You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
145 lines
3.5 KiB
145 lines
3.5 KiB
image:
|
|
repository: paasup/mlflow
|
|
tag: "v3.11.1-oidc"
|
|
|
|
initImages:
|
|
dbchecker:
|
|
tag: "1.37"
|
|
iniFileInitializer:
|
|
tag: "1.37"
|
|
mlflowDbMigration:
|
|
repository: paasup/mlflow
|
|
tag: "v3.11.1-oidc"
|
|
|
|
backendStore:
|
|
databaseMigration: true
|
|
databaseConnectionCheck: true
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: mlflow
|
|
password: mlflow1234
|
|
database: mlflow
|
|
image:
|
|
repository: bitnamilegacy/postgresql
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
|
|
artifactRoot:
|
|
proxiedArtifactStorage: true
|
|
defaultArtifactsDestination: "s3://mlflow/artifacts"
|
|
s3:
|
|
enabled: true
|
|
bucket: mlflow
|
|
path: artifacts
|
|
awsAccessKeyId: "adminuser" # 직접 입력하거나 existingSecret 사용
|
|
awsSecretAccessKey: "adminuser"
|
|
# existingSecret:
|
|
# name: mlflow-s3-secret
|
|
# keyOfAccessKeyId: AWS_ACCESS_KEY_ID
|
|
# keyOfSecretAccessKey: AWS_SECRET_ACCESS_KEY
|
|
|
|
extraEnvVars:
|
|
# --- 기본 설정 ---
|
|
MLFLOW_S3_ENDPOINT_URL: "http://minio.minio.svc.cluster.local:9000"
|
|
MLFLOW_S3_IGNORE_TLS: "true"
|
|
SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
|
|
|
|
# --- OIDC 설정 ---
|
|
OIDC_CLIENT_ID: "mlflow"
|
|
OIDC_DISCOVERY_URL: "https://keycloak.example.org/realms/paasup/.well-known/openid-configuration"
|
|
OIDC_REDIRECT_URI: "https://mlflow.example.org/callback"
|
|
OIDC_SCOPE: "openid email profile"
|
|
OIDC_GROUPS_ATTRIBUTE: "groups"
|
|
OIDC_GROUP_NAME: "mlflow"
|
|
OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
|
|
OIDC_USERS_DB_URI: "postgresql://mlflow:mlflow1234@mlflow-postgresql:5432/mlflow"
|
|
DEFAULT_MLFLOW_PERMISSION: "READ"
|
|
AUTOMATIC_LOGIN_REDIRECT: "true"
|
|
OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
|
|
|
|
# --- Workspace 설정 ---
|
|
MLFLOW_ENABLE_WORKSPACES: "true"
|
|
OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
|
|
OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
|
|
PYTHONPATH: "/opt/mlflow-plugins"
|
|
WORKSPACE_CACHE_MAX_SIZE: "1024"
|
|
WORKSPACE_CACHE_TTL_SECONDS: "300"
|
|
PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
|
|
MLFLOW_LOGGING_LEVEL: "DEBUG"
|
|
|
|
extraSecretNamesForEnvFrom:
|
|
- mlflow-oidc-secret
|
|
|
|
auth:
|
|
enabled: false
|
|
|
|
log:
|
|
enabled: false
|
|
|
|
extraArgs:
|
|
appName: "oidc-auth"
|
|
uvicornOpts: "--timeout-keep-alive 600"
|
|
allowedHosts: "mlflow.example.org"
|
|
corsAllowedOrigins: "https://mlflow.example.org"
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: "kong"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "selfsigned-issuer"
|
|
cert-manager.io/duration: 8760h
|
|
cert-manager.io/renew-before: 720h
|
|
konghq.com/plugins: mlflow-cors
|
|
hosts:
|
|
- host: mlflow.example.org
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
tls:
|
|
- secretName: mlflow-tls-secret
|
|
hosts:
|
|
- mlflow.example.org
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
extraVolumes:
|
|
- name: keycloak-ca-cert
|
|
configMap:
|
|
name: keycloak-ca-cert
|
|
- name: workspace-plugin
|
|
configMap:
|
|
name: mlflow-workspace-plugin
|
|
- name: hooks-patch
|
|
configMap:
|
|
name: mlflow-hooks-patch
|
|
|
|
extraVolumeMounts:
|
|
- name: keycloak-ca-cert
|
|
mountPath: /etc/ssl/certs/custom-ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
- name: workspace-plugin
|
|
mountPath: /opt/mlflow-plugins
|
|
- name: hooks-patch
|
|
mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
|
|
subPath: before_request.py
|
|
readOnly: true
|
|
|
|
serviceMonitor:
|
|
enabled: false
|
|
namespace: monitoring
|
|
labels:
|
|
release: prometheus |