ODH-ADR-ML-0002: Shared workspace for cross-namespace resource sharing in MLflow - #137
Conversation
…aring Formalizes the architecture for designating a global MLflow namespace to share resources (starting with prompts) across GenAI Studio users. Key decisions: dashboard config as source of truth, Auth CR controller manages RoleBindings via label watching, SSAR security gate, prompt API centralization in MLflow BFF, user token-based access. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 58 minutes and 18 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis pull request adds a new Architecture Decision Record that specifies a cluster-scoped global MLflow workspace for sharing MLflow prompts/resources across OpenShift namespaces. The ADR defines the control flow (Dashboard cluster setting → Auth CR controller provisioning RoleBindings → MLflow BFF serving prompts to GenAI Studio using requester tokens), initial single-namespace UI scope, namespace lifecycle and graceful degradation behaviors, centralization of the prompt API in the MLflow package, security/privacy considerations, rejected alternatives, stakeholder impacts, references, and a reviews table. Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| - It supports GitOps workflows — administrators can label namespaces via declarative configuration, and the controller reacts to label changes regardless of how they are applied. | ||
| - It is architecturally consistent with how RoleBindings for other RHOAI projects are already managed. | ||
|
|
||
| When the global namespace is changed, the dashboard removes the label from the previous namespace and labels the new one. The Auth CR controller detects both changes and creates RoleBindings in the new namespace and removes them from the previous one. |
There was a problem hiding this comment.
Is there a dashboard controller that watches the dashboard config? Is that the platform operator?
There was a problem hiding this comment.
I don't believe there is active reconciliation of the config at the moment. @ederign ?
mprahl
left a comment
mprahl
left a comment
There was a problem hiding this comment.
I left a couple comments but they are not blocking from the core MLflow side.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@architecture-decision-records/mlflow/ODH-ADR-ML-0002-shared-workspace-for-cross-namespace-resource-sharing.md`:
- Around line 109-110: The Auth CR controller currently acts on namespace label
changes (e.g., "global-mlflow-workspace") regardless of source; update the
reconciliation in the Auth CR controller (the reconcile/OnUpdate handler that
provisions RoleBindings) to first verify authority via the dashboard-config
(call/check the DashboardConfig/ConfigMap entry that enumerates approved
namespaces and require a successful SSAR-like authorization check) and
ignore/quarantine any label changes on namespaces not listed in that config; in
practice modify the label-change path in the controller to: 1) fetch dashboard
config, 2) validate the namespace is authorized for shared-workspace labels, and
3) skip/provide a quarantine log entry (no RoleBinding provisioning) for labels
applied outside the configured set so provisioning cannot be triggered by
out-of-band CLI/console/GitOps changes.
- Around line 53-94: The fenced diagram block in
ODH-ADR-ML-0002-shared-workspace-for-cross-namespace-resource-sharing.md is
missing a language tag and triggers markdownlint MD040; update the opening fence
for the ASCII diagram (the triple-backtick before the cluster diagram) to
include a language identifier such as text (i.e., change ``` to ```text) and
keep the closing ``` unchanged so the fenced block is properly tagged for
markdownlint.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 8cb2a8e7-7dcf-4239-abdc-d285ba52c6ab
📒 Files selected for processing (1)
architecture-decision-records/mlflow/ODH-ADR-ML-0002-shared-workspace-for-cross-namespace-resource-sharing.md
Make explicit that authenticated users receive mlflow-view in the global namespace so they can discover and use shared prompts, while RHOAI administrators receive both mlflow-view and mlflow-edit for managing shared resources. Signed-off-by: Edson Tirelli <etirelli@redhat.com>
451380e to
2804eaa
Compare
Fix markdownlint MD040 by tagging the ASCII architecture diagram code fence. Signed-off-by: Edson Tirelli <etirelli@redhat.com>
Signed-off-by: Edson Tirelli <etirelli@redhat.com>
3 participants
Summary
Related
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit