Add chart mlflow 1.9.0

2026-04-22 17:08:02 +09:00
parent b8942c5f46
commit 3a78d39b7a
153 changed files with 21026 additions and 0 deletions
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "mlflow.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "mlflow.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "mlflow.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "mlflow.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
@@ -0,0 +1,97 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "mlflow.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "mlflow.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "mlflow.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "mlflow.labels" -}}
+helm.sh/chart: {{ include "mlflow.chart" . }}
+{{ include "mlflow.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "mlflow.selectorLabels" -}}
+app: {{ include "mlflow.name" . }}
+app.kubernetes.io/name: {{ include "mlflow.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "mlflow.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "mlflow.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "mlflow.health" -}}
+{{- $basPath := default "/" .Values.extraArgs.staticPrefix }}
+{{- printf "%s/health" ($basPath | trimSuffix "/" )}}
+{{- end }}
+
+{{/*
+Generate random hex similar to `openssl rand -hex 16` command.
+Usage: {{ include "mlflow.generateRandomHex" 32 }}
+*/}}
+{{- define "mlflow.generateRandomHex" -}}
+{{- $length := . -}}
+{{- $chars := list "0" "1" "2" "3" "4" "5" "6" "7" "8" "9" "a" "b" "c" "d" "e" "f" -}}
+{{- $result := "" -}}
+{{- range $i := until $length -}}
+  {{- $result = print $result (index $chars (randInt 0 16)) -}}
+{{- end -}}
+{{- $result -}}
+{{- end -}}
+
+{{/*
+Create postgresql name secret name.
+*/}}
+{{- define "mlflow.postgresql.fullname" -}}
+{{- printf "%s-postgresql" (include "mlflow.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create mysql name secret name.
+*/}}
+{{- define "mlflow.mysql.fullname" -}}
+{{- printf "%s-mysql" (include "mlflow.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
@@ -0,0 +1,16 @@
+{{- if and .Values.auth.enabled (not .Values.auth.existingAdminSecret.name) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "mlflow.fullname" . }}-auth-admin-secret
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+type: Opaque
+data:
+  username: {{ required "auth.adminUsername must be specified" .Values.auth.adminUsername | b64enc }}
+  password: {{ required "auth.adminPassword must be specified" .Values.auth.adminPassword | b64enc }}
+{{- end }}
@@ -0,0 +1,56 @@
+{{- if or .Values.auth.enabled .Values.ldapAuth.enabled }}
+  {{- $defaultPermission := "" }}
+  {{- $databaseUri := "" }}
+  {{- $adminUsername := "" }}
+  {{- $adminPassword := "" }}
+  {{- $authorizationFunction := "" }}
+
+  {{- if .Values.auth.enabled }}
+    {{- $defaultPermission = .Values.auth.defaultPermission }}
+    {{- if .Values.auth.postgres.enabled }}
+      {{- $dbConnectionDriver := "" }}
+      {{- if .Values.auth.postgres.driver }}
+        {{- $dbConnectionDriver = printf "+%s" .Values.auth.postgres.driver }}
+      {{- end }}
+      {{- $pgHost := required "auth.postgres.host must be specified" .Values.auth.postgres.host }}
+      {{- $pgPort := required "auth.postgres.port must be specified" .Values.auth.postgres.port | toString }}
+      {{- $pgDatabase := required "auth.postgres.database must be specified" .Values.auth.postgres.database }}
+      {{- $databaseUri = printf "postgresql%s://$(POSTGRES_USERNAME_PLACEHOLDER):$(POSTGRES_PASSWORD_PLACEHOLDER)@%s:%s/%s" $dbConnectionDriver $pgHost $pgPort $pgDatabase }}
+    {{- else }}
+      {{- $sqliteFile := .Values.auth.sqliteFile }}
+      {{- if .Values.auth.sqliteFullPath }}
+        {{- $path := printf "%s/" .Values.auth.sqliteFullPath | trimSuffix "/" }}
+        {{- $databaseUri = printf "sqlite:///%s%s" $path $sqliteFile }}
+      {{- else }}
+        {{- $databaseUri = printf "sqlite:///%s" $sqliteFile }}
+      {{- end }}
+    {{- end }}
+    {{- $adminUsername = "$(ADMIN_USERNAME_PLACEHOLDER)" }}
+    {{- $adminPassword = "$(ADMIN_PASSWORD_PLACEHOLDER)" }}
+    {{- $authorizationFunction = required "auth.authorizationFunction can not be empty!" .Values.auth.authorizationFunction }}
+  {{- else }}
+    {{- $defaultPermission = "READ" }}
+    {{- $databaseUri = "sqlite:///ldap_basic_auth.db" }}
+    {{- $adminUsername = "fakeuser" }}
+    {{- $adminPassword = "fakepassword" }}
+    {{- $authorizationFunction = "mlflowstack.auth.ldap:authenticate_request_basic_auth" }}
+  {{- end }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "mlflow.fullname" . }}-auth-ini-template
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  auth_template.ini: |
+    [mlflow]
+    default_permission = {{ $defaultPermission }}
+    database_uri = {{ $databaseUri }}
+    admin_username = {{ $adminUsername }}
+    admin_password = {{ $adminPassword }}
+    authorization_function = {{ $authorizationFunction }}
+{{- end }}
@@ -0,0 +1,16 @@
+{{- if and .Values.auth.enabled .Values.auth.postgres.enabled (not .Values.auth.postgres.existingSecret.name) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "mlflow.fullname" . }}-auth-pg-secret
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+type: Opaque
+data:
+  username: {{ required "auth.postgres.user must be specified" .Values.auth.postgres.user | b64enc }}
+  password: {{ required "auth.postgres.password must be specified" .Values.auth.postgres.password | b64enc }}
+{{- end }}
@@ -0,0 +1,101 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "mlflow.fullname" . }}-env-configmap
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+{{- if .Values.backendStore.postgres.enabled }}
+  PGHOST: {{ required "postgres host must be specified" .Values.backendStore.postgres.host }}
+  PGPORT: {{ required "postgres port must be specified" .Values.backendStore.postgres.port | quote }}
+  PGDATABASE: {{ required "postgres database must be specified" .Values.backendStore.postgres.database }}
+{{- end }}
+{{- if .Values.postgresql.enabled }}
+  PGHOST: {{ template "mlflow.fullname" . }}-postgresql
+  PGPORT: {{ default "5432" .Values.postgresql.primary.service.ports.postgresql | quote }}
+  PGDATABASE: {{ .Values.postgresql.auth.database }}
+{{- end }}
+{{- if .Values.backendStore.mysql.enabled }}
+  MYSQL_HOST: {{ required "mysql host must be specified" .Values.backendStore.mysql.host }}
+  MYSQL_TCP_PORT: {{ required "mysql port must be specified" .Values.backendStore.mysql.port | quote }}
+  MYSQL_DATABASE: {{ required "mysql database must be specified" .Values.backendStore.mysql.database }}
+{{- end }}
+{{- if .Values.backendStore.mssql.enabled }}
+  MSSQL_HOST: {{ required "mssql host must be specified" .Values.backendStore.mssql.host }}
+  MSSQL_TCP_PORT: {{ required "mssql port must be specified" .Values.backendStore.mssql.port | quote }}
+  MSSQL_DATABASE: {{ required "mssql database must be specified" .Values.backendStore.mssql.database }}
+{{- end }}
+{{- if .Values.mysql.enabled }}
+  MYSQL_HOST: {{ template "mlflow.fullname" . }}-mysql
+  MYSQL_TCP_PORT: {{ default "3306" .Values.mysql.primary.service.ports.mysql | quote }}
+  MYSQL_DATABASE: {{ .Values.mysql.auth.database }}
+{{- end }}
+  MLFLOW_CONFIGURE_LOGGING: {{ .Values.log.enabled | quote }}
+{{- if .Values.log.enabled }}
+  MLFLOW_LOGGING_LEVEL: {{ .Values.log.level | upper | quote }}
+{{- end }}
+{{- if not .Values.telemetry.enabled }}
+  MLFLOW_DISABLE_TELEMETRY: "true"
+  DO_NOT_TRACK: "true"
+{{- end }}
+---
+{{- if and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) .Values.backendStore.databaseMigration }}
+{{- $dbConnectionDriver := "" }}
+{{- if and (or .Values.backendStore.postgres.enabled .Values.postgresql.enabled .Values.postgresql.enabled) .Values.backendStore.postgres.driver }}
+  {{- $dbConnectionDriver = printf "+%s" .Values.backendStore.postgres.driver }}
+{{- else if and (or .Values.backendStore.mysql.enabled .Values.mysql.enabled) .Values.backendStore.mysql.driver }}
+  {{- $dbConnectionDriver = printf "+%s" .Values.backendStore.mysql.driver }}
+{{- else if and .Values.backendStore.mssql.enabled .Values.backendStore.mssql.driver }}
+  {{- $dbConnectionDriver = printf "+%s" .Values.backendStore.mssql.driver }}
+{{- end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "mlflow.fullname" . }}-migrations
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  migrations.py: |-
+    from mlflow.store.db import utils
+    import os
+
+
+  {{- if or .Values.backendStore.postgres.enabled .Values.postgresql.enabled }}
+    engine = utils.create_sqlalchemy_engine_with_retry("postgresql{{ $dbConnectionDriver }}://")
+  {{- else if or .Values.backendStore.mysql.enabled .Values.mysql.enabled }}
+    username = os.getenv("MYSQL_USERNAME")
+    password = os.getenv("MYSQL_PWD")
+    host = os.getenv("MYSQL_HOST")
+    port = os.getenv("MYSQL_TCP_PORT")
+    database = os.getenv("MYSQL_DATABASE")
+    engine = utils.create_sqlalchemy_engine_with_retry(f"mysql{{ $dbConnectionDriver }}://{username}:{password}@{host}:{port}/{database}")
+  {{- else if .Values.backendStore.mssql.enabled }}
+    username = os.getenv("MSSQL_USERNAME")
+    password = os.getenv("MSSQL_PWD")
+    host = os.getenv("MSSQL_HOST")
+    port = os.getenv("MSSQL_TCP_PORT")
+    database = os.getenv("MSSQL_DATABASE")
+    engine = utils.create_sqlalchemy_engine_with_retry(f"mssql{{ $dbConnectionDriver }}://{username}:{password}@{host}:{port}/{database}")
+  {{- end }}
+    utils._initialize_tables(engine)
+{{- end }}
+{{- if and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) .Values.backendStore.databaseConnectionCheck }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "mlflow.fullname" . }}-dbchecker
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  {{ (.Files.Glob "files/dbchecker.sh").AsConfig | nindent 2 }}
+{{- end }}
@@ -0,0 +1,532 @@
+{{- $artifactCommandPrefix := "default-artifact-root" }}
+{{- $artifactCommand := printf "--%s=%s" $artifactCommandPrefix .Values.artifactRoot.defaultArtifactRoot }}
+
+{{- if .Values.artifactRoot.proxiedArtifactStorage }}
+  {{- $artifactCommandPrefix = "artifacts-destination" }}
+  {{- $artifactCommand = printf "--%s=%s" $artifactCommandPrefix .Values.artifactRoot.defaultArtifactsDestination }}
+{{- end }}
+
+{{- if .Values.artifactRoot.azureBlob.enabled }}
+  {{- $artifactCommand = printf "--%s=wasbs://%s@%s.blob.core.windows.net/%s" $artifactCommandPrefix .Values.artifactRoot.azureBlob.container .Values.artifactRoot.azureBlob.storageAccount .Values.artifactRoot.azureBlob.path }}
+{{- else if .Values.artifactRoot.s3.enabled }}
+  {{- $artifactCommand = printf "--%s=s3://%s/%s" $artifactCommandPrefix .Values.artifactRoot.s3.bucket .Values.artifactRoot.s3.path }}
+{{- else if .Values.artifactRoot.gcs.enabled }}
+  {{- $artifactCommand = printf "--%s=gs://%s/%s" $artifactCommandPrefix .Values.artifactRoot.gcs.bucket .Values.artifactRoot.gcs.path }}
+{{- end }}
+
+{{- $dbConnectionDriver := "" }}
+{{- if and (or .Values.backendStore.postgres.enabled .Values.postgresql.enabled) .Values.backendStore.postgres.driver }}
+  {{- $dbConnectionDriver = printf "+%s" .Values.backendStore.postgres.driver }}
+{{- else if and (or .Values.backendStore.mysql.enabled .Values.mysql.enabled) .Values.backendStore.mysql.driver }}
+  {{- $dbConnectionDriver = printf "+%s" .Values.backendStore.mysql.driver }}
+{{- else if and .Values.backendStore.mssql.enabled .Values.backendStore.mssql.driver }}
+  {{- $dbConnectionDriver = printf "+%s" .Values.backendStore.mssql.driver }}
+{{- end }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "mlflow.fullname" . }}
+  labels:
+    {{- include "mlflow.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  strategy:
+    type: {{ .Values.strategy.type }}
+    {{- if eq .Values.strategy.type "RollingUpdate" }}
+    rollingUpdate:
+      maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
+      maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
+    {{- end }}
+  selector:
+    matchLabels:
+      {{- include "mlflow.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "mlflow.selectorLabels" . | nindent 8 }}
+      {{- with .Values.extraPodLabels }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "mlflow.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- if or (and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) (or .Values.backendStore.databaseConnectionCheck .Values.backendStore.databaseMigration) ) .Values.auth.enabled .Values.ldapAuth.enabled .Values.initContainers }}
+      initContainers:
+    {{- end }}
+      {{- if and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) .Values.backendStore.databaseConnectionCheck }}
+        - name: dbchecker
+          image: "{{ .Values.initImages.dbchecker.repository }}:{{ .Values.initImages.dbchecker.tag }}"
+          imagePullPolicy: {{ .Values.initImages.dbchecker.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          command: [ "/script/dbchecker.sh" ]
+        {{- if or .Values.postgresql.enabled .Values.mysql.enabled .Values.backendStore.existingDatabaseSecret.name }}
+          env:
+        {{- end }}
+          {{- if .Values.postgresql.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "mlflow.postgresql.fullname" .) }}
+              {{- if .Values.postgresql.auth.username }}
+                  key: password
+              {{- else }}
+                  key: postgres-password
+              {{- end }}
+                  optional: true
+          {{- end }}
+          {{- if .Values.mysql.enabled }}
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "mlflow.mysql.fullname" .) }}
+              {{- if .Values.mysql.auth.username }}
+                  key: password
+              {{- else }}
+                  key: mysql-root-password
+              {{- end }}
+                  optional: true
+          {{- end }}
+          {{- if .Values.backendStore.existingDatabaseSecret.name }}
+            {{- if .Values.backendStore.postgres.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+            {{- if .Values.backendStore.mysql.enabled }}
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: MYSQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+            {{- if .Values.backendStore.mssql.enabled }}
+            - name: MSSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: MSSQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: {{ template "mlflow.fullname" . }}-env-configmap
+          volumeMounts:
+            - name: dbchecker
+              mountPath: /script/dbchecker.sh
+              subPath: dbchecker.sh
+      {{- end }}
+      {{- if and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) .Values.backendStore.databaseMigration }}
+        - name: "mlflow-db-migration"
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.initImages.mlflowDbMigration.repository }}:{{ .Values.initImages.mlflowDbMigration.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.initImages.mlflowDbMigration.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+        {{- if or .Values.postgresql.enabled .Values.mysql.enabled .Values.backendStore.existingDatabaseSecret.name }}
+          env:
+        {{- end }}
+          {{- if .Values.postgresql.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "mlflow.postgresql.fullname" .) }}
+              {{- if .Values.postgresql.auth.username }}
+                  key: password
+              {{- else }}
+                  key: postgres-password
+              {{- end }}
+                  optional: true
+          {{- end }}
+          {{- if .Values.mysql.enabled }}
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "mlflow.mysql.fullname" .) }}
+              {{- if .Values.mysql.auth.username }}
+                  key: password
+              {{- else }}
+                  key: mysql-root-password
+              {{- end }}
+                  optional: true
+          {{- end }}
+          {{- if .Values.backendStore.existingDatabaseSecret.name }}
+            {{- if .Values.backendStore.postgres.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+            {{- if .Values.backendStore.mysql.enabled }}
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: MYSQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+            {{- if .Values.backendStore.mssql.enabled }}
+            - name: MSSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: MSSQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: {{ template "mlflow.fullname" . }}-env-configmap
+            - secretRef:
+                name: {{ template "mlflow.fullname" . }}-env-secret
+            - secretRef:
+                name: {{ template "mlflow.fullname" . }}-flask-server-secret-key
+          command: ["python"]
+          args:
+            - /opt/mlflow/migrations.py
+          volumeMounts:
+            - name: migrations-config
+              mountPath: /opt/mlflow/migrations.py
+              subPath: migrations.py
+              readOnly: true
+      {{- end }}
+      {{- if or .Values.auth.enabled .Values.ldapAuth.enabled }}
+        - name: ini-file-initializer
+          image: "{{ .Values.initImages.iniFileInitializer.repository }}:{{ .Values.initImages.iniFileInitializer.tag }}"
+          imagePullPolicy: {{ .Values.initImages.iniFileInitializer.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          command: ['sh', '-c']
+          args:
+            - |
+              sed -e "s/\$(ADMIN_USERNAME_PLACEHOLDER)/${ADMIN_USERNAME}/g" \
+                  -e "s/\$(ADMIN_PASSWORD_PLACEHOLDER)/${ADMIN_PASSWORD}/g" \
+                {{- if .Values.auth.postgres.enabled }}
+                  -e "s/\$(POSTGRES_USERNAME_PLACEHOLDER)/${DB_USERNAME}/g" \
+                  -e "s/\$(POSTGRES_PASSWORD_PLACEHOLDER)/${DB_PASSWORD}/g" \
+                {{- end }}
+                  /template/auth_template.ini > /config/auth_result.ini
+          env:
+          {{- if .Values.auth.postgres.enabled }}
+            - name: DB_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-auth-pg-secret" (include "mlflow.fullname" .)) .Values.auth.postgres.existingSecret.name }}
+                  key: {{ ternary "username" .Values.auth.postgres.existingSecret.usernameKey (eq .Values.auth.postgres.existingSecret.name "") }}
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-auth-pg-secret" (include "mlflow.fullname" .)) .Values.auth.postgres.existingSecret.name }}
+                  key: {{ ternary "password" .Values.auth.postgres.existingSecret.passwordKey (eq .Values.auth.postgres.existingSecret.name "") }}
+          {{- end }}
+            - name: ADMIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-auth-admin-secret" (include "mlflow.fullname" .)) .Values.auth.existingAdminSecret.name }}
+                  key: {{ ternary "username" .Values.auth.existingAdminSecret.usernameKey (eq .Values.auth.existingAdminSecret.name "") }}
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-auth-admin-secret" (include "mlflow.fullname" .)) .Values.auth.existingAdminSecret.name }}
+                  key: {{ ternary "password" .Values.auth.existingAdminSecret.passwordKey (eq .Values.auth.existingAdminSecret.name "") }}
+          volumeMounts:
+            - name: auth-ini-template-file
+              mountPath: /template
+              readOnly: true
+            - name: ini-file
+              mountPath: /config
+      {{- end }}
+      {{- with .Values.initContainers }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["mlflow"]
+          args:
+            - server
+            - --host=0.0.0.0
+            - --port={{ .Values.service.containerPort }}
+          {{- if or .Values.backendStore.postgres.enabled .Values.postgresql.enabled }}
+            - --backend-store-uri=postgresql{{ $dbConnectionDriver }}://
+          {{- else if or .Values.backendStore.mysql.enabled .Values.mysql.enabled }}
+            - --backend-store-uri=mysql{{ $dbConnectionDriver }}://$(MYSQL_USERNAME):$(MYSQL_PWD)@$(MYSQL_HOST):$(MYSQL_TCP_PORT)/$(MYSQL_DATABASE)
+          {{- else if or .Values.backendStore.mssql.enabled }}
+            - --backend-store-uri=mssql{{ $dbConnectionDriver }}://$(MSSQL_USERNAME):$(MSSQL_PWD)@$(MSSQL_HOST):$(MSSQL_TCP_PORT)/$(MSSQL_DATABASE)
+          {{- else }}
+            - "--backend-store-uri=sqlite:///{{ .Values.backendStore.defaultSqlitePath }}"
+          {{- end }}
+            - {{ $artifactCommand }}
+          {{- if .Values.artifactRoot.proxiedArtifactStorage }}
+            - --serve-artifacts
+          {{- end }}
+          {{- if .Values.serviceMonitor.enabled }}
+            - --expose-prometheus=/mlflow/metrics
+          {{- end }}
+          {{- if .Values.auth.enabled }}
+            - --app-name={{ .Values.auth.appName }}
+          {{- else if .Values.ldapAuth.enabled }}
+            - --app-name=basic-auth
+          {{- end }}
+          {{- if and .Values.log.enabled (not (hasKey .Values.extraArgs "gunicornOpts")) }}
+            - {{ printf "--gunicorn-opts='--log-level=%s'" .Values.log.level }}
+          {{- end }}
+          {{- range $key, $value := .Values.extraArgs }}
+            {{- if and $.Values.log.enabled (eq $key "gunicornOpts") (contains "--log-level" $value) }}
+            - {{ printf "--gunicorn-opts='%s'" (regexReplaceAll "--log-level=[^\\s]*" $value (printf "--log-level=%s" $.Values.log.level)) }}
+            {{- else if and $.Values.log.enabled (eq $key "gunicornOpts") (not (contains "--log-level" $value)) }}
+            - {{ printf "--gunicorn-opts='--log-level=%s %s'" $.Values.log.level $value }}
+            {{- else }}
+            - {{ printf "--%s=%s" (kebabcase $key) $value }}
+            {{- end }}
+          {{- end }}
+          {{- range .Values.extraFlags }}
+            - --{{ kebabcase . }}
+          {{- end }}
+          ports:
+            - name: {{ .Values.service.containerPortName }}
+              containerPort: {{ .Values.service.containerPort }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: {{ include "mlflow.health" . }}
+              port: {{ .Values.service.containerPortName }}
+          {{- with .Values.livenessProbe }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          readinessProbe:
+            httpGet:
+              path: {{ include "mlflow.health" . }}
+              port: {{ .Values.service.containerPortName }}
+          {{- with .Values.readinessProbe }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          env:
+            - name: MLFLOW_VERSION
+              value: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+          {{- if .Values.auth.enabled }}
+            - name: MLFLOW_AUTH_CONFIG_PATH
+              value: {{ printf "%s/%s" (.Values.auth.configPath | trimSuffix "/") (default "basic_auth.ini" (.Values.auth.configFile | trimPrefix "/")) }}
+          {{- else if .Values.ldapAuth.enabled }}
+            - name: MLFLOW_AUTH_CONFIG_PATH
+              value: "/etc/mlflow/auth/ldap_basic_auth.ini"
+            {{- if or .Values.ldapAuth.encodedTrustedCACertificate .Values.ldapAuth.externalSecretForTrustedCACertificate }}
+            - name: LDAP_CA
+              value: "/certs/ca.crt"
+            {{- end }}
+          {{- end }}
+          {{- if .Values.postgresql.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "mlflow.postgresql.fullname" .) }}
+              {{- if .Values.postgresql.auth.username }}
+                  key: password
+              {{- else }}
+                  key: postgres-password
+              {{- end }}
+                  optional: true
+          {{- end }}
+          {{- if .Values.mysql.enabled }}
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "mlflow.mysql.fullname" .) }}
+              {{- if .Values.mysql.auth.username }}
+                  key: password
+              {{- else }}
+                  key: mysql-root-password
+              {{- end }}
+                  optional: true
+          {{- end }}
+          {{- if .Values.backendStore.existingDatabaseSecret.name }}
+            {{- if .Values.backendStore.postgres.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+            {{- if .Values.backendStore.mysql.enabled }}
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: MYSQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+            {{- if .Values.backendStore.mssql.enabled }}
+            - name: MSSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.passwordKey }}
+            - name: MSSQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backendStore.existingDatabaseSecret.name }}
+                  key: {{ .Values.backendStore.existingDatabaseSecret.usernameKey }}
+            {{- end }}
+          {{- end }}
+          {{- if and .Values.artifactRoot.s3.enabled .Values.artifactRoot.s3.existingSecret.name }}
+            {{- if .Values.artifactRoot.s3.existingSecret.keyOfAccessKeyId }}
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.artifactRoot.s3.existingSecret.name }}
+                  key: {{ .Values.artifactRoot.s3.existingSecret.keyOfAccessKeyId }}
+            {{- end }}
+            {{- if .Values.artifactRoot.s3.existingSecret.keyOfSecretAccessKey }}
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.artifactRoot.s3.existingSecret.name }}
+                  key: {{ .Values.artifactRoot.s3.existingSecret.keyOfSecretAccessKey }}
+            {{- end }}
+          {{- end }}
+          {{- range $key, $value := .Values.extraEnvVars }}
+            - name: {{ upper $key }}
+              value: {{ $value | quote }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: {{ template "mlflow.fullname" . }}-env-configmap
+            - secretRef:
+                name: {{ template "mlflow.fullname" . }}-env-secret
+            - secretRef:
+                name: {{ template "mlflow.fullname" . }}-flask-server-secret-key
+          {{- range .Values.extraSecretNamesForEnvFrom }}
+            - secretRef:
+                name: {{ . }}
+          {{- end }}
+          {{- if or .Values.extraVolumeMounts .Values.auth.enabled .Values.ldapAuth.enabled }}
+          volumeMounts:
+            {{- if .Values.auth.enabled }}
+            - name: ini-file
+              mountPath: {{ printf "%s/%s" (.Values.auth.configPath | trimSuffix "/") (default "basic_auth.ini" (.Values.auth.configFile | trimPrefix "/")) }}
+              subPath: auth_result.ini
+              readOnly: true
+            {{- else if .Values.ldapAuth.enabled }}
+            - name: ini-file
+              mountPath: /etc/mlflow/auth/ldap_basic_auth.ini
+              subPath: auth_result.ini
+              readOnly: true
+              {{- if or .Values.ldapAuth.encodedTrustedCACertificate .Values.ldapAuth.externalSecretForTrustedCACertificate }}
+            - name: trusted-ca-cert-secret
+              mountPath: /certs/ca.crt
+              subPath: ca.crt
+              readOnly: true
+              {{- end }}
+            {{- end }}
+          {{- with .Values.extraVolumeMounts }}
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+      {{- with .Values.extraContainers }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if or (and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) (or .Values.backendStore.databaseConnectionCheck .Values.backendStore.databaseMigration) ) .Values.extraVolumes .Values.auth.enabled .Values.ldapAuth.enabled }}
+      volumes:
+        {{- if and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) .Values.backendStore.databaseConnectionCheck }}
+        - name: dbchecker
+          configMap:
+            name: {{ template "mlflow.fullname" . }}-dbchecker
+            defaultMode: 0777
+        {{- end }}
+        {{- if and (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled .Values.backendStore.mssql.enabled .Values.postgresql.enabled .Values.mysql.enabled) .Values.backendStore.databaseMigration }}
+        - name: migrations-config
+          configMap:
+            name: {{ template "mlflow.fullname" . }}-migrations
+        {{- end }}
+        {{- if or .Values.auth.enabled .Values.ldapAuth.enabled }}
+        - name: ini-file
+          emptyDir: {}
+        - name: auth-ini-template-file
+          configMap:
+            name: {{ template "mlflow.fullname" . }}-auth-ini-template
+          {{- if or .Values.ldapAuth.encodedTrustedCACertificate .Values.ldapAuth.externalSecretForTrustedCACertificate }}
+        - name: trusted-ca-cert-secret
+          secret:
+            secretName: {{ default (printf "%s-trusted-ca-cert-secret" (include "mlflow.fullname" .)) .Values.ldapAuth.externalSecretForTrustedCACertificate }}
+          {{- end }}
+        {{- end }}
+      {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
@@ -0,0 +1,21 @@
+{{- $secretName := printf "%s-flask-server-secret-key" (include "mlflow.fullname" .) }}
+{{- $flaskServerSecretKey := ternary .Values.flaskServerSecretKey (include "mlflow.generateRandomHex" 32) (ne .Values.flaskServerSecretKey "") }}
+{{- if not (lookup "v1" "Secret" .Release.Namespace $secretName) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ include "mlflow.name" . }}
+    chart: {{ include "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": "pre-install,pre-upgrade"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+type: Opaque
+data:
+  MLFLOW_FLASK_SERVER_SECRET_KEY: {{ $flaskServerSecretKey | b64enc | quote }}
+{{- end }}
@@ -0,0 +1,28 @@
+{{- if and .Values.autoscaling.enabled (or .Values.backendStore.postgres.enabled .Values.backendStore.mysql.enabled) (or .Values.artifactRoot.azureBlob.enabled .Values.artifactRoot.s3.enabled .Values.artifactRoot.gcs.enabled) (or (and .Values.auth.enabled .Values.auth.postgres.enabled) (not .Values.auth.enabled)) }}
+---
+{{- if semverCompare ">=1.23-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: autoscaling/v2
+{{- else }}
+apiVersion: autoscaling/v2beta2
+{{- end }}
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "mlflow.fullname" . }}
+  labels:
+    {{- include "mlflow.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "mlflow.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  {{- with .Values.autoscaling.metrics }}
+  metrics:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.autoscaling.behavior (gt (len .Values.autoscaling.behavior) 0) }}
+  behavior:
+    {{- toYaml .Values.autoscaling.behavior | nindent 4 }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,61 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "mlflow.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "mlflow.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
@@ -0,0 +1,60 @@
+{{- if .Values.service.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "mlflow.fullname" . }}-env-secret
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+type: Opaque
+data:
+{{- if and .Values.backendStore.postgres.enabled (not .Values.backendStore.existingDatabaseSecret.name) }}
+  PGUSER: {{ required "postgres user must be specified" .Values.backendStore.postgres.user | b64enc }}
+  PGPASSWORD: {{ required "postgres password must be specified" .Values.backendStore.postgres.password | b64enc }}
+{{- end }}
+{{- if .Values.postgresql.enabled }}
+  PGUSER: {{ default "postgres" .Values.postgresql.auth.username | b64enc }}
+{{- end }}
+{{- if and .Values.backendStore.mysql.enabled (not .Values.backendStore.existingDatabaseSecret.name) }}
+  MYSQL_USERNAME: {{ required "mysql user must be specified" .Values.backendStore.mysql.user | b64enc }}
+  MYSQL_PWD: {{ required "mysql password must be specified" .Values.backendStore.mysql.password | b64enc }}
+{{- end }}
+{{- if and .Values.backendStore.mssql.enabled (not .Values.backendStore.existingDatabaseSecret.name) }}
+  MSSQL_USERNAME: {{ required "mssql user must be specified" .Values.backendStore.mssql.user | b64enc }}
+  MSSQL_PWD: {{ required "mssql password must be specified" .Values.backendStore.mssql.password | b64enc }}
+{{- end }}
+{{- if .Values.mysql.enabled }}
+  MYSQL_USERNAME: {{ default "root" .Values.mysql.auth.username | b64enc }}
+{{- end }}
+{{- if .Values.artifactRoot.azureBlob.enabled }}
+{{- if .Values.artifactRoot.azureBlob.connectionString }}
+  AZURE_STORAGE_CONNECTION_STRING: {{ .Values.artifactRoot.azureBlob.connectionString | b64enc }}
+{{- end }}
+{{- if .Values.artifactRoot.azureBlob.accessKey }}
+  AZURE_STORAGE_ACCESS_KEY: {{ .Values.artifactRoot.azureBlob.accessKey | b64enc }}
+{{- end }}
+{{- end }}
+{{- if .Values.artifactRoot.s3.enabled }}
+{{- if and .Values.artifactRoot.s3.awsAccessKeyId (eq .Values.artifactRoot.s3.existingSecret.name "") (eq .Values.artifactRoot.s3.existingSecret.keyOfAccessKeyId "") }}
+  AWS_ACCESS_KEY_ID: {{ .Values.artifactRoot.s3.awsAccessKeyId | b64enc }}
+{{- end }}
+{{- if and .Values.artifactRoot.s3.awsSecretAccessKey (eq .Values.artifactRoot.s3.existingSecret.name "") (eq .Values.artifactRoot.s3.existingSecret.keyOfSecretAccessKey "") }}
+  AWS_SECRET_ACCESS_KEY: {{ .Values.artifactRoot.s3.awsSecretAccessKey | b64enc }}
+{{- end }}
+{{- end }}
+{{- if .Values.ldapAuth.enabled }}
+  LDAP_URI: {{ .Values.ldapAuth.uri | b64enc }}
+  LDAP_TLS_VERIFY: {{ .Values.ldapAuth.tlsVerification | b64enc }}
+  LDAP_LOOKUP_BIND: {{ .Values.ldapAuth.lookupBind | b64enc }}
+  LDAP_GROUP_ATTRIBUTE: {{ .Values.ldapAuth.groupAttribute | b64enc }}
+  {{- if .Values.ldapAuth.groupAttributeKey }}
+  LDAP_GROUP_ATTRIBUTE_KEY: {{ .Values.ldapAuth.groupAttributeKey | b64enc }}
+  {{- end }}
+  LDAP_GROUP_SEARCH_BASE_DN: {{ .Values.ldapAuth.searchBaseDistinguishedName | b64enc }}
+  LDAP_GROUP_SEARCH_FILTER: {{ .Values.ldapAuth.searchFilter | b64enc }}
+  LDAP_GROUP_ADMIN_DN: {{ .Values.ldapAuth.adminGroupDistinguishedName | b64enc }}
+  LDAP_GROUP_USER_DN: {{ .Values.ldapAuth.userGroupDistinguishedName | b64enc }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mlflow.fullname" . }}
+  labels:
+    {{- include "mlflow.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.containerPortName }}
+      protocol: TCP
+      name: {{ .Values.service.name }}
+  selector:
+    {{- include "mlflow.selectorLabels" . | nindent 4 }}
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "mlflow.serviceAccountName" . }}
+  labels:
+    {{- include "mlflow.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}
@@ -0,0 +1,48 @@
+{{- if $.Values.serviceMonitor }}
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) ( .Values.serviceMonitor.enabled ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+{{- if .Values.serviceMonitor.labels }}
+  labels:
+{{ toYaml .Values.serviceMonitor.labels | indent 4}}
+{{- end }}
+  name: {{ template "mlflow.fullname" . }}
+{{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+{{- end }}
+spec:
+  endpoints:
+{{- if .Values.serviceMonitor.useServicePort}}
+  - port: {{ .Values.service.name }}
+{{- else }}
+  - targetPort: {{ .Values.service.name }}
+{{- end }}
+{{- if .Values.serviceMonitor.interval }}
+    interval: {{ .Values.serviceMonitor.interval }}
+{{- end }}
+{{- if .Values.serviceMonitor.telemetryPath }}
+    path: {{ .Values.serviceMonitor.telemetryPath }}
+{{- end }}
+{{- if .Values.serviceMonitor.timeout }}
+    scrapeTimeout: {{ .Values.serviceMonitor.timeout }}
+{{- end }}
+{{- if .Values.serviceMonitor.metricRelabelings }}
+    metricRelabelings:
+{{ toYaml .Values.serviceMonitor.metricRelabelings | indent 4 }}
+{{- end }}
+  jobLabel: {{ template "mlflow.fullname" . }}
+  namespaceSelector:
+    matchNames:
+    - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      {{- include "mlflow.selectorLabels" . | nindent 6 }}
+{{- if .Values.serviceMonitor.targetLabels }}
+  targetLabels:
+{{- range .Values.serviceMonitor.targetLabels }}
+    - {{ . }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,14 @@
+{{- if and .Values.ldapAuth.encodedTrustedCACertificate (not .Values.ldapAuth.externalSecretForTrustedCACertificate) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "mlflow.fullname" . }}-trusted-ca-cert-secret
+  labels:
+    app: {{ template "mlflow.name" . }}
+    chart: {{ template "mlflow.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+type: Opaque
+data:
+  ca.crt: {{ .Values.ldapAuth.encodedTrustedCACertificate }}
+{{- end }}