Skip to content

Allow for model registration to use KMS auth from different workspace#20156

Merged
BenWilson2 merged 3 commits intomlflow:masterfrom
BenWilson2:registry-uc-fix
Jan 22, 2026
Merged

Allow for model registration to use KMS auth from different workspace#20156
BenWilson2 merged 3 commits intomlflow:masterfrom
BenWilson2:registry-uc-fix

Conversation

@BenWilson2
Copy link
Member

@BenWilson2 BenWilson2 commented Jan 20, 2026

Related Issues/PRs

#xxx

What changes are proposed in this pull request?

In MLflow 2.14.3, a function was added (_parse_aws_sse_credential) that extracted the KMS key for acquiring write credentials for registration to UC. Prior to this release, the KMS authentication relied on the default account that was being used, meaning that the bucket defaults would be used, allowing for cross-account encryption capabilities.
To restore the original behavior, this PR pulls the full ARN for authentication instead of parsing out the key / value pair, which breaks the multi-tenant workflow.

How is this PR tested?

  • Existing unit/integration tests
  • New unit/integration tests
  • Manual tests

Does this PR require documentation update?

  • No. You can skip the rest of this section.
  • Yes. I've updated:
    • Examples
    • API references
    • Instructions

Release Notes

Is this a user-facing change?

  • No. You can skip the rest of this section.
  • Yes. Give a description of this change to be included in the release notes for MLflow users.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

  • area/tracking: Tracking Service, tracking client APIs, autologging
  • area/models: MLmodel format, model serialization/deserialization, flavors
  • area/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registry
  • area/scoring: MLflow Model server, model deployment tools, Spark UDFs
  • area/evaluation: MLflow model evaluation features, evaluation metrics, and evaluation workflows
  • area/gateway: MLflow AI Gateway client APIs, server, and third-party integrations
  • area/prompts: MLflow prompt engineering features, prompt templates, and prompt management
  • area/tracing: MLflow Tracing features, tracing APIs, and LLM tracing functionality
  • area/projects: MLproject format, project running backends
  • area/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev server
  • area/build: Build and test infrastructure for MLflow
  • area/docs: MLflow documentation pages

How should the PR be classified in the release notes? Choose one:

  • rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
  • rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
  • rn/feature - A new user-facing feature worth mentioning in the release notes
  • rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
  • rn/documentation - A user-facing documentation change worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes should be selected for bug fixes, documentation updates, and other small changes. No should be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.

What is a minor/patch release?
  • Minor release: a release that increments the second part of the version number (e.g., 1.2.0 -> 1.3.0).
    Bug fixes, doc updates and new features usually go into minor releases.
  • Patch release: a release that increments the third part of the version number (e.g., 1.2.0 -> 1.2.1).
    Bug fixes and doc updates usually go into patch releases.
  • Yes (this PR will be cherry-picked and included in the next patch release)
  • No (this PR will be included in the next minor release)

@BenWilson2
Preserve full ARN
d47b4f1 
Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
Copilot AI review requested due to automatic review settings January 20, 2026 18:28
@github-actions
Copy link
Contributor

github-actions bot commented Jan 20, 2026

🛠 DevTools 🛠

Install mlflow from this PR

# mlflow
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/20156/merge
# mlflow-skinny
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/20156/merge#subdirectory=libs/skinny

For Databricks, use the following command:

%sh curl -LsSf https://raw.githubusercontent.com/mlflow/mlflow/HEAD/dev/install-skinny.sh | sh -s pull/20156/merge

@github-actions github-actions bot added area/model-registry Model registry, model registry APIs, and the fluent client calls for model registry rn/bug-fix Mention under Bug Fixes in Changelogs. v3.9.0 labels Jan 20, 2026
@BenWilson2 BenWilson2 added the team-review Trigger a team review request label Jan 20, 2026
@github-actions github-actions bot requested review from TomeHirata and harupy January 20, 2026 18:29
Copilot AI reviewed Jan 20, 2026
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a regression introduced in MLflow 2.14.3 where KMS key authentication for Unity Catalog model registration was broken for cross-account encryption scenarios. The fix restores the original behavior by using the full KMS key ARN instead of parsing out just the key ID.

Changes:

  • Modified _parse_aws_sse_credential to pass the full KMS ARN to AWS S3's SSEKMSKeyId parameter instead of extracting only the key ID
  • Updated test expectations to reflect that the full ARN is now used

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
mlflow/utils/_unity_catalog_utils.py Removed the key ID parsing logic and now passes the full aws_kms_key_arn directly to the SSEKMSKeyId parameter
tests/utils/test_unity_catalog_utils.py Updated test data to use a realistic full KMS ARN format and verify the expected output includes the full ARN

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@github-actions
Copy link
Contributor

github-actions bot commented Jan 20, 2026 •
edited
Loading

Documentation preview for fc71a05 is available at:

More info
  • Ignore this comment if this PR does not change the documentation.
  • The preview is updated when a new commit is pushed to this PR.
  • This comment was created by this workflow run.
  • The documentation was built by this workflow run.

TomeHirata
TomeHirata approved these changes Jan 21, 2026
View reviewed changes
Copy link
Collaborator

@TomeHirata TomeHirata left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

BenWilson2 and others added 2 commits January 21, 2026 19:20
@BenWilson2
fix
10b4515 
Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
@BenWilson2
Merge branch 'master' into registry-uc-fix
fc71a05
@BenWilson2
Copy link
Member Author

BenWilson2 commented Jan 22, 2026

Test failure https://github.com/mlflow/mlflow/actions/runs/21230883374/job/61088897239?pr=20156 is present in master and is unrelated (sqlalchemy issue with latest released version on PyPI)

@BenWilson2 BenWilson2 merged commit a8d80a0 into mlflow:master Jan 22, 2026
44 of 46 checks passed
@BenWilson2 BenWilson2 deleted the registry-uc-fix branch January 22, 2026 00:57
harupy pushed a commit to harupy/mlflow that referenced this pull request Jan 28, 2026
@BenWilson2 @harupy
Allow for model registration to use KMS auth from different workspace (…
1545e1f 
…mlflow#20156)

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
harupy pushed a commit to harupy/mlflow that referenced this pull request Jan 28, 2026
@BenWilson2 @harupy
Allow for model registration to use KMS auth from different workspace (…
9d54f42 
…mlflow#20156)

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
harupy pushed a commit that referenced this pull request Jan 28, 2026
@BenWilson2 @harupy
Allow for model registration to use KMS auth from different workspace (…
7e5523b 
…#20156)

Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@harupy harupy harupy approved these changes

@TomeHirata TomeHirata TomeHirata approved these changes

Assignees

@harupy harupy

@TomeHirata TomeHirata

Labels

area/model-registry Model registry, model registry APIs, and the fluent client calls for model registry rn/bug-fix Mention under Bug Fixes in Changelogs. team-review Trigger a team review request v3.9.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@BenWilson2 @harupy @TomeHirata