Fix PVC provisioning and allow non-root volume permissions

[borishim]

Summary

• Added templates/pvc.yaml so a PersistentVolumeClaim is actually rendered whenever persistence.enabled is true, matching the Deployment’s mlflow-storage volume reference.
• Fixed envFrom indentation in the Deployment override so shared secrets/configs no longer “break” the template merge; the persistence-specific security context, init container, and volume mount now render reliably.
• Introduced persistence.volumePermissions configuration (enabled/runAsUser) and wired it into the Deployment so clusters with strict PodSecurity policies can disable the init container or run it as a non-root UID.

Testing

• Ran helm template to confirm PVC creation, init-container toggling, and clean rendering both with and without shared secrets.

[borishim]

Hi @kharkevich , can you take a look at this when you got some spare time? Thanks!

[Copilot]

Pull request overview

This PR fixes PersistentVolumeClaim provisioning and adds configuration options for volume permission handling in strict PodSecurity environments. The changes ensure that a PVC is actually created when persistence is enabled, fix template indentation issues that broke rendering with shared secrets/configs, and provide flexibility to disable or customize the init container that sets volume permissions.

Key changes:

• Added PVC template that renders when persistence is enabled
• Fixed envFrom indentation (from 2 to 12 spaces) to properly merge shared secrets and configs
• Introduced configurable volumePermissions with enabled flag and runAsUser option

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
charts/mlflow-tracking-server/Chart.yaml	Version bump to 1.1.3 for this patch release
charts/mlflow-tracking-server/values.yaml	Added volumePermissions configuration with enabled and runAsUser options
charts/mlflow-tracking-server/templates/pvc.yaml	New template to create PVC using common helper when persistence is enabled
charts/mlflow-tracking-server/templates/deployment.yaml	Added conditional logic for volumePermissions, fixed envFrom indentation, and made init container conditional and configurable

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.