Update values for mlflow

mlflow/values.yaml

@@ -0,0 +1,141 @@
+#version: mlflow, 1.9.0
+image:
+  repository: paasup/mlflow
+  tag: "v3.11.1-oidc"
+
+initImages:
+  dbchecker:
+    tag: "1.37"
+  iniFileInitializer:
+    tag: "1.37"
+  mlflowDbMigration:
+    repository: paasup/mlflow
+    tag: "v3.11.1-oidc"
+
+fullnameOverride: "mlflow"
+
+backendStore:
+  databaseMigration: true
+  databaseConnectionCheck: true
+
+postgresql:
+  enabled: true
+  auth:
+    username: mlflow
+    password: "zmSCZqFlUhAC"
+    database: mlflow
+  image:
+    repository: bitnamilegacy/postgresql
+  primary:
+    persistence:
+      enabled: true
+
+artifactRoot:
+  proxiedArtifactStorage: true
+  defaultArtifactsDestination: "s3://mlflow/artifacts"
+  s3:
+    enabled: true
+    bucket: mlflow
+    path: artifacts
+    awsAccessKeyId: "accesskey1234"
+    awsSecretAccessKey: "secretkey1234"
+
+extraEnvVars:
+  MLFLOW_S3_ENDPOINT_URL: "http://minio.minio.svc.cluster.local:9000"
+  MLFLOW_S3_IGNORE_TLS: "true"
+  # SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
+
+  OIDC_CLIENT_ID: "service-mlflow"
+  OIDC_DISCOVERY_URL: "https://keycloak.gke.paasup.io/realms/paasup/.well-known/openid-configuration"
+  OIDC_REDIRECT_URI: "https://mlflow.gke.paasup.io/callback"
+  OIDC_SCOPE: "openid email profile"
+  OIDC_GROUPS_ATTRIBUTE: "mlflow-groups"
+  OIDC_GROUP_NAME: "paasup"
+  OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
+  OIDC_USERS_DB_URI: "postgresql://mlflow:zmSCZqFlUhAC@mlflow-postgresql:5432/mlflow"
+  DEFAULT_MLFLOW_PERMISSION: "READ"
+  AUTOMATIC_LOGIN_REDIRECT: "true"
+  OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
+
+  MLFLOW_ENABLE_WORKSPACES: "true"
+  OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
+  OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
+  # OIDC_WORKSPACE_CLAIM_NAME: "workspace"
+  PYTHONPATH: "/opt/mlflow-plugins"
+  WORKSPACE_CACHE_MAX_SIZE: "1024"
+  WORKSPACE_CACHE_TTL_SECONDS: "300"
+  PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
+  MLFLOW_LOGGING_LEVEL: "DEBUG"
+
+extraSecretNamesForEnvFrom:
+  - mlflow-oidc-secret
+
+auth:
+  enabled: false
+
+log:
+  enabled: false
+
+extraArgs:
+  appName: "oidc-auth"
+  uvicornOpts: "--timeout-keep-alive 600"
+  allowedHosts: "mlflow.gke.paasup.io"
+  corsAllowedOrigins: "https://mlflow.gke.paasup.io"
+
+service:
+  type: ClusterIP
+  port: 80
+
+ingress:
+  enabled: true
+  className: "kong"
+  annotations:
+    cert-manager.io/cluster-issuer: "root-ca-issuer"
+    cert-manager.io/duration: 8760h
+    cert-manager.io/renew-before: 720h
+  hosts:
+    - host: "mlflow.gke.paasup.io"
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - secretName: "mlflow-tls-secret"
+      hosts:
+        - "mlflow.gke.paasup.io"
+
+resources:
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi
+
+extraVolumes:
+  # - name: keycloak-tls
+  #   secret:
+  #     secretName: keycloak-tls
+  - name: workspace-plugin
+    configMap:
+      name: mlflow-workspace-plugin
+  - name: hooks-patch
+    configMap:
+      name: mlflow-hooks-patch
+
+extraVolumeMounts:
+  # - name: keycloak-tls
+  #   mountPath: /etc/ssl/certs/custom-ca.crt
+  #   subPath: ca.crt
+  #   readOnly: true
+  - name: workspace-plugin
+    mountPath: /opt/mlflow-plugins
+  - name: hooks-patch
+    mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
+    subPath: before_request.py
+    readOnly: true
+
+serviceMonitor:
+  enabled: false
+  namespace: monitoring
+  labels:
+    release: prometheus