Add multi-tenant feature

manifests/helm/mlflow/1.9.0/custom-values.yaml

@@ -7,7 +7,10 @@ initImages:
     tag: "1.37"
   iniFileInitializer:
     tag: "1.37"
-
+  mlflowDbMigration:
+    repository: paasup/mlflow
+    tag: "v3.11.1-oidc"
+    
 backendStore:
   databaseMigration: true
   databaseConnectionCheck: true
@@ -39,9 +42,12 @@ artifactRoot:
     #   keyOfSecretAccessKey: AWS_SECRET_ACCESS_KEY
 
 extraEnvVars:
+  # --- 기본 설정 ---
   MLFLOW_S3_ENDPOINT_URL: "http://minio.minio.svc.cluster.local:9000"
   MLFLOW_S3_IGNORE_TLS: "true"
   SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
+
+  # --- OIDC 설정 ---
   OIDC_CLIENT_ID: "mlflow"
   OIDC_DISCOVERY_URL: "https://keycloak.example.org/realms/paasup/.well-known/openid-configuration"
   OIDC_REDIRECT_URI: "https://mlflow.example.org/callback"
@@ -51,10 +57,18 @@ extraEnvVars:
   OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
   OIDC_USERS_DB_URI: "postgresql://mlflow:mlflow1234@mlflow-postgresql:5432/mlflow"
   DEFAULT_MLFLOW_PERMISSION: "READ"
-  MLFLOW_ENABLE_WORKSPACES: "false"
   AUTOMATIC_LOGIN_REDIRECT: "true"
   OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
 
+  # --- Workspace 설정 ---
+  MLFLOW_ENABLE_WORKSPACES: "true"
+  OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
+  OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
+  PYTHONPATH: "/opt/mlflow-plugins"
+  WORKSPACE_CACHE_MAX_SIZE: "1024"
+  WORKSPACE_CACHE_TTL_SECONDS: "300"
+  PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
+
 extraSecretNamesForEnvFrom:
   - mlflow-oidc-secret
 
@@ -102,12 +116,17 @@ extraVolumes:
   - name: keycloak-ca-cert
     configMap:
       name: keycloak-ca-cert
+  - name: workspace-plugin
+    configMap:
+      name: mlflow-workspace-plugin
 
 extraVolumeMounts:
   - name: keycloak-ca-cert
     mountPath: /etc/ssl/certs/custom-ca.crt
     subPath: ca.crt
     readOnly: true
+  - name: workspace-plugin
+    mountPath: /opt/mlflow-plugins
 
 serviceMonitor:
   enabled: false