You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
141 lines
3.3 KiB
141 lines
3.3 KiB
#version: mlflow, 1.9.0
|
|
image:
|
|
repository: paasup/mlflow
|
|
tag: "v3.11.1-oidc"
|
|
|
|
initImages:
|
|
dbchecker:
|
|
tag: "1.37"
|
|
iniFileInitializer:
|
|
tag: "1.37"
|
|
mlflowDbMigration:
|
|
repository: paasup/mlflow
|
|
tag: "v3.11.1-oidc"
|
|
|
|
fullnameOverride: "demo01-mlf"
|
|
|
|
backendStore:
|
|
databaseMigration: true
|
|
databaseConnectionCheck: true
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: mlflow
|
|
password: "wve4mGwQHGOP"
|
|
database: mlflow
|
|
image:
|
|
repository: bitnamilegacy/postgresql
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
|
|
artifactRoot:
|
|
proxiedArtifactStorage: true
|
|
defaultArtifactsDestination: "s3://mlflow/artifacts"
|
|
s3:
|
|
enabled: true
|
|
bucket: mlflow
|
|
path: artifacts
|
|
awsAccessKeyId: "access123456"
|
|
awsSecretAccessKey: "secret123456"
|
|
|
|
extraEnvVars:
|
|
MLFLOW_S3_ENDPOINT_URL: "http://minio.minio.svc.cluster.local:9000"
|
|
MLFLOW_S3_IGNORE_TLS: "true"
|
|
SSL_CERT_FILE: "/etc/ssl/certs/custom-ca.crt"
|
|
|
|
OIDC_CLIENT_ID: "service-demo01-mlf"
|
|
OIDC_DISCOVERY_URL: "https://keycloak.gke.paasup.io/realms/paasup/.well-known/openid-configuration"
|
|
OIDC_REDIRECT_URI: "https://demo01-mlf.gke.paasup.io/callback"
|
|
OIDC_SCOPE: "openid email profile"
|
|
OIDC_GROUPS_ATTRIBUTE: "mlflow-groups"
|
|
OIDC_GROUP_NAME: "paasup"
|
|
OIDC_ADMIN_GROUP_NAME: "mlflow-admin"
|
|
OIDC_USERS_DB_URI: "postgresql://mlflow:wve4mGwQHGOP@demo01-mlf-postgresql:5432/mlflow"
|
|
DEFAULT_MLFLOW_PERMISSION: "READ"
|
|
AUTOMATIC_LOGIN_REDIRECT: "true"
|
|
OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
|
|
|
|
MLFLOW_ENABLE_WORKSPACES: "true"
|
|
OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"
|
|
# OIDC_WORKSPACE_DETECTION_PLUGIN: "mlflow_workspace_detector"
|
|
OIDC_WORKSPACE_CLAIM_NAME: "workspace"
|
|
PYTHONPATH: "/opt/mlflow-plugins"
|
|
WORKSPACE_CACHE_MAX_SIZE: "1024"
|
|
WORKSPACE_CACHE_TTL_SECONDS: "300"
|
|
PERMISSION_SOURCE_ORDER: "user,group,regex,group-regex"
|
|
MLFLOW_LOGGING_LEVEL: "DEBUG"
|
|
|
|
extraSecretNamesForEnvFrom:
|
|
- mlflow-oidc-secret
|
|
|
|
auth:
|
|
enabled: false
|
|
|
|
log:
|
|
enabled: false
|
|
|
|
extraArgs:
|
|
appName: "oidc-auth"
|
|
uvicornOpts: "--timeout-keep-alive 600"
|
|
allowedHosts: "demo01-mlf.gke.paasup.io"
|
|
corsAllowedOrigins: "https://demo01-mlf.gke.paasup.io"
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: "kong"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "root-ca-issuer"
|
|
cert-manager.io/duration: 8760h
|
|
cert-manager.io/renew-before: 720h
|
|
hosts:
|
|
- host: "demo01-mlf.gke.paasup.io"
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
tls:
|
|
- secretName: "demo01-mlf-tls-secret"
|
|
hosts:
|
|
- "demo01-mlf.gke.paasup.io"
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
extraVolumes:
|
|
- name: keycloak-tls
|
|
secret:
|
|
secretName: keycloak-tls
|
|
- name: workspace-plugin
|
|
configMap:
|
|
name: mlflow-workspace-plugin
|
|
- name: hooks-patch
|
|
configMap:
|
|
name: mlflow-hooks-patch
|
|
|
|
extraVolumeMounts:
|
|
- name: keycloak-tls
|
|
mountPath: /etc/ssl/certs/custom-ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
- name: workspace-plugin
|
|
mountPath: /opt/mlflow-plugins
|
|
- name: hooks-patch
|
|
mountPath: /usr/local/lib/python3.10/site-packages/mlflow_oidc_auth/hooks/before_request.py
|
|
subPath: before_request.py
|
|
readOnly: true
|
|
|
|
serviceMonitor:
|
|
enabled: false
|
|
namespace: monitoring
|
|
labels:
|
|
release: prometheus |