To get the IP addresses required for user-defined routes, use the following tables and instructions.

控制平面 NAT 和 Webapp IP 地址Control plane NAT and Webapp IP addresses

详细信息取决于是否为工作区启用了安全群集连接 (SCC)。The details vary based on whether secure cluster connectivity (SCC) is enabled for the workspace. 受影响的行标有 **。Rows that are affected are marked with **.

• 如果为工作区启用了安全群集连接，则你需要一个 UDR 来允许群集连接到控制平面中的安全群集连接中继。If secure cluster connectivity is enabled for the workspace, you need an UDR to allow the clusters to connect to the secure cluster connectivity relay in the control plane. 为你的区域的 SCC 中继添加一个 UDR。Add a UDR for the SCC relay for your region.
• 如果为工作区禁用了安全群集连接，则存在来自控制平面 NAT 的入站连接，但从技术上讲，该连接的低层 TCP SYN-ACK 是需要 UDR 的出站数据。If secure cluster connectivity is disabled for the workspace, there is an inbound connection from the Control Plane NAT, but the low-level TCP SYN-ACK to that connection technically is outbound data that requires a UDR. 为你的区域的控制平面 NAT 添加一个 UDR。Add a UDR for the Control Plane NAT for your region.

DBFS 根 Blob 存储 IP 地址DBFS root Blob storage IP address

若要查找 DBFS 根 Blob 存储 IP 地址，必须找到域名，然后使用该域名查找 IP 地址。To find the DBFS root Blob storage IP address, you must find the domain name and use that to look up the IP address.

若要获取 DBFS 根 Blob 存储的域名，请转到工作区的托管资源组，找到名称格式为 dbstorage************ 的存储帐户，然后找到其 Blob 服务终结点。To get the domain name of DBFS root Blob storage, go to the managed resource group for the workspace, find a storage account with the name in the format dbstorage************, and then find its Blob Service Endpoint. 域名的格式为 dbstorage************.blob.core.windows.net。The domain name is in the format dbstorage************.blob.core.windows.net.

元存储、项目 Blob 存储、日志 Blob 存储和事件中心终结点 IP 地址 Metastore, artifact Blob storage, log Blob storage, and Event Hub endpoint IP addresses

若要获取元存储、项目 Blob 存储、日志 Blob 存储和事件中心 IP 地址，必须使用下表提供的域名来查找 IP 地址。To get the metastore, artifact Blob storage, log Blob storage, and Event Hub IP addresses, you must use their domain names, provided in the following table, to look up the IP addresses.