Managing model registries

Red Hat OpenShift AI Self-Managed 3.0

Managing model registries in Red Hat OpenShift AI Self-Managed

Abstract

As an OpenShift AI administrator, you can create, delete, and manage permissions for model registries in OpenShift AI.

Preface
Copy link

As an OpenShift AI administrator, you can create, delete, and manage permissions for model registries in OpenShift AI.

Chapter 1. Overview of the model catalog and model registries
Copy link

The model catalog provides a curated library where data scientists and AI engineers can discover and evaluate the available generative AI (gen AI) models to find the best fit for their use cases.

A model registry acts as a central repository for administrators, data scientists, and AI engineers to register, version, and manage the lifecycle of AI models before configuring them for deployment. A model registry is a key component for AI model governance.

1.1. Model catalog
Copy link

Data scientists and AI engineers can use the model catalog to discover and evaluate the gen AI models that are available and ready for their organization to register, deploy, and customize.

The model catalog provides models from different providers that you can search, discover, and evaluate before you register models in a model registry and deploy them to a model serving runtime. Third-party gen AI models are benchmarked by Red Hat for performance and quality by using open-source evaluation datasets. You can compare performance metrics for specific hardware configurations and determine the most suitable option for deployment.

OpenShift AI provides a default model catalog, which includes models from providers such as Red Hat, IBM, Meta, Nvidia, Mistral AI, and Google. OpenShift AI administrators can configure the available repository sources for models displayed in the model catalog.

For more information about how data scientists and AI engineers can use the model catalog, see Working with the model catalog.

1.2. Model registry
Copy link

A model registry is an important component in the lifecycle of an artificial intelligence/machine learning (AI/ML) model, and is a vital part of any machine learning operations (MLOps) platform or workflow. A model registry acts as a central repository, storing metadata related to machine learning models from development to deployment. This metadata ranges from high-level information like the deployment environment and project, to specific details like training hyperparameters, performance metrics, and deployment events.

A model registry acts as a bridge between model experimentation and serving, offering a secure, collaborative metadata store interface for stakeholders in the ML lifecycle. Model registries provide a structured and organized way to store, share, version, deploy, and track models.

OpenShift AI administrators can create model registries in OpenShift AI and grant model registry access to data scientists and AI engineers. For more information, see Managing model registries.

Data scientists and AI engineers with access to a model registry can use it to store, share, version, deploy, and track models. For more information, see Working with model registries.

Chapter 2. Creating a model registry
Copy link

You can create a model registry to store, share, version, deploy, and track your models.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
The model registry component is enabled in your OpenShift AI deployment. For more information, see Enabling the model registry component.
You have access to an external MySQL database which uses at least MySQL version 5.x. However, Red Hat recommends that you use MySQL version 8.x.

Procedure

From the OpenShift AI dashboard, click Settings → Model resources and operations → Model registry settings.
Click Create model registry.
The Create model registry dialog opens.
In the Name field, enter a name for the model registry.
Optional: Click Edit resource name, and then enter a specific resource name for the model registry in the Resource name field. By default, the resource name will match the name of the model registry.
Important
Resource names are what your resources are labeled as in OpenShift. Your resource name cannot exceed 253 characters, must consist of lowercase alphanumeric characters or -, and must start and end with an alphanumeric character. Resource names are not editable after creation.
The resource name must not match the name of any other model registry resource in your OpenShift cluster.
Optional: In the Description field, enter a description for the model registry.
In the Connect to external MySQL database section, enter the information for the external database where your model data is stored.
1. In the Host field, enter the database hostname.
  1. If the database is running in the rhoai-model-registries namespace, enter only the hostname for the database.
  2. If the database is running in a different namespace from rhoai-model-registries, enter the database hostname details in <hostname>.<namespace>.svc.cluster.local format.
2. In the Port field, enter the port number for the database.
3. In the Username field, enter the default user name that is connected to the database.
4. In the Password field, enter the password for the default user account.
5. In the Database field, enter the database name.
Optional: Select the Add CA certificate to secure database connection to use a certificate with your database connection.
Important
If your external database is configured to enforce Transport Layer Security (TLS), then you must add a Certificate Authority (CA) certificate.
1. Click Use cluster-wide CA bundle to use the ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
2. Click Use Red Hat OpenShift AI CA bundle to use the odh-ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
3. Click Choose from existing certificates to select an existing certificate. You can select the key of any ConfigMap or secret in the rhoai-model-registries namespace.
  1. From the Resource list, select a ConfigMap or secret.
  2. From the Key list, select a key.
4. Click Upload new certificate to upload a new certificate as a ConfigMap.
  1. Drag and drop the PEM file for your certificate into the Certificate field, or click Upload to select a file from your local machine’s file system.
    Note
    Uploading a certificate creates the db-credential ConfigMap with the ca.crt key.
    To upload a certificate as a secret, you must create a secret in the OpenShift rhoai-model-registries namespace, and then select it as an existing certificate when you create your model registry.
    For more information about creating secrets, see Providing sensitive data to pods by using secrets in the OpenShift Container Platform documentation.
Click Create.

Note

To find the resource name or type of a model registry, click the help icon beside the registry name. Resource names and types are used to find your resources in OpenShift.

Verification

The new model registry is displayed on the Model registry settings page.
You can edit the model registry by clicking the action menu (⋮) beside it, and then clicking Edit model registry.
You can register a model with the model registry from the Model registry tab. For more information about working with model registries, see Working with model registries.

Chapter 3. Editing a model registry
Copy link

You can edit the details of existing model registries, such as the model registry name, description, and database connection details.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
The model registry component is enabled in your OpenShift AI deployment. For more information, see Enabling the model registry component.
Your OpenShift AI deployment contains at least 1 model registry.

Procedure

From the OpenShift AI dashboard, click Settings → Model resources and operations → Model registry settings.
Click the action menu (⋮) beside the model registry that you want to edit, and then click Edit model registry.
The Edit model registry dialog opens.
Optional: In the Name field, edit the name of the model registry.
Optional: In the Description field, edit the description of the model registry.
Optional: In the Connect to external MySQL database section, edit the information for the external database where model data for the registry is stored.
1. In the Host field, enter the database hostname.
  1. If the database is running in the rhoai-model-registries namespace, enter only the hostname for the database.
  2. If the database is running in a different namespace from rhoai-model-registries, enter the database hostname details in <hostname>.<namespace>.svc.cluster.local format.
2. In the Port field, enter the port number for the database.
3. In the Username field, enter the default user name that is connected to the database.
4. In the Password field, enter the password for the default user account.
5. In the Database field, enter the database name.
Optional: Select the Add CA certificate to secure database connection to use a certificate with your database connection.
Important
If your external database is configured to enforce Transport Layer Security (TLS), then you must add a Certificate Authority (CA) certificate.
1. Click Use cluster-wide CA bundle to use the ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
2. Click Use Red Hat OpenShift AI CA bundle to use the odh-ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
3. Click Choose from existing certificates to select an existing certificate. You can select the key of any ConfigMap or secret in the rhoai-model-registries namespace.
  1. From the Resource list, select a ConfigMap or secret.
  2. From the Key list, select a key.
4. Click Upload new certificate to upload a new certificate as a ConfigMap.
  1. Drag and drop the PEM file for your certificate into the Certificate field, or click Upload to select a file from your local machine’s file system.
    Note
    Uploading a certificate creates the db-credential ConfigMap with the ca.crt key.
    To upload a certificate as a secret, you must create a secret in the OpenShift rhoai-model-registries namespace, and then select it as an existing certificate when you create your model registry.
    For more information about creating secrets, see Providing sensitive data to pods by using secrets in the OpenShift Container Platform documentation.
Click Update.

Verification

The model registry is displayed with updated details on the Model registry settings page.

Chapter 4. Managing model registry permissions
Copy link

You can manage access to a model registry for individual users and user groups in your organization, and for service accounts in a project.

Note

OpenShift AI creates the <model-registry-name>-users group automatically for use with model registries. You can add users to this group in OpenShift, or ask the cluster administrator to do so.

The model registry operator uses OpenShift Role-Based Access Control (RBAC), and creates various RBAC resources in the rhoai-model-registries namespace.

For each model registry instance, the operator creates a registry-users-<model registry instance name> role and an OpenShift group called <model registry instance name>-users. To grant an individual user, service account, or group access to a model registry instance, your cluster administrator must create a role binding to the registry-users-<model registry instance name> role for the instance.

The <model registry instance name>-users group has a role binding to the registry-users-<model registry instance name> role. Your cluster administrator can add users to this group to grant them access to the model registry instance without needing to create a role binding for each user.

For more information about managing RBAC in OpenShift, see Using RBAC to define and apply permissions.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
An available model registry exists in your deployment.
The users and groups that you want to provide access to already exist in OpenShift. For more information, see Managing users and groups.

Procedure

From the OpenShift AI dashboard, click Settings → Model resources and operations → Model registry settings.
Click Manage permissions beside the model registry that you want to manage access for.
The permissions page for the model registry opens.
Provide one or more OpenShift groups with access to the project.
1. On the Users tab, in the Groups section, click Add group.
2. From the Select a group drop-down list, select a group.
  Note
  To enable access for all cluster users, add system:authenticated to the group list.
3. To confirm your entry, click Confirm ( ).
4. Optional: To add an additional group, click Add group and repeat the process.
Provide one or more users with access to the model registry.
1. On the Users tab, in the Users section, click Add user.
2. In the Type username field, enter the username of the user to whom you want to provide access.
3. To confirm your entry, click Confirm ( ).
4. Optional: To add an additional user, click Add user and repeat the process.
Provide all service accounts in a project with access to the model registry.
1. On the Projects tab, in the Projects section, click Add project.
2. In the Select or enter a project field, select or enter the name of the project to which you want to provide access.
3. To confirm your entry, click Confirm ( ).
4. Optional: To add an additional project, click Add project and repeat the process.

Verification

Users, groups, and accounts that were granted access to a model registry can register, view, edit, version, deploy, delete, archive, and restore models in that registry.
The Users and Groups sections on the Permissions tab show the respective users and groups that you granted access to the model registry.
The Projects sections on the Projects tab show the projects that you granted access to the model registry.

After you provide access to a model registry, users with access can store, share, version, deploy, and track models using the model registry feature. For more information, see Working with model registries.

Chapter 5. Deleting a model registry
Copy link

You can delete model registries that you no longer require.

Important

When you delete a model registry, databases connected to the model registry will not be removed. To remove any remaining databases, contact your cluster administrator.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
An available model registry exists in your deployment.

Procedure

From the OpenShift AI dashboard, click Settings → Model resources and operations → Model registry settings.
Click the action menu (⋮) beside the model registry that you want to delete.
Click Delete model registry.
In the Delete model registry? dialog that opens, enter the name of the model registry in the text field to confirm that you intend to delete it.
Click Delete model registry.

Verification

The model registry is no longer displayed on the Model registry settings page.

Legal Notice
Copy link

The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other countries.

Java® is a registered trademark of Oracle and/or its affiliates.

XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.

MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.

Node.js® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.

The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

Managing model registries