You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
144 lines
3.5 KiB
144 lines
3.5 KiB
image:
|
|
repository: paasup/mlflow
|
|
tag: "v3.11.1-oidc"
|
|
|
|
initImages:
|
|
dbchecker:
|
|
tag: "1.37"
|
|
iniFileInitializer:
|
|
tag: "1.37"
|
|
mlflowDbMigration:
|
|
repository: paasup/mlflow
|
|
tag: "v3.11.1-oidc"
|
|
|
|
fullnameOverride: "{{ .Name }}"
|
|
|
|
backendStore:
|
|
databaseMigration: true
|
|
databaseConnectionCheck: true
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: mlflow
|
|
password: "$postgresql.auth.password"
|
|
database: mlflow
|
|
image:
|
|
repository: bitnamilegacy/postgresql
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
|
|
artifactRoot:
|
|
proxiedArtifactStorage: true
|
|
defaultArtifactsDestination: "s3://mlflow/artifacts"
|
|
s3:
|
|
enabled: true
|
|
bucket: mlflow
|
|
path: artifacts
|
|
awsAccessKeyId: "$artifactRoot.s3.awsAccessKeyId"
|
|
awsSecretAccessKey: "$artifactRoot.s3.awsSecretAccessKey"
|
|
|
|
|
|
extraEnvVars:
|
|
MLFLOW_S3_ENDPOINT_URL: "$extraEnvVars.s3endpoint"
|
|
MLFLOW_S3_IGNORE_TLS: "true"
|
|
SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
|
|
REQUESTS_CA_BUNDLE: "/etc/ssl/certs/custom-ca.crt"
|
|
HTTPX_CA_BUNDLE: "/etc/ssl/certs/custom-ca.crt"
|
|
|
|
OIDC_CLIENT_ID: "$KEYCLOAK_CLIENT_ID"
|
|
OIDC_DISCOVERY_URL: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/.well-known/openid-configuration"
|
|
OIDC_REDIRECT_URI: "https://{{ .Name }}.{{ .Domain }}/callback"
|
|
OIDC_SCOPE: "openid email profile"
|
|
OIDC_GROUPS_ATTRIBUTE: "mlflow-groups"
|
|
OIDC_GROUP_NAME: "paasup"
|
|
OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
|
|
OIDC_USERS_DB_URI: "postgresql://mlflow:$postgresql.auth.password@{{ .Name }}-postgresql:5432/mlflow"
|
|
DEFAULT_MLFLOW_PERMISSION: "READ"
|
|
AUTOMATIC_LOGIN_REDIRECT: "true"
|
|
OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
|
|
|
|
MLFLOW_ENABLE_WORKSPACES: "true"
|
|
OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
|
|
OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
|
|
PYTHONPATH: "/opt/mlflow-plugins"
|
|
WORKSPACE_CACHE_MAX_SIZE: "1024"
|
|
WORKSPACE_CACHE_TTL_SECONDS: "300"
|
|
PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
|
|
MLFLOW_LOGGING_LEVEL: "DEBUG"
|
|
MLFLOW_SERVER_ALLOWED_HOSTS: "*"
|
|
|
|
extraSecretNamesForEnvFrom:
|
|
- mlflow-oidc-secret
|
|
|
|
auth:
|
|
enabled: false
|
|
|
|
log:
|
|
enabled: false
|
|
|
|
extraArgs:
|
|
appName: "oidc-auth"
|
|
uvicornOpts: "--timeout-keep-alive 600"
|
|
allowedHosts: "{{ .Name }}.{{ .Domain }}"
|
|
corsAllowedOrigins: "https://{{ .Name }}.{{ .Domain }}"
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: "apisix"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "root-ca-issuer"
|
|
cert-manager.io/duration: 8760h
|
|
cert-manager.io/renew-before: 720h
|
|
k8s.apisix.apache.org/plugin-config-name: https-redirect
|
|
hosts:
|
|
- host: "{{ .Name }}.{{ .Domain }}"
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: "{{ .Name }}-tls-secret"
|
|
hosts:
|
|
- "{{ .Name }}.{{ .Domain }}"
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
extraVolumes:
|
|
- name: keycloak-tls
|
|
secret:
|
|
secretName: keycloak-tls
|
|
- name: workspace-plugin
|
|
configMap:
|
|
name: mlflow-workspace-plugin
|
|
- name: hooks-patch
|
|
configMap:
|
|
name: mlflow-hooks-patch
|
|
|
|
extraVolumeMounts:
|
|
- name: keycloak-tls
|
|
mountPath: /etc/ssl/certs/custom-ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
- name: workspace-plugin
|
|
mountPath: /opt/mlflow-plugins
|
|
- name: hooks-patch
|
|
mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
|
|
subPath: before_request.py
|
|
readOnly: true
|
|
|
|
serviceMonitor:
|
|
enabled: false
|
|
namespace: monitoring
|
|
labels:
|
|
release: prometheus |