feat: add multi-tenancy

.github/workflows/ci.yaml

@@ -131,7 +131,7 @@ jobs:
           - integration-object-storage
           - integration-s3
           - integration-ambient
-          - integration-major-upgrade
+          - integration-upgrade-minor
     runs-on: ubuntu-24.04
     steps:
       - name: Maximise GH runner space

config.yaml

@@ -12,25 +12,11 @@ options:
       The port MLFlow will be listening on
     type: int
     default: 5000
-  mlflow_nodeport:
-    description: |
-      The nodeport for MLFlow
-    type: int
-    default: 31380
   mlflow_prometheus_exporter_port:
     description: |
       The port MLFlow Prometheus exporter will be listening on
     type: int
     default: 8000
-  mlflow_prometheus_exporter_nodeport:
-    description: |
-      The nodeport for MLFlow Prometheus exporter
-    type: int
-    default: 31381
-  enable_mlflow_nodeport:
-    description: Deploy the NodePort service for MLFlow
-    type: boolean
-    default: true
   serve_artifacts:
     description: |
       Whether to let the tracking server act as a proxy to interact with the artifact store on behalf of the client.
@@ -39,3 +25,44 @@ options:
       https://mlflow.org/docs/latest/api_reference/cli.html#cmdoption-mlflow-server-serve-artifacts
     type: boolean
     default: false
+  identity_header_name:
+    description: |
+      Name of the trusted user-ID HTTP header the tracking server's custom authentication logic
+      reads to map incoming requests to MLflow users. The charm ecosystem (identity stack and
+      service mesh) is responsible for setting this header securely; the tracking server trusts it
+      as the sole source of truth for the caller's identity.
+
+      Defaults to "kubeflow-userid" (the header used when deployed alongside Charmed Kubeflow); set
+      it to e.g. "mlflow-userid" for a standalone deployment.
+    type: string
+    default: kubeflow-userid
+  identity_aliases:
+    description: |
+      Optional flat mapping from "secondary" identities received via the trusted user-ID header
+      (an IAM identity email, a programmatic access client ID, or an in-mesh K8s namespace name
+      such as a Kubeflow Profile's) to the "primary" identity already used as an MLflow user's
+      username. Several secondary identities may alias onto the same primary identity, and thus the
+      same MLflow user, for use cases where more identities should map to one user.
+
+      By convention a user's primary identity is its own MLflow username, so most identities need
+      no entry; any unmapped identity resolves to a just-in-time MLflow user of its own. Editing
+      this map never creates or removes users, it only changes how identities resolve to them.
+
+      Expressed as YAML, for example:
+
+        svc-alice-ci: alice@example.com
+        kubeflow-profile-for-dan: dan@example.com
+    type: string
+    default: ""
+  istio_waypoint_principal:
+    description: |
+      The SPIFFE principal of the platform namespace's waypoint proxy, e.g.
+      "cluster.local/ns/<namespace>/sa/<model>-istio-beacon-k8s-waypoint". This allows in-mesh
+      clients that reach the MLflow tracking server through the waypoint.
+
+      Only relevant when the charm is related over `service-mesh`. When left empty without a
+      `service-mesh` relation, the charm does not create an authorization policy for the tracking
+      server. When `service-mesh` is related, this option must be set; otherwise the charm is
+      blocked until the waypoint principal is configured.
+    type: string
+    default: ""