Pulumi MLflow Provider

Manage MLflow experiments, model registry and access control as code.

A native Pulumi provider for MLflow. It manages the declarative parts of an MLflow estate — experiments, the model registry (registered models, versions, aliases) and access control (users and permissions) — through the MLflow REST API, so they can be reviewed and rolled out like the rest of your infrastructure.

• 🧪 Experiments — declare experiments, artifact locations and tags.
• 📦 Model Registry — registered models, immutable model versions, and mutable deployment aliases.
• 🔐 Access control — users and per-experiment / per-model permissions (with the mlflow.server.auth app).
• 🔁 MLflow 2.x and 3.x — one code path; the provider detects the server version at runtime.
• 🌐 Multi-language — TypeScript/JavaScript, Python, and Go (.NET and Java planned).

Status — v0.1.0. First release covering the stable tracking + registry + auth surface. The API may still change on minor releases while it stabilizes. MLflow 3.x-only modules (LoggedModel, Prompt, AI Gateway, Webhooks) are on the roadmap.

Contents

• Installation
• Configuration
• Quick start
• Resources & functions
• MLflow version support
• Development
• Testing
• Publishing
• Roadmap
• License

Installation

# TypeScript / JavaScript
npm install @baubap/mlflow

# Python
pip install baubap-mlflow

# Go
go get github.com/Baubap/pulumi-mlflow/sdk/go/mlflow

The plugin binary is resolved from GitHub Releases via pluginDownloadURL github://api.github.com/Baubap/pulumi-mlflow, so pulumi plugin install and SDK auto-install work out of the box.

Configuration

pulumi config set mlflow:trackingUri https://mlflow.internal.example.com
pulumi config set mlflow:token <token> --secret

Quick start

import * as mlflow from "@baubap/mlflow";

const experiment = new mlflow.Experiment("demo", {
    name: "fraud-detection",
    tags: { team: "foundations" },
});

const model = new mlflow.registry.RegisteredModel("fraud", {
    name: "fraud-detector",
    description: "Gradient-boosted fraud model",
});

const v1 = new mlflow.registry.ModelVersion("fraud-v1", {
    name: model.name,
    source: "s3://models/fraud/1",
});

// Point deployments at a mutable alias instead of a deprecated stage.
new mlflow.registry.RegisteredModelAlias("champion", {
    modelName: model.name,
    alias: "champion",
    version: v1.version,
});

import baubap_mlflow as mlflow

experiment = mlflow.Experiment("demo", name="fraud-detection", tags={"team": "foundations"})
model = mlflow.registry.RegisteredModel("fraud", name="fraud-detector",
                                        description="Gradient-boosted fraud model")
v1 = mlflow.registry.ModelVersion("fraud-v1", name=model.name, source="s3://models/fraud/1")
mlflow.registry.RegisteredModelAlias("champion", model_name=model.name, alias="champion", version=v1.version)

Resources & functions

¹ The auth resources require the tracking server to run with the mlflow.server.auth app enabled.

Every resource supports pulumi import. See the per-resource Import sections in the registry docs once published.

MLflow version support

The declarative REST surface is identical across MLflow 2.x and 3.x, so the same program works against either. The provider version is independent of the MLflow version — MLflow compatibility is documented and handled at runtime (via GET /version), not encoded in the provider's semver. Model-version stages are deprecated in MLflow 3; use RegisteredModelAlias instead.

Development

See CONTRIBUTING.md for the full development workflow, project layout, conventions, and how to add resources, functions, and docs.

make provider          # build the plugin binary into ./bin
make generate_schema   # regenerate provider/cmd/pulumi-resource-mlflow/schema.json
make generate_nodejs generate_python generate_go   # generate the SDKs into ./sdk

Testing

make test_provider     # hermetic unit tests (no server needed)

# End-to-end against a real MLflow server (Docker):
make mlflow-up && make test_e2e && make mlflow-down

# Sweep the e2e suite across MLflow versions:
make test_matrix MLFLOW_TAGS="v2.16.2 v3.1.0"

The e2e suite (provider/e2e, build tag e2e) drives the full resource lifecycle through the provider's in-process server against real MLflow 2.x/3.x servers — see integration.yml. It is parametrizable over multiple servers via MLFLOW_TRACKING_URIS.

Publishing

Tagging vX.Y.Z triggers release.yml: GoReleaser builds the multi-arch plugin and creates the GitHub Release, then the SDKs are published to npm and PyPI (Go via a module tag). Listing on the public Pulumi Registry is a one-time PR to pulumi/registry — see docs/registry-submission.md.

Roadmap

• v0.2.0+ — MLflow 3.x-only modules behind version gating: Webhook, LoggedModel/Scorer/EvaluationDataset, Prompt/PromptAlias, and the AI Gateway (endpoints, model definitions, secrets, budgets, guardrails).
• Additional language SDKs: .NET and Java.

License

Apache-2.0.