image:
  repository: paasup/mlflow
  tag: "v3.11.1-oidc"

initImages:
  dbchecker:
    tag: "1.37"
  iniFileInitializer:
    tag: "1.37"
  mlflowDbMigration:
    repository: paasup/mlflow
    tag: "v3.11.1-oidc"

fullnameOverride: "{{ .Name }}"    
    
backendStore:
  databaseMigration: true
  databaseConnectionCheck: true

postgresql:
  enabled: true
  auth:
    username: mlflow
    password: "$postgresql.auth.password"
    database: mlflow
  image:
    repository: bitnamilegacy/postgresql
  primary:
    persistence:
      enabled: true

artifactRoot:
  proxiedArtifactStorage: true
  defaultArtifactsDestination: "s3://mlflow/artifacts"
  s3:
    enabled: true
    bucket: mlflow
    path: artifacts
    awsAccessKeyId: "$artifactRoot.s3.awsAccessKeyId"
    awsSecretAccessKey: "$artifactRoot.s3.awsSecretAccessKey"


extraEnvVars:
  MLFLOW_S3_ENDPOINT_URL: "$extraEnvVars.s3endpoint"
  MLFLOW_S3_IGNORE_TLS: "true"
  SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
  REQUESTS_CA_BUNDLE: "/etc/ssl/certs/custom-ca.crt"
  HTTPX_CA_BUNDLE: "/etc/ssl/certs/custom-ca.crt"

  OIDC_CLIENT_ID: "$KEYCLOAK_CLIENT_ID"
  OIDC_DISCOVERY_URL: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/.well-known/openid-configuration"
  OIDC_REDIRECT_URI: "https://{{ .Name }}.{{ .Domain }}/callback"
  OIDC_SCOPE: "openid email profile"
  OIDC_GROUPS_ATTRIBUTE: "mlflow-groups"
  OIDC_GROUP_NAME: "paasup"
  OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
  OIDC_USERS_DB_URI: "postgresql://mlflow:$postgresql.auth.password@{{ .Name }}-postgresql:5432/mlflow"
  DEFAULT_MLFLOW_PERMISSION: "READ"
  AUTOMATIC_LOGIN_REDIRECT: "true"
  OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"

  MLFLOW_ENABLE_WORKSPACES: "true"
  OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
  OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
  PYTHONPATH: "/opt/mlflow-plugins"
  WORKSPACE_CACHE_MAX_SIZE: "1024"
  WORKSPACE_CACHE_TTL_SECONDS: "300"
  PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
  MLFLOW_LOGGING_LEVEL: "DEBUG"
  MLFLOW_SERVER_ALLOWED_HOSTS: "*"

extraSecretNamesForEnvFrom:
  - mlflow-oidc-secret

auth:
  enabled: false

log:
  enabled: false

extraArgs:
  appName: "oidc-auth"
  uvicornOpts: "--timeout-keep-alive 600"
  allowedHosts: "{{ .Name }}.{{ .Domain }}"
  corsAllowedOrigins: "https://{{ .Name }}.{{ .Domain }}"

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  className: "apisix"
  annotations:
    cert-manager.io/cluster-issuer: "root-ca-issuer"
    cert-manager.io/duration: 8760h
    cert-manager.io/renew-before: 720h
    k8s.apisix.apache.org/plugin-config-name: https-redirect
  hosts:
    - host: "{{ .Name }}.{{ .Domain }}"
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: "{{ .Name }}-tls-secret"
      hosts:
        - "{{ .Name }}.{{ .Domain }}"

resources:
  limits:
    cpu: 1000m
    memory: 2Gi
  requests:
    cpu: 500m
    memory: 1Gi

extraVolumes:
  - name: keycloak-tls
    secret:
      secretName: keycloak-tls
  - name: workspace-plugin
    configMap:
      name: mlflow-workspace-plugin
  - name: hooks-patch
    configMap:
      name: mlflow-hooks-patch

extraVolumeMounts:
  - name: keycloak-tls
    mountPath: /etc/ssl/certs/custom-ca.crt
    subPath: ca.crt
    readOnly: true
  - name: workspace-plugin
    mountPath: /opt/mlflow-plugins
  - name: hooks-patch
    mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
    subPath: before_request.py
    readOnly: true

serviceMonitor:
  enabled: false
  namespace: monitoring
  labels:
    release: prometheus