Configure the MLflow model registry

Introduction to the MLflow model registry

See MLflow Model Registry — MLflow documentation.

Prerequisites

• An ACK Pro cluster is created with Kubernetes 1.20 or later.

• An RDS PostgreSQL instance is created.

  We recommend selecting the same VPC as your ACK cluster and adding its CIDR block to the whitelist for internal access. If the RDS instance and ACK cluster are in different VPCs, enable public network access and add the ACK cluster VPC CIDR block to the whitelist.

• A standard account named mlflow is created in the RDS PostgreSQL instance.

• A database named mlflow_store is created in the RDS PostgreSQL instance for model metadata. Set Authorized Account to the mlflow account.

• (Optional) A database named mlflow_basic_auth is created in the RDS PostgreSQL instance for MLflow authentication data. Set Authorized Account to the mlflow account.

• The Arena client is configured (version 0.9.14 or later).

Step 1: Deploy MLflow in an ACK cluster

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Applications > Helm.

3. Click Deploy. On the Deploy page, set Application Name to mlflow and Namespace to kube-ai. In Chart, search for and select mlflow. Click Next. Confirm whether to use mlflow as the default namespace for the Chart.

   • To use the AI Suite console, deploy in the kube-ai namespace with the default release name mlflow.

   • To use Arena, deploy in any namespace with the default release name mlflow.

4. On the Create page, configure the Chart parameters.

   1. Configure defaultArtifactRoot and backendStore:

      trackingServer:
        # -- Specifies which mode mlflow tracking server run with, available options are `serve-artifacts`, `no-serve-artifacts` and `artifacts-only`
        mode: no-serve-artifacts
        # -- Specifies a default artifact location for logging, data will be logged to `mlflow-artifacts/:` if artifact serving is enabled, otherwise `./mlruns`
        defaultArtifactRoot: "./mlruns"
      # For more information about how to configure backend store, please visit https://mlflow.org/docs/latest/tracking/backend-stores.html
      backendStore:
        # -- Backend store uri e.g. `<dialect>+<driver>://<username>:<password>@<host>:<port>/<database>`
        backendStoreUri: postgresql+psycopg2://mlflow:<password>@pgm-xxxxxxxxxxxxxx.pg.rds.aliyuncs.com/mlflow_store

      Replace backendStore.backendStoreUri with your mlflow_store database endpoint.

      Important

      If the RDS instance and ACK cluster are in the same VPC, use the internal endpoint. Otherwise, use the public endpoint and ensure the ACK cluster can access it.

      Log on to the RDS PostgreSQL console. Click Instance ID > Database Connection > Internal/External Endpoint to get the endpoint, such as pgm-xxxxxxxxxxxxxx.pg.rds.aliyuncs.com.

      See Connect to a database.

   2. (Optional) To enable BasicAuth:

      trackingServer:
        # -- Specifies which mode mlflow tracking server run with, available options are `serve-artifacts`, `no-serve-artifacts` and `artifacts-only`
        mode: no-serve-artifacts
        # -- Specifies a default artifact location for logging, data will be logged to `mlflow-artifacts/:` if artifact serving is enabled, otherwise `./mlruns`
        defaultArtifactRoot: "./mlruns"
        # Basic authentication configuration,
        # for more information, please visit https://mlflow.org/docs/latest/auth/index.html#configuration
        basicAuth:
          # -- Specifies whether to enable basic authentication
          enabled: true
          # -- Default permission on all resources, available options are `READ`, `EDIT`, `MANAGE` and `NO_PERMISSIONS`
          defaultPermission: NO_PERMISSIONS
          # -- Database location to store permissions and user data e.g. `<dialect>+<driver>://<username>:<password>@<host>:<port>/<database>`
          databaseUri: postgresql+psycopg2://<username>:<password>@pgm-xxxxxxxxxxxxxx.pg.rds.aliyuncs.com/mlflow_basic_auth
          # -- Default admin username if the admin is not already created
          adminUsername: admin
          # -- Default admin password if the admin is not already created
          adminPassword: password
          # -- Function to authenticate requests
          authorizationFunction: mlflow.server.auth:authenticate_request_basic_auth
      # For more information about how to configure backend store, please visit https://mlflow.org/docs/latest/tracking/backend-stores.html
      backendStore:
        # -- Backend store uri e.g. `<dialect>+<driver>://<username>:<password>@<host>:<port>/<database>`
        backendStoreUri: postgresql+psycopg2://mlflow:<password>@pgm-xxxxxxxxxxxxxx.pg.rds.aliyuncs.com/mlflow_store

      • Replace trackingServer.basicAuth.databaseUri with your mlflow_basic_auth database endpoint.

      • Set trackingServer.basicAuth.adminUsername and trackingServer.basicAuth.adminPassword to the MLflow admin credentials. A new admin account is created only if one does not already exist.

   All Chart parameters are listed in MLflow.

Step 2: Access the MLflow Web UI deployed on Kubernetes

1. Forward the MLflow Web UI service to local port 5000:

   kubectl port-forward -n kube-ai services/mlflow 5000

   Expected output:

   Forwarding from 127.0.0.1:5000 -> 5000
   Forwarding from [::1]:5000 -> 5000
   Handling connection for 5000
   Handling connection for 5000
   ...

2. Go to http://127.0.0.1:5000 to view the MLflow Web UI.

   The Default experiment page appears with "No runs logged", confirming that MLflow is deployed and running.

What to do next: Model management

Manage models in the MLflow registry with the AI Suite console or Arena. See Manage MLflow registry models using Arena.