[Endpoints] [14/x] Add encryption availability endpoints by BenWilson2 · Pull Request #19176 · mlflow/mlflow

BenWilson2 · 2025-12-02T20:03:17Z

🥞 Stacked PR

Use this link to review incremental changes.

stack/endpoints/passphrase [Files changed]

Related Issues/PRs

#xxx

What changes are proposed in this pull request?

Adds:

Security configuration validation endpoint to ensure that the API Key management UI is capable of being displayed (if passphrase is not set and configured, will display a 'getting started' page to instruct users on how they can enable the capability and disables the gateway functionality within the UI.
Fixes for UI consistency across the pages for uniform display 'feel'
Adjustments to css styling for consistency
Fixes to spacing and consistent design system emotion css usage
Fixes to tooltip displays on list pages

How is this PR tested?

Existing unit/integration tests
New unit/integration tests
Manual tests

Does this PR require documentation update?

Release Notes

Is this a user-facing change?

No. You can skip the rest of this section.
Yes. Give a description of this change to be included in the release notes for MLflow users.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

How should the PR be classified in the release notes? Choose one:

rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
rn/feature - A new user-facing feature worth mentioning in the release notes
rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
rn/documentation - A user-facing documentation change worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes should be selected for bug fixes, documentation updates, and other small changes. No should be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.

What is a minor/patch release?

Minor release: a release that increments the second part of the version number (e.g., 1.2.0 -> 1.3.0).
Bug fixes, doc updates and new features usually go into minor releases.
Patch release: a release that increments the third part of the version number (e.g., 1.2.0 -> 1.2.1).
Bug fixes and doc updates usually go into patch releases.

Yes (this PR will be cherry-picked and included in the next patch release)
No (this PR will be included in the next minor release)

github-actions · 2025-12-02T22:58:31Z

Documentation preview for 6b6dc51 is available at:

https://pr-19176--mlflow-docs-preview.netlify.app/docs/latest/

More info

Ignore this comment if this PR does not change the documentation.
The preview is updated when a new commit is pushed to this PR.
This comment was created by this workflow run.
The documentation was built by this workflow run.

Copilot

Pull request overview

This PR adds encryption availability validation endpoints to enable secure API key management in the MLflow Gateway UI. When the encryption passphrase is not configured, the UI displays a setup guide instead of non-functional API key features. The changes include comprehensive test coverage for the cryptography utilities, entity models, and UI components.

Adds encryption configuration validation endpoint to check if secrets management is properly configured
Implements comprehensive cryptography utilities with envelope encryption using AES-256-GCM and PBKDF2
Adds database models and entities for secrets, model definitions, endpoints, and bindings
Implements UI components and pages for the Gateway feature with proper error handling

Reviewed changes

Copilot reviewed 108 out of 119 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`tests/entities/test_gateway_endpoint.py`	Comprehensive tests for Gateway entity models including proto round-trip conversions
`tests/cli/test_cryptography.py`	Tests for KEK rotation CLI command with various scenarios and edge cases
`requirements/genai-requirements.yaml`	Adds litellm dependency configuration for Gateway features
`pyproject.toml`	Adds litellm<2,>=1.0.0 to genai extras
`pyproject.release.toml`	Mirrors litellm dependency addition for release configuration
`mlflow/utils/providers.py`	Provider configuration utilities using litellm for credential and capability management
`mlflow/utils/cryptography.py`	Core cryptography implementation with envelope encryption and key rotation
`mlflow/store/tracking/sqlalchemy_store.py`	Store implementations for secrets, model definitions, endpoints, and bindings
`mlflow/store/tracking/rest_store.py`	REST API client methods for Gateway features
`mlflow/store/tracking/dbmodels/models.py`	SQLAlchemy model conversions to MLflow entities
`mlflow/store/tracking/abstract_store.py`	Abstract store method signatures for Gateway features
`mlflow/store/tracking/_secret_cache.py`	Encrypted in-memory cache for decrypted secrets with forward secrecy
`mlflow/server/js/src/lang/default/en.json`	Internationalization strings for Gateway UI
`mlflow/server/js/src/gateway/utils/providerUtils.ts`	Provider grouping and formatting utilities
`mlflow/server/js/src/gateway/utils/dateUtils.ts`	Timestamp conversion utilities with unit detection
`mlflow/server/js/src/gateway/utils/dateUtils.test.ts`	Tests for timestamp conversion edge cases
`mlflow/server/js/src/gateway/types.ts`	TypeScript type definitions for Gateway API
`mlflow/server/js/src/gateway/routes.ts`	Route path definitions for Gateway pages
`mlflow/server/js/src/gateway/route-defs.ts`	Route configuration with lazy loading
`mlflow/server/js/src/gateway/pages/ModelDefinitionsPage.tsx`	Models list page with CRUD operations
`mlflow/server/js/src/gateway/pages/ModelDefinitionsPage.test.tsx`	Tests for models list page rendering
`mlflow/server/js/src/gateway/pages/ModelDefinitionDetailsPage.tsx`	Model details page with configuration display
`mlflow/server/js/src/gateway/pages/GatewayPage.tsx`	Endpoints list page
`mlflow/server/js/src/gateway/pages/GatewayLayout.tsx`	Layout with backend validation and setup guide
`mlflow/server/js/src/gateway/hooks/useUpdateSecretMutation.ts`	React hook for updating secrets
`mlflow/server/js/src/gateway/hooks/useUpdateModelDefinitionMutation.tsx`	React hook for updating model definitions
`mlflow/server/js/src/gateway/hooks/useSecretsQuery.ts`	React hook for fetching secrets list
`mlflow/server/js/src/gateway/hooks/useSecretsConfigQuery.ts`	React hook for checking secrets configuration
`mlflow/server/js/src/gateway/hooks/useSecretQuery.ts`	React hook for fetching single secret
`mlflow/server/js/src/gateway/hooks/useProvidersQuery.ts`	React hook for fetching provider list
`mlflow/server/js/src/gateway/hooks/useProviderConfigQuery.ts`	React hook for fetching provider configuration

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

daniellok-db · 2025-12-15T05:54:19Z

mlflow/server/js/src/common/components/long-form/LongFormLayout.tsx

+            position: 'sticky',
+            top: 0,
+            alignSelf: 'flex-start',
+            [`@media (max-width: ${sidebarHideBreakpoint}px)`]: {


this should align with the breakpoints defined in LongFormSection / LongFormSummary and the create/edit pages

daniellok-db · 2025-12-15T05:55:04Z

mlflow/server/js/src/common/components/long-form/LongFormLayout.tsx

+ * A layout component for long forms with an optional summary sidebar.
+ * The sidebar is flexible and hides on narrow screens to avoid clipping the form.
+ */
+export function LongFormLayout({


where is this used? i don't see any references in code

daniellok-db · 2025-12-15T05:55:27Z

mlflow/server/js/src/gateway/components/endpoints/EndpointSummary.tsx

+ * Displays provider, model (with capabilities and connection/API key info).
+ * Connection is nested under Model since each model can have its own API key mapping.
+ */
+export const EndpointSummary = ({


is this used anywhere?

daniellok-db · 2025-12-15T05:56:20Z

mlflow/server/js/src/gateway/hooks/useDeleteSecretMutation.ts

@@ -1,4 +1,4 @@
-import { useMutation, useQueryClient } from '@mlflow/mlflow/src/common/utils/reactQueryHooks';


was it necessary to revert the changes here? i think the @mlflow/mlflow import pattern is better as it stays consistent even as we move files around.

daniellok-db

stamping to unblock

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

B-Step62

@BenWilson2 Let's split the PR. This includes so many changes across different domains.

BenWilson2 changed the title ~~Add security configuration availability endpoints~~ [Endpoints] [15/x] Add encryption availability endpoints Dec 2, 2025

BenWilson2 marked this pull request as ready for review December 2, 2025 20:10

github-actions bot added area/uiux Front-end, user experience, plotting, JavaScript, JavaScript dev server rn/feature Mention under Features in Changelogs. labels Dec 2, 2025

BenWilson2 force-pushed the stack/endpoints/passphrase branch 2 times, most recently from 0fa11df to 8f7ba58 Compare December 2, 2025 22:49

BenWilson2 force-pushed the stack/endpoints/passphrase branch 4 times, most recently from 5195e71 to 0f7cdfd Compare December 4, 2025 00:27

Copilot AI review requested due to automatic review settings December 4, 2025 01:54

BenWilson2 force-pushed the stack/endpoints/passphrase branch from 0f7cdfd to f609398 Compare December 4, 2025 01:54

Copilot AI reviewed Dec 4, 2025

View reviewed changes

BenWilson2 force-pushed the stack/endpoints/passphrase branch 2 times, most recently from 3178cff to 686c531 Compare December 4, 2025 23:40

BenWilson2 added 13 commits December 11, 2025 17:42

endpoint pages

b85afbc

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add left hand nav tabs

0c95157

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add Key management pages

7aa12ff

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

endpoint pages

5094fad

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add left hand nav tabs

159e850

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

endpoint pages

1249473

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add left hand nav tabs

cdd4178

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

endpoint pages

d5c7e06

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

endpoint pages

838fbf2

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add left hand nav tabs

f2e8174

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add Key management pages

8ec216a

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

endpoint pages

28d605f

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Add Key management pages

5ddcc46

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

BenWilson2 force-pushed the stack/endpoints/passphrase branch from f9a7399 to 8ece09e Compare December 11, 2025 22:43

Add security configuration availability endpoints

08d4627

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

BenWilson2 force-pushed the stack/endpoints/passphrase branch from 8ece09e to 08d4627 Compare December 12, 2025 19:36

daniellok-db reviewed Dec 15, 2025

View reviewed changes

daniellok-db approved these changes Dec 15, 2025

View reviewed changes

github-actions bot assigned daniellok-db Dec 15, 2025

BenWilson2 added 4 commits December 15, 2025 22:20

Apply fixes and refactor for maintainability

6948975

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

improve secret field

fc2c235

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

Merge branch 'master' into stack/endpoints/passphrase

705f9ea

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

fixes

6b6dc51

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>

B-Step62 requested changes Dec 16, 2025

View reviewed changes

github-actions bot assigned B-Step62 Dec 16, 2025

BenWilson2 closed this Dec 29, 2025

BenWilson2 deleted the stack/endpoints/passphrase branch December 29, 2025 16:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Endpoints] [14/x] Add encryption availability endpoints#19176

[Endpoints] [14/x] Add encryption availability endpoints#19176
BenWilson2 wants to merge 19 commits intomlflow:masterfrom
BenWilson2:stack/endpoints/passphrase

BenWilson2 commented Dec 2, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

daniellok-db Dec 15, 2025

Uh oh!

daniellok-db Dec 15, 2025

Uh oh!

daniellok-db Dec 15, 2025

Uh oh!

daniellok-db Dec 15, 2025

Uh oh!

daniellok-db left a comment

Uh oh!

B-Step62 left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -1,4 +1,4 @@
		import { useMutation, useQueryClient } from '@mlflow/mlflow/src/common/utils/reactQueryHooks';

Conversation

BenWilson2 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🥞 Stacked PR

Related Issues/PRs

What changes are proposed in this pull request?

How is this PR tested?

Does this PR require documentation update?

Release Notes

Is this a user-facing change?

What component(s), interfaces, languages, and integrations does this PR affect?

How should the PR be classified in the release notes? Choose one:

Should this PR be included in the next patch release?

Uh oh!

github-actions bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

daniellok-db Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

daniellok-db Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

daniellok-db Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

daniellok-db Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

daniellok-db left a comment

Choose a reason for hiding this comment

Uh oh!

B-Step62 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

BenWilson2 commented Dec 2, 2025 •

edited

Loading

github-actions bot commented Dec 2, 2025 •

edited

Loading

B-Step62 left a comment •

edited

Loading