dip-values add

2026-06-09 11:51:43 +09:00
parent 162d9b2c2a
commit e64f933901
33 changed files with 2202 additions and 0 deletions
@@ -0,0 +1,142 @@
+image:
+  repository: paasup/mlflow
+  tag: "v3.11.1-oidc"
+
+initImages:
+  dbchecker:
+    tag: "1.37"
+  iniFileInitializer:
+    tag: "1.37"
+  mlflowDbMigration:
+    repository: paasup/mlflow
+    tag: "v3.11.1-oidc"
+
+fullnameOverride: "{{ .Name }}"    
+    
+backendStore:
+  databaseMigration: true
+  databaseConnectionCheck: true
+
+postgresql:
+  enabled: true
+  auth:
+    username: mlflow
+    password: "$postgresql.auth.password"
+    database: mlflow
+  image:
+    repository: bitnamilegacy/postgresql
+  primary:
+    persistence:
+      enabled: true
+
+artifactRoot:
+  proxiedArtifactStorage: true
+  defaultArtifactsDestination: "s3://mlflow/artifacts"
+  s3:
+    enabled: true
+    bucket: mlflow
+    path: artifacts
+    awsAccessKeyId: "$artifactRoot.s3.awsAccessKeyId"
+    awsSecretAccessKey: "$artifactRoot.s3.awsSecretAccessKey"
+
+
+extraEnvVars:
+  MLFLOW_S3_ENDPOINT_URL: "$extraEnvVars.s3endpoint"
+  MLFLOW_S3_IGNORE_TLS: "true"
+  SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
+  REQUESTS_CA_BUNDLE: "/etc/ssl/certs/custom-ca.crt"
+  HTTPX_CA_BUNDLE: "/etc/ssl/certs/custom-ca.crt"
+
+  OIDC_CLIENT_ID: "$KEYCLOAK_CLIENT_ID"
+  OIDC_DISCOVERY_URL: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/.well-known/openid-configuration"
+  OIDC_REDIRECT_URI: "https://{{ .Name }}.{{ .Domain }}/callback"
+  OIDC_SCOPE: "openid email profile"
+  OIDC_GROUPS_ATTRIBUTE: "mlflow-groups"
+  OIDC_GROUP_NAME: "paasup"
+  OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
+  OIDC_USERS_DB_URI: "postgresql://mlflow:$postgresql.auth.password@{{ .Name }}-postgresql:5432/mlflow"
+  DEFAULT_MLFLOW_PERMISSION: "READ"
+  AUTOMATIC_LOGIN_REDIRECT: "true"
+  OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
+
+  MLFLOW_ENABLE_WORKSPACES: "true"
+  OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
+  OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
+  PYTHONPATH: "/opt/mlflow-plugins"
+  WORKSPACE_CACHE_MAX_SIZE: "1024"
+  WORKSPACE_CACHE_TTL_SECONDS: "300"
+  PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
+  MLFLOW_LOGGING_LEVEL: "DEBUG"
+
+extraSecretNamesForEnvFrom:
+  - mlflow-oidc-secret
+
+auth:
+  enabled: false
+
+log:
+  enabled: false
+
+extraArgs:
+  appName: "oidc-auth"
+  uvicornOpts: "--timeout-keep-alive 600"
+  allowedHosts: "{{ .Name }}.{{ .Domain }}"
+  corsAllowedOrigins: "https://{{ .Name }}.{{ .Domain }}"
+
+service:
+  type: ClusterIP
+  port: 80
+
+ingress:
+  enabled: true
+  className: "apisix"
+  annotations:
+    cert-manager.io/cluster-issuer: "root-ca-issuer"
+    cert-manager.io/duration: 8760h
+    cert-manager.io/renew-before: 720h
+  hosts:
+    - host: "{{ .Name }}.{{ .Domain }}"
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: "{{ .Name }}-tls-secret"
+      hosts:
+        - "{{ .Name }}.{{ .Domain }}"
+
+resources:
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi
+
+extraVolumes:
+  - name: keycloak-tls
+    secret:
+      secretName: keycloak-tls
+  - name: workspace-plugin
+    configMap:
+      name: mlflow-workspace-plugin
+  - name: hooks-patch
+    configMap:
+      name: mlflow-hooks-patch
+
+extraVolumeMounts:
+  - name: keycloak-tls
+    mountPath: /etc/ssl/certs/custom-ca.crt
+    subPath: ca.crt
+    readOnly: true
+  - name: workspace-plugin
+    mountPath: /opt/mlflow-plugins
+  - name: hooks-patch
+    mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
+    subPath: before_request.py
+    readOnly: true
+
+serviceMonitor:
+  enabled: false
+  namespace: monitoring
+  labels:
+    release: prometheus