#version: mlflow, 1.9.0
image:
  repository: paasup/mlflow
  tag: "v3.11.1-oidc"

initImages:
  dbchecker:
    tag: "1.37"
  iniFileInitializer:
    tag: "1.37"
  mlflowDbMigration:
    repository: paasup/mlflow
    tag: "v3.11.1-oidc"

fullnameOverride: "demo01-mlf"

backendStore:
  databaseMigration: true
  databaseConnectionCheck: true

postgresql:
  enabled: true
  auth:
    username: mlflow
    password: "wve4mGwQHGOP"
    database: mlflow
  image:
    repository: bitnamilegacy/postgresql
  primary:
    persistence:
      enabled: true

artifactRoot:
  proxiedArtifactStorage: true
  defaultArtifactsDestination: "s3://mlflow/artifacts"
  s3:
    enabled: true
    bucket: mlflow
    path: artifacts
    awsAccessKeyId: "access123456"
    awsSecretAccessKey: "secret123456"

extraEnvVars:
  MLFLOW_S3_ENDPOINT_URL: "http://minio.minio.svc.cluster.local:9000"
  MLFLOW_S3_IGNORE_TLS: "true"
  SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"

  OIDC_CLIENT_ID: "service-demo01-mlf"
  OIDC_DISCOVERY_URL: "https://keycloak.gke.paasup.io/realms/paasup/.well-known/openid-configuration"
  OIDC_REDIRECT_URI: "https://demo01-mlf.gke.paasup.io/callback"
  OIDC_SCOPE: "openid email profile"
  OIDC_GROUPS_ATTRIBUTE: "mlflow-groups"
  OIDC_GROUP_NAME: "paasup"
  OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
  OIDC_USERS_DB_URI: "postgresql://mlflow:wve4mGwQHGOP@demo01-mlf-postgresql:5432/mlflow"
  DEFAULT_MLFLOW_PERMISSION: "READ"
  AUTOMATIC_LOGIN_REDIRECT: "true"
  OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"

  MLFLOW_ENABLE_WORKSPACES: "true"
  OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
  # OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
  OIDC_WORKSPACE_CLAIM_NAME: "workspace"
  PYTHONPATH: "/opt/mlflow-plugins"
  WORKSPACE_CACHE_MAX_SIZE: "1024"
  WORKSPACE_CACHE_TTL_SECONDS: "300"
  PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
  MLFLOW_LOGGING_LEVEL: "DEBUG"

extraSecretNamesForEnvFrom:
  - mlflow-oidc-secret

auth:
  enabled: false

log:
  enabled: false

extraArgs:
  appName: "oidc-auth"
  uvicornOpts: "--timeout-keep-alive 600"
  allowedHosts: "demo01-mlf.gke.paasup.io"
  corsAllowedOrigins: "https://demo01-mlf.gke.paasup.io"

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  className: "kong"
  annotations:
    cert-manager.io/cluster-issuer: "root-ca-issuer"
    cert-manager.io/duration: 8760h
    cert-manager.io/renew-before: 720h
  hosts:
    - host: "demo01-mlf.gke.paasup.io"
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls:
    - secretName: "demo01-mlf-tls-secret"
      hosts:
        - "demo01-mlf.gke.paasup.io"

resources:
  limits:
    cpu: 1000m
    memory: 2Gi
  requests:
    cpu: 500m
    memory: 1Gi

extraVolumes:
  - name: keycloak-tls
    secret:
      secretName: keycloak-tls
  - name: workspace-plugin
    configMap:
      name: mlflow-workspace-plugin
  - name: hooks-patch
    configMap:
      name: mlflow-hooks-patch

extraVolumeMounts:
  - name: keycloak-tls
    mountPath: /etc/ssl/certs/custom-ca.crt
    subPath: ca.crt
    readOnly: true
  - name: workspace-plugin
    mountPath: /opt/mlflow-plugins
  - name: hooks-patch
    mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
    subPath: before_request.py
    readOnly: true

serviceMonitor:
  enabled: false
  namespace: monitoring
  labels:
    release: prometheus