Merge upstream/master into upstream/stable

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: VaniHaripriya

backend/src/apiserver/plugins/mlflow/handler.go

@@ -23,6 +23,7 @@ import (
 
 	"github.com/golang/glog"
 	apiv2beta1 "github.com/kubeflow/pipelines/backend/api/v2beta1/go_client"
+	"github.com/kubeflow/pipelines/backend/src/apiserver/common"
 	apiserverPlugins "github.com/kubeflow/pipelines/backend/src/apiserver/plugins"
 	commonplugins "github.com/kubeflow/pipelines/backend/src/common/plugins"
 	commonmlflow "github.com/kubeflow/pipelines/backend/src/common/plugins/mlflow"
@@ -125,7 +126,7 @@ func (h *Handler) OnBeforeRunCreation(ctx context.Context, run *apiserverPlugins
 	var runtimeTLS *commonplugins.TLSConfig
 	if runCfg.TLS != nil && runCfg.TLS.CABundlePath != "" {
 		runtimeTLS = &commonplugins.TLSConfig{
-			CABundlePath: runCfg.TLS.CABundlePath,
+			CABundlePath: common.CustomCaCertPath,
 		}
 	}
 	mlflowRuntimeConfig := commonmlflow.MLflowRuntimeConfig{

backend/src/apiserver/plugins/mlflow/handler_test.go

@@ -238,7 +238,7 @@ func TestOnBeforeRunCreation_CABundlePath_Propagated(t *testing.T) {
 	var rtCfg commonmlflow.MLflowRuntimeConfig
 	require.NoError(t, json.Unmarshal([]byte(env[commonmlflow.EnvMLflowConfig]), &rtCfg))
 	require.NotNil(t, rtCfg.TLS)
-	assert.Equal(t, caBundlePath, rtCfg.TLS.CABundlePath)
+	assert.Equal(t, common.CustomCaCertPath, rtCfg.TLS.CABundlePath)
 	assert.False(t, rtCfg.TLS.InsecureSkipVerify)
 }