dstack 0.19.25rc1__py3-none-any.whl → 0.19.27__py3-none-any.whl

dstack/_internal/core/backends/nebius/compute.py

@@ -59,13 +59,6 @@ DOCKER_DAEMON_CONFIG = {
     "exec-opts": ["native.cgroupdriver=cgroupfs"],
 }
 SETUP_COMMANDS = [
-    "ufw allow ssh",
-    "ufw allow from 10.0.0.0/8",
-    "ufw allow from 172.16.0.0/12",
-    "ufw allow from 192.168.0.0/16",
-    "ufw default deny incoming",
-    "ufw default allow outgoing",
-    "ufw enable",
     'sed -i "s/.*AllowTcpForwarding.*/AllowTcpForwarding yes/g" /etc/ssh/sshd_config',
     "service ssh restart",
     f"echo {shlex.quote(json.dumps(DOCKER_DAEMON_CONFIG))} > /etc/docker/daemon.json",
@@ -364,7 +357,7 @@ def _wait_for_instance(sdk: SDK, op: SDKOperation[Operation]) -> None:
         )
         time.sleep(WAIT_FOR_INSTANCE_UPDATE_INTERVAL)
         resources.LOOP.await_(
-            op.update(timeout=resources.REQUEST_TIMEOUT, metadata=resources.REQUEST_MD)
+            op.update(per_retry_timeout=resources.REQUEST_TIMEOUT, metadata=resources.REQUEST_MD)
         )
 
 

dstack/_internal/core/backends/nebius/configurator.py

@@ -11,7 +11,6 @@ from dstack._internal.core.backends.nebius import resources
 from dstack._internal.core.backends.nebius.backend import NebiusBackend
 from dstack._internal.core.backends.nebius.fabrics import get_all_infiniband_fabrics
 from dstack._internal.core.backends.nebius.models import (
-    AnyNebiusBackendConfig,
     NebiusBackendConfig,
     NebiusBackendConfigWithCreds,
     NebiusConfig,
@@ -22,7 +21,12 @@ from dstack._internal.core.backends.nebius.models import (
 from dstack._internal.core.models.backends.base import BackendType
 
 
-class NebiusConfigurator(Configurator):
+class NebiusConfigurator(
+    Configurator[
+        NebiusBackendConfig,
+        NebiusBackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.NEBIUS
     BACKEND_CLASS = NebiusBackend
 
@@ -60,12 +64,12 @@ class NebiusConfigurator(Configurator):
             auth=NebiusCreds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(
-        self, record: BackendRecord, include_creds: bool
-    ) -> AnyNebiusBackendConfig:
+    def get_backend_config_with_creds(self, record: BackendRecord) -> NebiusBackendConfigWithCreds:
+        config = self._get_config(record)
+        return NebiusBackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> NebiusBackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return NebiusBackendConfigWithCreds.__response__.parse_obj(config)
         return NebiusBackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> NebiusBackend:

dstack/_internal/core/backends/nebius/resources.py

@@ -119,7 +119,7 @@ def wait_for_operation(
         if time.monotonic() + interval > deadline:
             raise TimeoutError(f"Operation {op.id} wait timeout")
         time.sleep(interval)
-        LOOP.await_(op.update(timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD))
+        LOOP.await_(op.update(per_retry_timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD))
 
 
 def get_region_to_project_id_map(
@@ -155,7 +155,7 @@ def validate_regions(configured: set[str], available: set[str]) -> None:
 def list_tenant_projects(sdk: SDK) -> Sequence[Container]:
     tenants = LOOP.await_(
         TenantServiceClient(sdk).list(
-            ListTenantsRequest(), timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
+            ListTenantsRequest(), per_retry_timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
         )
     )
     if len(tenants.items) != 1:
@@ -164,7 +164,7 @@ def list_tenant_projects(sdk: SDK) -> Sequence[Container]:
     projects = LOOP.await_(
         ProjectServiceClient(sdk).list(
             ListProjectsRequest(parent_id=tenant_id, page_size=999),
-            timeout=REQUEST_TIMEOUT,
+            per_retry_timeout=REQUEST_TIMEOUT,
             metadata=REQUEST_MD,
         )
     )
@@ -238,7 +238,7 @@ def get_default_subnet(sdk: SDK, project_id: str) -> Subnet:
     subnets = LOOP.await_(
         SubnetServiceClient(sdk).list(
             ListSubnetsRequest(parent_id=project_id, page_size=999),
-            timeout=REQUEST_TIMEOUT,
+            per_retry_timeout=REQUEST_TIMEOUT,
             metadata=REQUEST_MD,
         )
     )
@@ -264,13 +264,15 @@ def create_disk(
         ),
     )
     with wrap_capacity_errors():
-        return LOOP.await_(client.create(request, timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD))
+        return LOOP.await_(
+            client.create(request, per_retry_timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD)
+        )
 
 
 def delete_disk(sdk: SDK, disk_id: str) -> None:
     LOOP.await_(
         DiskServiceClient(sdk).delete(
-            DeleteDiskRequest(id=disk_id), timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
+            DeleteDiskRequest(id=disk_id), per_retry_timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
         )
     )
 
@@ -318,13 +320,17 @@ def create_instance(
         ),
     )
     with wrap_capacity_errors():
-        return LOOP.await_(client.create(request, timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD))
+        return LOOP.await_(
+            client.create(request, per_retry_timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD)
+        )
 
 
 def get_instance(sdk: SDK, instance_id: str) -> Instance:
     return LOOP.await_(
         InstanceServiceClient(sdk).get(
-            GetInstanceRequest(id=instance_id), timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
+            GetInstanceRequest(id=instance_id),
+            per_retry_timeout=REQUEST_TIMEOUT,
+            metadata=REQUEST_MD,
         )
     )
 
@@ -332,7 +338,9 @@ def get_instance(sdk: SDK, instance_id: str) -> Instance:
 def delete_instance(sdk: SDK, instance_id: str) -> SDKOperation[Operation]:
     return LOOP.await_(
         InstanceServiceClient(sdk).delete(
-            DeleteInstanceRequest(id=instance_id), timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
+            DeleteInstanceRequest(id=instance_id),
+            per_retry_timeout=REQUEST_TIMEOUT,
+            metadata=REQUEST_MD,
         )
     )
 
@@ -345,7 +353,7 @@ def create_cluster(sdk: SDK, name: str, project_id: str, fabric: str) -> SDKOper
                     metadata=ResourceMetadata(name=name, parent_id=project_id),
                     spec=GpuClusterSpec(infiniband_fabric=fabric),
                 ),
-                timeout=REQUEST_TIMEOUT,
+                per_retry_timeout=REQUEST_TIMEOUT,
                 metadata=REQUEST_MD,
             )
         )
@@ -354,6 +362,8 @@ def create_cluster(sdk: SDK, name: str, project_id: str, fabric: str) -> SDKOper
 def delete_cluster(sdk: SDK, cluster_id: str) -> None:
     return LOOP.await_(
         GpuClusterServiceClient(sdk).delete(
-            DeleteGpuClusterRequest(id=cluster_id), timeout=REQUEST_TIMEOUT, metadata=REQUEST_MD
+            DeleteGpuClusterRequest(id=cluster_id),
+            per_retry_timeout=REQUEST_TIMEOUT,
+            metadata=REQUEST_MD,
         )
     )

dstack/_internal/core/backends/oci/compute.py

@@ -135,11 +135,10 @@ class OCICompute(
             security_group.id, region.virtual_network_client
         )
 
-        setup_commands = [
-            f"sudo iptables -I INPUT -s {resources.VCN_CIDR} -j ACCEPT",
-            "sudo netfilter-persistent save",
-        ]
-        cloud_init_user_data = get_user_data(instance_config.get_public_keys(), setup_commands)
+        cloud_init_user_data = get_user_data(
+            authorized_keys=instance_config.get_public_keys(),
+            firewall_allow_from_subnets=[resources.VCN_CIDR],
+        )
 
         display_name = generate_unique_instance_name(instance_config)
         try:

dstack/_internal/core/backends/oci/configurator.py

@@ -10,7 +10,6 @@ from dstack._internal.core.backends.oci import resources
 from dstack._internal.core.backends.oci.backend import OCIBackend
 from dstack._internal.core.backends.oci.exceptions import any_oci_exception
 from dstack._internal.core.backends.oci.models import (
-    AnyOCIBackendConfig,
     OCIBackendConfig,
     OCIBackendConfigWithCreds,
     OCIConfig,
@@ -42,7 +41,12 @@ SUPPORTED_REGIONS = frozenset(
 )
 
 
-class OCIConfigurator(Configurator):
+class OCIConfigurator(
+    Configurator[
+        OCIBackendConfig,
+        OCIBackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.OCI
     BACKEND_CLASS = OCIBackend
 
@@ -83,12 +87,12 @@ class OCIConfigurator(Configurator):
             auth=OCICreds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(
-        self, record: BackendRecord, include_creds: bool
-    ) -> AnyOCIBackendConfig:
+    def get_backend_config_with_creds(self, record: BackendRecord) -> OCIBackendConfigWithCreds:
+        config = self._get_config(record)
+        return OCIBackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> OCIBackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return OCIBackendConfigWithCreds.__response__.parse_obj(config)
         return OCIBackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> OCIBackend:

dstack/_internal/core/backends/runpod/configurator.py

@@ -8,7 +8,6 @@ from dstack._internal.core.backends.base.configurator import (
 from dstack._internal.core.backends.runpod import api_client
 from dstack._internal.core.backends.runpod.backend import RunpodBackend
 from dstack._internal.core.backends.runpod.models import (
-    AnyRunpodBackendConfig,
     RunpodBackendConfig,
     RunpodBackendConfigWithCreds,
     RunpodConfig,
@@ -18,7 +17,12 @@ from dstack._internal.core.backends.runpod.models import (
 from dstack._internal.core.models.backends.base import BackendType
 
 
-class RunpodConfigurator(Configurator):
+class RunpodConfigurator(
+    Configurator[
+        RunpodBackendConfig,
+        RunpodBackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.RUNPOD
     BACKEND_CLASS = RunpodBackend
 
@@ -35,12 +39,12 @@ class RunpodConfigurator(Configurator):
             auth=RunpodCreds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(
-        self, record: BackendRecord, include_creds: bool
-    ) -> AnyRunpodBackendConfig:
+    def get_backend_config_with_creds(self, record: BackendRecord) -> RunpodBackendConfigWithCreds:
+        config = self._get_config(record)
+        return RunpodBackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> RunpodBackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return RunpodBackendConfigWithCreds.__response__.parse_obj(config)
         return RunpodBackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> RunpodBackend:

dstack/_internal/core/backends/template/configurator.py.jinja

@@ -7,7 +7,6 @@ from dstack._internal.core.backends.base.configurator import (
 )
 from dstack._internal.core.backends.{{ backend_name|lower }}.backend import {{ backend_name }}Backend
 from dstack._internal.core.backends.{{ backend_name|lower }}.models import (
-    Any{{ backend_name }}BackendConfig,
     Any{{ backend_name }}Creds,
     {{ backend_name }}BackendConfig,
     {{ backend_name }}BackendConfigWithCreds,
@@ -20,7 +19,12 @@ from dstack._internal.core.models.backends.base import (
 )
 
 
-class {{ backend_name }}Configurator(Configurator):
+class {{ backend_name }}Configurator(
+    Configurator[
+        {{ backend_name }}BackendConfig,
+        {{ backend_name }}BackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.{{ backend_name|upper }}
     BACKEND_CLASS = {{ backend_name }}Backend
 
@@ -40,12 +44,12 @@ class {{ backend_name }}Configurator(Configurator):
             auth={{ backend_name }}Creds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(
-        self, record: BackendRecord, include_creds: bool
-    ) -> Any{{ backend_name }}BackendConfig:
+    def get_backend_config_with_creds(self, record: BackendRecord) -> {{ backend_name }}BackendConfigWithCreds:
+        config = self._get_config(record)
+        return {{ backend_name }}BackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> {{ backend_name }}BackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return {{ backend_name }}BackendConfigWithCreds.__response__.parse_obj(config)
         return {{ backend_name }}BackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> {{ backend_name }}Backend:

dstack/_internal/core/backends/tensordock/configurator.py

@@ -8,7 +8,6 @@ from dstack._internal.core.backends.base.configurator import (
 from dstack._internal.core.backends.tensordock import api_client
 from dstack._internal.core.backends.tensordock.backend import TensorDockBackend
 from dstack._internal.core.backends.tensordock.models import (
-    AnyTensorDockBackendConfig,
     TensorDockBackendConfig,
     TensorDockBackendConfigWithCreds,
     TensorDockConfig,
@@ -23,7 +22,12 @@ from dstack._internal.core.models.backends.base import (
 REGIONS = []
 
 
-class TensorDockConfigurator(Configurator):
+class TensorDockConfigurator(
+    Configurator[
+        TensorDockBackendConfig,
+        TensorDockBackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.TENSORDOCK
     BACKEND_CLASS = TensorDockBackend
 
@@ -44,12 +48,14 @@ class TensorDockConfigurator(Configurator):
             auth=TensorDockCreds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(
-        self, record: BackendRecord, include_creds: bool
-    ) -> AnyTensorDockBackendConfig:
+    def get_backend_config_with_creds(
+        self, record: BackendRecord
+    ) -> TensorDockBackendConfigWithCreds:
+        config = self._get_config(record)
+        return TensorDockBackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> TensorDockBackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return TensorDockBackendConfigWithCreds.__response__.parse_obj(config)
         return TensorDockBackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> TensorDockBackend:

dstack/_internal/core/backends/vastai/configurator.py

@@ -8,7 +8,6 @@ from dstack._internal.core.backends.base.configurator import (
 from dstack._internal.core.backends.vastai import api_client
 from dstack._internal.core.backends.vastai.backend import VastAIBackend
 from dstack._internal.core.backends.vastai.models import (
-    AnyVastAIBackendConfig,
     VastAIBackendConfig,
     VastAIBackendConfigWithCreds,
     VastAIConfig,
@@ -23,7 +22,12 @@ from dstack._internal.core.models.backends.base import (
 REGIONS = []
 
 
-class VastAIConfigurator(Configurator):
+class VastAIConfigurator(
+    Configurator[
+        VastAIBackendConfig,
+        VastAIBackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.VASTAI
     BACKEND_CLASS = VastAIBackend
 
@@ -42,12 +46,12 @@ class VastAIConfigurator(Configurator):
             auth=VastAICreds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(
-        self, record: BackendRecord, include_creds: bool
-    ) -> AnyVastAIBackendConfig:
+    def get_backend_config_with_creds(self, record: BackendRecord) -> VastAIBackendConfigWithCreds:
+        config = self._get_config(record)
+        return VastAIBackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> VastAIBackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return VastAIBackendConfigWithCreds.__response__.parse_obj(config)
         return VastAIBackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> VastAIBackend:

dstack/_internal/core/backends/vultr/compute.py

@@ -75,17 +75,13 @@ class VultrCompute(
         subnet = vpc["v4_subnet"]
         subnet_mask = vpc["v4_subnet_mask"]
 
-        setup_commands = [
-            f"sudo ufw allow from {subnet}/{subnet_mask}",
-            "sudo ufw reload",
-        ]
         instance_id = self.api_client.launch_instance(
             region=instance_offer.region,
             label=instance_name,
             plan=instance_offer.instance.name,
             user_data=get_user_data(
                 authorized_keys=instance_config.get_public_keys(),
-                backend_specific_commands=setup_commands,
+                firewall_allow_from_subnets=[f"{subnet}/{subnet_mask}"],
             ),
             vpc_id=vpc["id"],
         )

dstack/_internal/core/backends/vultr/configurator.py

@@ -23,7 +23,12 @@ from dstack._internal.core.models.backends.base import (
 REGIONS = []
 
 
-class VultrConfigurator(Configurator):
+class VultrConfigurator(
+    Configurator[
+        VultrBackendConfig,
+        VultrBackendConfigWithCreds,
+    ]
+):
     TYPE = BackendType.VULTR
     BACKEND_CLASS = VultrBackend
 
@@ -42,10 +47,12 @@ class VultrConfigurator(Configurator):
             auth=VultrCreds.parse_obj(config.creds).json(),
         )
 
-    def get_backend_config(self, record: BackendRecord, include_creds: bool) -> VultrBackendConfig:
+    def get_backend_config_with_creds(self, record: BackendRecord) -> VultrBackendConfigWithCreds:
+        config = self._get_config(record)
+        return VultrBackendConfigWithCreds.__response__.parse_obj(config)
+
+    def get_backend_config_without_creds(self, record: BackendRecord) -> VultrBackendConfig:
         config = self._get_config(record)
-        if include_creds:
-            return VultrBackendConfigWithCreds.__response__.parse_obj(config)
         return VultrBackendConfig.__response__.parse_obj(config)
 
     def get_backend(self, record: BackendRecord) -> VultrBackend:

dstack/_internal/core/compatibility/fleets.py

@@ -59,6 +59,11 @@ def get_fleet_spec_excludes(fleet_spec: FleetSpec) -> Optional[IncludeExcludeDic
         profile_excludes.add("stop_criteria")
     if profile.schedule is None:
         profile_excludes.add("schedule")
+    if (
+        fleet_spec.configuration.nodes
+        and fleet_spec.configuration.nodes.min == fleet_spec.configuration.nodes.target
+    ):
+        configuration_excludes["nodes"] = {"target"}
     if configuration_excludes:
         spec_excludes["configuration"] = configuration_excludes
     if profile_excludes:

dstack/_internal/core/compatibility/gpus.py

@@ -0,0 +1,13 @@
+from typing import Optional
+
+from dstack._internal.core.compatibility.runs import get_run_spec_excludes
+from dstack._internal.core.models.common import IncludeExcludeDictType
+from dstack._internal.server.schemas.gpus import ListGpusRequest
+
+
+def get_list_gpus_excludes(request: ListGpusRequest) -> Optional[IncludeExcludeDictType]:
+    list_gpus_excludes: IncludeExcludeDictType = {}
+    run_spec_excludes = get_run_spec_excludes(request.run_spec)
+    if run_spec_excludes is not None:
+        list_gpus_excludes["run_spec"] = run_spec_excludes
+    return list_gpus_excludes

dstack/_internal/core/compatibility/runs.py

@@ -1,7 +1,7 @@
 from typing import Optional
 
 from dstack._internal.core.models.common import IncludeExcludeDictType, IncludeExcludeSetType
-from dstack._internal.core.models.configurations import ServiceConfiguration
+from dstack._internal.core.models.configurations import LEGACY_REPO_DIR, ServiceConfiguration
 from dstack._internal.core.models.runs import ApplyRunPlanInput, JobSpec, JobSubmission, RunSpec
 from dstack._internal.server.schemas.runs import GetRunPlanRequest, ListRunsRequest
 
@@ -102,6 +102,11 @@ def get_run_spec_excludes(run_spec: RunSpec) -> IncludeExcludeDictType:
     configuration = run_spec.configuration
     profile = run_spec.profile
 
+    if run_spec.repo_dir in [None, LEGACY_REPO_DIR]:
+        spec_excludes["repo_dir"] = True
+    elif run_spec.repo_dir == "." and configuration.working_dir in [None, LEGACY_REPO_DIR, "."]:
+        spec_excludes["repo_dir"] = True
+
     if configuration.fleets is None:
         configuration_excludes["fleets"] = True
     if profile is not None and profile.fleets is None:
@@ -136,6 +141,7 @@ def get_run_spec_excludes(run_spec: RunSpec) -> IncludeExcludeDictType:
         configuration_excludes["schedule"] = True
     if profile is not None and profile.schedule is None:
         profile_excludes.add("schedule")
+    configuration_excludes["repos"] = True
 
     if configuration_excludes:
         spec_excludes["configuration"] = configuration_excludes
@@ -162,6 +168,8 @@ def get_job_spec_excludes(job_specs: list[JobSpec]) -> IncludeExcludeDictType:
         spec_excludes["service_port"] = True
     if all(not s.probes for s in job_specs):
         spec_excludes["probes"] = True
+    if all(s.repo_dir in [None, LEGACY_REPO_DIR] for s in job_specs):
+        spec_excludes["repo_dir"] = True
 
     return spec_excludes
 

dstack/_internal/core/models/backends/base.py

@@ -4,13 +4,15 @@ import enum
 class BackendType(str, enum.Enum):
     """
     Attributes:
+        AMDDEVCLOUD (BackendType): AMD Developer Cloud
         AWS (BackendType): Amazon Web Services
         AZURE (BackendType): Microsoft Azure
         CLOUDRIFT (BackendType): CloudRift
         CUDO (BackendType): Cudo
+        DATACRUNCH (BackendType): DataCrunch
+        DIGITALOCEAN (BackendType): DigitalOcean
         DSTACK (BackendType): dstack Sky
         GCP (BackendType): Google Cloud Platform
-        DATACRUNCH (BackendType): DataCrunch
         HOTAISLE (BackendType): Hot Aisle
         KUBERNETES (BackendType): Kubernetes
         LAMBDA (BackendType): Lambda Cloud
@@ -22,11 +24,13 @@ class BackendType(str, enum.Enum):
         VULTR (BackendType): Vultr
     """
 
+    AMDDEVCLOUD = "amddevcloud"
     AWS = "aws"
     AZURE = "azure"
     CLOUDRIFT = "cloudrift"
     CUDO = "cudo"
     DATACRUNCH = "datacrunch"
+    DIGITALOCEAN = "digitalocean"
     DSTACK = "dstack"
     GCP = "gcp"
     HOTAISLE = "hotaisle"

dstack/_internal/core/models/common.py

@@ -102,12 +102,12 @@ class RegistryAuth(CoreModel):
         password (str): The password or access token
     """
 
-    class Config(CoreModel.Config):
-        frozen = True
-
     username: Annotated[str, Field(description="The username")]
     password: Annotated[str, Field(description="The password or access token")]
 
+    class Config(CoreModel.Config):
+        frozen = True
+
 
 class ApplyAction(str, Enum):
     CREATE = "create"  # resource is to be created or overridden