Managing model registries

Red Hat OpenShift AI Self-Managed 2.19

Managing model registries in Red Hat OpenShift AI Self-Managed

Legal Notice

Abstract

As an OpenShift AI administrator, you can create, delete, and manage permissions for model registries in OpenShift AI.

Preface
Copy link

As an OpenShift AI administrator, you can create, delete, and manage permissions for model registries in OpenShift AI.

Chapter 1. Overview of model registries
Copy link

Important

Model registry is currently available in Red Hat OpenShift AI 2.19 as a Technology Preview feature. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

A model registry is an important component in the lifecycle of an artificial intelligence/machine learning (AI/ML) model, and a vital part of any machine learning operations (MLOps) platform or ML workflow. A model registry acts as a central repository, holding metadata related to machine learning models from inception to deployment. This metadata ranges from high-level information like the deployment environment and project origins, to intricate details like training hyperparameters, performance metrics, and deployment events. A model registry acts as a bridge between model experimentation and serving, offering a secure, collaborative metadata store interface for stakeholders of the ML lifecycle.

Model registries provide a structured and organized way to store, share, version, deploy, and track models.

To use model registries in OpenShift AI, an OpenShift cluster administrator must configure the model registry component. For more information, see Configuring the model registry component.

After the model registry component is configured, an OpenShift AI administrator can create model registries in OpenShift AI and grant model registry access to the data scientists that will work with them. For more information, see Managing model registries.

Data scientists with access to a model registry can store, share, version, deploy, and track models using the model registry feature. For more information, see Working with model registries.

Chapter 2. Creating a model registry
Copy link

You can create a model registry to store, share, version, deploy, and track your models.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
A cluster administrator has configured and enabled the model registry component in your OpenShift AI deployment. For more information, see Configuring the model registry component.
The model registry component is enabled for your OpenShift AI deployment.
You have access to an external MySQL database which uses at least MySQL version 5.x. However, Red Hat recommends that you use MySQL version 8.x.
Note
The mysql_native_password authentication plugin is required for the ML Metadata component to successfully connect to your database. mysql_native_password is disabled by default in MySQL 8.4 and later. If your database uses MySQL 8.4 or later, you must update your MySQL deployment to enable the mysql_native_password plugin.
For more information about enabling the mysql_native_password plugin, see Native Pluggable Authentication in the MySQL documentation.
By default, the OpenShift MySQL template uses the caching_sha2_password authentication plugin. If you used the OpenShift template for MySQL, you must manually update it to use mysql_native_password for the model registry to connect to your database instance successfully. For more information, see the Model registry fails to connect to MySQL database due to an authentication plugin mismatch Knowledgebase solution.

Procedure

From the OpenShift AI dashboard, click Settings → Model registry settings.
Click Create model registry.
The Create model registry dialog opens.
In the Name field, enter a name for the model registry.
Optional: Click Edit resource name, and then enter a specific resource name for the model registry in the Resource name field. By default, the resource name will match the name of the model registry.
Important
Resource names are what your resources are labeled as in OpenShift. Your resource name cannot exceed 253 characters, must consist of lowercase alphanumeric characters or -, and must start and end with an alphanumeric character. Resource names are not editable after creation.
The resource name must not match the name of any other model registry resource in your OpenShift cluster.
Optional: In the Description field, enter a description for the model registry.
In the Connect to external MySQL database section, enter the information for the external database where your model data is stored.
1. In the Host field, enter the database’s host name.
  1. If the database is running in the rhoai-model-registries namespace, enter only the hostname for the database.
  2. If the database is running in a different namespace from rhoai-model-registries, enter the database hostname details in <host name>.<namespace>.svc.cluster.local format.
2. In the Port field, enter the port number for the database.
3. In the Username field, enter the default user name that is connected to the database.
4. In the Password field, enter the password for the default user account.
5. In the Database field, enter the database name.
Optional: Select the Add CA certificate to secure database connection to use a certificate with your database connection.
1. Click Use cluster-wide CA bundle to use the ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
2. Click Use Red Hat OpenShift AI CA bundle to use the odh-ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
3. Click Choose from existing certificates to select an existing certificate. You can select the key of any ConfigMap or secret in the rhoai-model-registries namespace.
  1. From the Resource list, select a ConfigMap or secret.
  2. From the Key list, select a key.
4. Click Upload new certificate to upload a new certificate as a ConfigMap.
  1. Drag and drop the PEM file for your certificate into the Certificate field, or click Upload to select a file from your local machine’s file system.
    Note
    Uploading a certificate creates the db-credential ConfigMap with the ca.crt key.
    To upload a certificate as a secret, you must create a secret in the OpenShift rhoai-model-registries namespace, and then select it as an existing certificate when you create your model registry.
    For more information about creating secrets in OpenShift, see Providing sensitive data to pods by using secrets.
Click Create.

Note

To find the resource name or type of a model registry, click the help icon beside the registry name. Resource names and types are used to find your resources in OpenShift.

Verification

The new model registry appears on the Model registry settings page.
You can edit the model registry by clicking the action menu (⋮) beside it, and then clicking Edit model registry.
You can register a model with the model registry from the Model registry tab. For more information about working with model registries, see Working with model registries.

Chapter 3. Editing a model registry
Copy link

You can edit the details of existing model registries, such as the model registry name, description, and database connection details.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
A cluster administrator has configured and enabled the model registry component in your OpenShift AI deployment. For more information, see Configuring the model registry component.
The model registry component is enabled for your OpenShift AI deployment, and contains at least 1 model registry.

Procedure

From the OpenShift AI dashboard, click Settings → Model registry settings.
Click the action menu (⋮) beside the model registry that you want to edit, and then click Edit model registry.
The Edit model registry dialog opens.
Optional: In the Name field, edit the name of the model registry.
Optional: In the Description field, edit the description of the model registry.
Optional: In the Connect to external MySQL database section, edit the information for the external database where model data for the registry is stored.
1. In the Host field, enter the database’s host name.
  1. If the database is running in the rhoai-model-registries namespace, enter only the hostname for the database.
  2. If the database is running in a different namespace from rhoai-model-registries, enter the database hostname details in <host name>.<namespace>.svc.cluster.local format.
2. In the Port field, enter the port number for the database.
3. In the Username field, enter the default user name that is connected to the database.
4. In the Password field, enter the password for the default user account.
5. In the Database field, enter the database name.
Optional: Select the Add CA certificate to secure database connection to use a certificate with your database connection.
1. Click Use cluster-wide CA bundle to use the ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
2. Click Use Red Hat OpenShift AI CA bundle to use the odh-ca-bundle.crt bundle in the odh-trusted-ca-bundle ConfigMap.
3. Click Choose from existing certificates to select an existing certificate. You can select the key of any ConfigMap or secret in the rhoai-model-registries namespace.
  1. From the Resource list, select a ConfigMap or secret.
  2. From the Key list, select a key.
4. Click Upload new certificate to upload a new certificate as a ConfigMap.
  1. Drag and drop the PEM file for your certificate into the Certificate field, or click Upload to select a file from your local machine’s file system.
    Note
    Uploading a certificate creates the db-credential ConfigMap with the ca.crt key.
    To upload a certificate as a secret, you must create a secret in the OpenShift rhoai-model-registries namespace, and then select it as an existing certificate when you create your model registry.
    For more information about creating secrets in OpenShift, see Providing sensitive data to pods by using secrets.
Click Update.

Verification

The model registry appears with updated details on the Model registry settings page.

Chapter 4. Managing model registry permissions
Copy link

You can manage access to a model registry for individual users and user groups in your organization, and for service accounts in a project.

OpenShift AI creates the <model-registry-name>-users group automatically for use with model registries. You can add users to this group in OpenShift, or ask the cluster admin to do so.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
An available model registry exists in your deployment.
The users and groups that you want to provide access to already exist in OpenShift. For more information, see Managing users and groups.

Procedure

From the OpenShift AI dashboard, click Settings → Model registry settings.
Click Manage permissions beside the model registry that you want to manage access for.
The permissions page for the model registry opens.
Provide one or more OpenShift groups with access to the project.
1. On the Users tab, in the Groups section, click Add group.
2. From the Select a group drop-down list, select a group.
  Note
  To enable access for all cluster users, add system:authenticated to the group list.
3. To confirm your entry, click Confirm ( ).
4. Optional: To add an additional group, click Add group and repeat the process.
Provide one or more users with access to the model registry.
1. On the Users tab, in the Users section, click Add user.
2. In the Type username field, enter the username of the user to whom you want to provide access.
3. To confirm your entry, click Confirm ( ).
4. Optional: To add an additional user, click Add user and repeat the process.
Provide all service accounts in a project with access to the model registry.
1. On the Projects tab, in the Projects section, click Add project.
2. In the Select or enter a project field, select or enter the name of the project to which you want to provide access.
3. To confirm your entry, click Confirm ( ).
4. Optional: To add an additional project, click Add project and repeat the process.

Verification

Users, groups, and accounts that were granted access to a model registry can register, view, edit, version, deploy, delete, archive, and restore models in that registry.
The Users and Groups sections on the Permissions tab show the respective users and groups that you granted access to the model registry.
The Projects sections on the Projects tab show the projects that you granted access to the model registry.

After you provide access to a model registry, users with access can store, share, version, deploy, and track models using the model registry feature. For more information, see Working with model registries.

Chapter 5. Deleting a model registry
Copy link

You can delete model registries that you no longer require.

Important

When you delete a model registry, databases connected to the model registry will not be removed. To remove any remaining databases, contact your cluster administrator.

Prerequisites

You have logged in to OpenShift AI as a user with OpenShift AI administrator privileges.
An available model registry exists in your deployment.

Procedure

From the OpenShift AI dashboard, click Settings → Model registry settings.
Click the action menu (⋮) beside the model registry that you want to delete.
Click Delete model registry.
In the Delete model registry? dialog that appears, enter the name of the model registry in the text field to confirm that you intend to delete it.
Click Delete model registry.

Verification

The model registry no longer appears on the Model registry settings page.

Legal Notice
Copy link

The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other countries.

Java® is a registered trademark of Oracle and/or its affiliates.

XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.

MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.

Node.js® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.

The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

Managing model registries