fix(mlflow): use kubernetes-namespaced tracking auth

Switch MLFLOW_TRACKING_AUTH from "kubernetes" to
"kubernetes-namespaced" to enable namespace-scoped authentication,
aligning with the X-MLFLOW-WORKSPACE header already sent per namespace.

Signed-off-by: Ignas Baranauskas <ibaranau@redhat.com>

Author: Ygnas

kagenti-operator/internal/controller/mlflow_controller.go

@@ -205,7 +205,7 @@ func (r *MLflowReconciler) resolveTrackingURI(ctx context.Context) string {
 func mlflowEnvVars(trackingURI, experimentID, experimentName string) map[string]string {
 	return map[string]string{
 		"MLFLOW_TRACKING_URI":              trackingURI,
-		"MLFLOW_TRACKING_AUTH":             "kubernetes",
+		"MLFLOW_TRACKING_AUTH":             "kubernetes-namespaced",
 		"MLFLOW_EXPERIMENT_ID":             experimentID,
 		"MLFLOW_EXPERIMENT_NAME":           experimentName,
 		"MLFLOW_TRACKING_SERVER_CERT_PATH": "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt",
@@ -231,7 +231,7 @@ func (r *MLflowReconciler) configureDeployment(ctx context.Context, dep *appsv1.
 		annotations[AnnotationMLflowExperimentID] = experimentID
 		annotations[AnnotationMLflowExperimentName] = experimentName
 		annotations[AnnotationMLflowTrackingURI] = trackingURI
-		annotations[AnnotationMLflowTrackingAuth] = "kubernetes"
+		annotations[AnnotationMLflowTrackingAuth] = "kubernetes-namespaced"
 		latest.Spec.Template.Annotations = annotations
 
 		changed := false

kagenti-operator/internal/controller/mlflow_controller_test.go

@@ -229,15 +229,15 @@ var _ = Describe("MLflow Controller", func() {
 				envMap[e.Name] = e.Value
 			}
 			Expect(envMap["MLFLOW_TRACKING_URI"]).To(Equal(server.URL))
-			Expect(envMap["MLFLOW_TRACKING_AUTH"]).To(Equal("kubernetes"))
+			Expect(envMap["MLFLOW_TRACKING_AUTH"]).To(Equal("kubernetes-namespaced"))
 			Expect(envMap["MLFLOW_EXPERIMENT_ID"]).To(Equal("exp-123"))
 			Expect(envMap["MLFLOW_EXPERIMENT_NAME"]).To(Equal("mlflow-full"))
 			Expect(envMap["MLFLOW_TRACKING_SERVER_CERT_PATH"]).To(Equal("/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"))
 
 			Expect(updated.Spec.Template.Annotations[AnnotationMLflowExperimentID]).To(Equal("exp-123"))
 			Expect(updated.Spec.Template.Annotations[AnnotationMLflowExperimentName]).To(Equal("mlflow-full"))
 			Expect(updated.Spec.Template.Annotations[AnnotationMLflowTrackingURI]).To(Equal(server.URL))
-			Expect(updated.Spec.Template.Annotations[AnnotationMLflowTrackingAuth]).To(Equal("kubernetes"))
+			Expect(updated.Spec.Template.Annotations[AnnotationMLflowTrackingAuth]).To(Equal("kubernetes-namespaced"))
 		})
 
 		It("should use default SA name when none is specified", func() {