fix: bump mlflow-kubernetes-plugins to 1.3.0 for MLflow 3.13 auth coverage#315
Conversation
…erage Signed-off-by: kramaranya <kramaranya15@gmail.com>
📝 WalkthroughWalkthrough
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Supply chain surface (CWE-829 / CWE-494): Two items require explicit verification before merge:
🚥 Pre-merge checks | ✅ 9 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (9 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@requirements/konflux-pypi.in`:
- Line 13: The mlflow-kubernetes-plugins==1.3.0 dependency update in the
konflux-pypi.in file lacks test validation evidence. Run integration tests with
mlflow-kubernetes-plugins 1.3.0 against your locked MLflow version to confirm
runtime compatibility. Additionally, check the transitive dependencies
introduced by mlflow-kubernetes-plugins 1.3.0 (kubernetes >=29.0.0 and
graphql-core >=3.2.0) against the version constraints already locked in
requirements/konflux-aipcc-requirements.txt to verify there are no conflicts or
version mismatches. Document the test results and dependency verification
findings in the pull request to provide the required validation evidence.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 206441fc-2400-4f83-a260-dad4070ad06f
📒 Files selected for processing (2)
requirements/konflux-pypi-requirements.txtrequirements/konflux-pypi.in
| # python requirements/compile.py | ||
|
|
||
| mlflow-kubernetes-plugins==1.2.1 | ||
| mlflow-kubernetes-plugins==1.3.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What are the changes in mlflow-kubernetes-plugins version 1.3.0 compared to 1.2.1?
💡 Result:
The mlflow-kubernetes-plugins package version 1.3.0, released on June 12, 2026 [1][2], is part of the Kubeflow mlflow-integration repository [2]. While official release notes detailing specific code changes between 1.2.1 and 1.3.0 are not explicitly indexed in public summaries, the package maintains its core functionality as a Kubernetes-backed WorkspaceProvider and an optional Kubernetes RBAC authorization plugin [3][2]. Key information regarding this release: - Repository Migration: The project is now hosted under the kubeflow/mlflow-integration repository [2], having moved from its previous location at opendatahub-io/mlflow-kubernetes-plugins [4]. - Versioning: Version 1.3.0 was released shortly after 1.2.1 (which was released on May 8, 2026) [1][5]. - Dependencies: Version 1.3.0 requires MLflow <4.0.0, >=3.10.0, Kubernetes >=29.0.0, and graphql-core >=3.2.0 [3]. It requires Python >=3.12 [3]. - Scope: The plugin continues to provide workspace mapping to Kubernetes namespaces and Kubernetes-based request authorization [3][2]. For a complete list of commits or granular code changes between versions 1.2.1 and 1.3.0, please consult the commit history directly on the kubeflow/mlflow-integration GitHub repository [2].
Citations:
- 1: https://www.piwheels.org/project/mlflow-kubernetes-plugins/
- 2: https://github.com/kubeflow/mlflow-integration
- 3: https://pypi.org/project/mlflow-kubernetes-plugins/1.3.0/
- 4: https://github.com/opendatahub-io/mlflow-kubernetes-plugins
- 5: https://pypi.org/project/mlflow-kubernetes-plugins/
🏁 Script executed:
#!/bin/bash
# Check transitive dependencies of mlflow-kubernetes-plugins 1.3.0
pip show mlflow-kubernetes-plugins 2>/dev/null || echo "Package not installed, checking PyPI metadata"
# Try to fetch package metadata from PyPI
python3 - <<'PY'
import json
import urllib.request
try:
url = "https://pypi.org/pypi/mlflow-kubernetes-plugins/1.3.0/json"
with urllib.request.urlopen(url, timeout=10) as response:
data = json.loads(response.read())
print("=== mlflow-kubernetes-plugins 1.3.0 Dependencies ===")
requires = data['info'].get('requires_dist', [])
if requires:
for req in requires:
print(req)
else:
print("No requires_dist found")
except Exception as e:
print(f"Error fetching metadata: {e}")
PYRepository: opendatahub-io/mlflow
Length of output: 264
🏁 Script executed:
#!/bin/bash
# Check if requirements/konflux-aipcc-requirements.txt exists and examine it
if [ -f "requirements/konflux-aipcc-requirements.txt" ]; then
echo "=== Contents of konflux-aipcc-requirements.txt ==="
head -50 requirements/konflux-aipcc-requirements.txt
else
echo "File not found. Searching for similar files:"
find . -name "*requirements*.txt" -o -name "*requirements*.in" 2>/dev/null | grep -v ".git"
fiRepository: opendatahub-io/mlflow
Length of output: 2729
🌐 Web query:
mlflow-kubernetes-plugins 1.3.0 release notes changelog kubeflow mlflow-integration
💡 Result:
Not enough source evidence was retrieved in this run to provide the actual “release notes/changelog” contents for mlflow-kubernetes-plugins version 1.3.0. What I could verify from authoritative sources - The package exists and is described as providing a Kubernetes-backed workspace provider plus an optional Kubernetes authorization plugin for MLflow workspaces. [1] - In the Kubeflow integration docs, the entry points are: - kubernetes -> MLflow hook mlflow.workspace_provider [2] - kubernetes-auth -> MLflow hook mlflow.app [3] - mlflow-kubernetes-plugins 1.3.0 has dependency constraints for MLflow (>=3.10.0, <4.0.0). [1] What is missing (for 1.3.0 specifically) - I did not find any retrieved page (PyPI, the integration repo, or GitHub release pages indexed in the search results) that contains the text of the 1.3.0 “release notes” or a “what’s changed” changelog section for that exact version. [1] If you want, I can do a second targeted search round specifically for the GitHub release tag “v1.3.0” and/or a compare link “v1.2.x...v1.3.0” to extract the exact changelog entries.
Citations:
- 1: https://pypi.org/project/mlflow-kubernetes-plugins/1.3.0/
- 2: https://github.com/kubeflow/mlflow-integration/blob/main/docs/workspace-provider.md
- 3: https://github.com/kubeflow/mlflow-integration
🏁 Script executed:
#!/bin/bash
# Extract locked MLflow version from konflux-aipcc-requirements.txt to check compatibility
grep "^mlflow==" requirements/konflux-aipcc-requirements.txt | head -5Repository: opendatahub-io/mlflow
Length of output: 47
🌐 Web query:
site:github.com kubeflow/mlflow-integration v1.3.0 release changelog
💡 Result:
The kubeflow/mlflow-integration repository currently lists version v1.3.0 as its latest release, published on June 12, 2026 [1]. There is no publicly available changelog text specifically attached to the v1.3.0 release tag in the repository's release section [1]. It is important to note that the Kubeflow ecosystem previously released a major version labeled v1.3.0 in April 2021 [2]; however, this is distinct from the versioning used by the kubeflow/mlflow-integration repository, which was created in March 2026 [1]. Users should not confuse the repository's v1.3.0 release with the historical Kubeflow 1.3.0 platform release [2][3]. For details on the latest changes, users may refer to the repository's commit history or pull request logs, as the official release page for v1.3.0 does not contain descriptive release notes [1].
Citations:
- 1: https://github.com/kubeflow/mlflow-integration
- 2: https://github.com/kubeflow/website/blob/v1.9-branch/content/en/docs/releases/kubeflow-1.3.md
- 3: https://github.com/kubeflow/manifests/blob/v1.3-branch/README.md
🌐 Web query:
mlflow-kubernetes-plugins 1.3.0 transitive dependencies kubernetes graphql-core requirements
💡 Result:
The mlflow-kubernetes-plugins version 1.3.0 package requires the following primary dependencies [1]: - mlflow: >=3.10.0 and <4.0.0 [1] - kubernetes: >=29.0.0 [1] - graphql-core: >=3.2.0 [1] The dependency on graphql-core is listed as a direct dependency of the package [1]. Transitive dependencies are the dependencies of these primary packages, which will vary based on the specific versions of mlflow, kubernetes, and graphql-core installed in your Python environment [1].
Citations:
MLflow 3.13 compatibility is satisfied; shift focus to test validation evidence.
The version constraint for mlflow-kubernetes-plugins 1.3.0 explicitly requires MLflow >=3.10.0, <4.0.0—MLflow 3.13 falls within this range. No compatibility risk exists on that axis.
However, dependency bumps remain a supply-chain surface (CWE-1104: Use of Unmaintained Third Party Components). The valid concern is test validation:
Provide:
- Test results confirming mlflow-kubernetes-plugins 1.3.0 works with your locked MLflow version
- Verification that transitive dependencies of 1.3.0 (kubernetes >=29.0.0, graphql-core >=3.2.0) do not conflict with locked versions in requirements/konflux-aipcc-requirements.txt
Note: GitHub release page for v1.3.0 contains no descriptive release notes; consult commit history if detailed changelog is required.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@requirements/konflux-pypi.in` at line 13, The
mlflow-kubernetes-plugins==1.3.0 dependency update in the konflux-pypi.in file
lacks test validation evidence. Run integration tests with
mlflow-kubernetes-plugins 1.3.0 against your locked MLflow version to confirm
runtime compatibility. Additionally, check the transitive dependencies
introduced by mlflow-kubernetes-plugins 1.3.0 (kubernetes >=29.0.0 and
graphql-core >=3.2.0) against the version constraints already locked in
requirements/konflux-aipcc-requirements.txt to verify there are no conflicts or
version mismatches. Document the test results and dependency verification
findings in the pull request to provide the required validation evidence.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: DaoDaoNoCode, pmccarthy The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit 4adadfe
into
opendatahub-io:master
3 participants
Summary
https://redhat.atlassian.net/browse/RHOAIENG-70228
Upstream / Downstream Impact
opendatahub-io/mlflowmlflow/mlflowIf relevant, add any upstream issue or follow-up link here:
Testing
Testing details:
Summary by CodeRabbit
mlflow-kubernetes-pluginsdependency to version 1.3.0.