skypilot-nightly 1.0.0.dev20250603__py3-none-any.whl → 1.0.0.dev20250605__py3-none-any.whl

sky/provision/kubernetes/utils.py

@@ -1384,7 +1384,7 @@ def check_credentials(context: Optional[str],
     # Check if $KUBECONFIG envvar consists of multiple paths. We run this before
     # optional checks.
     try:
-        _ = _get_kubeconfig_path()
+        _ = get_kubeconfig_paths()
     except ValueError as e:
         return False, f'{common_utils.format_exception(e, use_bracket=True)}'
 
@@ -1537,15 +1537,11 @@ def is_kubeconfig_exec_auth(
             raise ValueError(f'Kubernetes context {context!r} not found.')
     target_username = context_obj['context']['user']
 
-    # K8s api does not provide a mechanism to get the user details from the
-    # context. We need to load the kubeconfig file and parse it to get the
-    # user details.
-    kubeconfig_path = _get_kubeconfig_path()
-
-    # Load the kubeconfig file as a dictionary
-    with open(kubeconfig_path, 'r', encoding='utf-8') as f:
-        kubeconfig = yaml.safe_load(f)
+    # Load the kubeconfig for the context
+    kubeconfig_text = _get_kubeconfig_text_for_context(context)
+    kubeconfig = yaml.safe_load(kubeconfig_text)
 
+    # Get the user details
     user_details = kubeconfig['users']
 
     # Find user matching the target username
@@ -1573,6 +1569,27 @@ def is_kubeconfig_exec_auth(
     return False, None
 
 
+def _get_kubeconfig_text_for_context(context: Optional[str] = None) -> str:
+    """Get the kubeconfig text for the given context.
+
+    The kubeconfig might be multiple files, this function use kubectl to
+    handle merging automatically.
+    """
+    command = 'kubectl config view --minify'
+    if context is not None:
+        command += f' --context={context}'
+    proc = subprocess.run(command,
+                          shell=True,
+                          check=False,
+                          stdout=subprocess.PIPE,
+                          stderr=subprocess.PIPE)
+    if proc.returncode != 0:
+        raise RuntimeError(
+            f'Failed to get kubeconfig text for context {context}: {proc.stderr.decode("utf-8")}'
+        )
+    return proc.stdout.decode('utf-8')
+
+
 @annotations.lru_cache(scope='request')
 def get_current_kube_config_context_name() -> Optional[str]:
     """Get the current kubernetes context from the kubeconfig file
@@ -3100,18 +3117,14 @@ def get_gpu_resource_key():
     return os.getenv('CUSTOM_GPU_RESOURCE_KEY', default=GPU_RESOURCE_KEY)
 
 
-def _get_kubeconfig_path() -> str:
-    """Get the path to the kubeconfig file.
+def get_kubeconfig_paths() -> List[str]:
+    """Get the path to the kubeconfig files.
     Parses `KUBECONFIG` env var if present, else uses the default path.
-    Currently, specifying multiple KUBECONFIG paths in the envvar is not
-    allowed, hence will raise a ValueError.
     """
-    kubeconfig_path = os.path.expanduser(
-        os.getenv(
-            'KUBECONFIG', kubernetes.kubernetes.config.kube_config.
-            KUBE_CONFIG_DEFAULT_LOCATION))
-    if len(kubeconfig_path.split(os.pathsep)) > 1:
-        raise ValueError('SkyPilot currently only supports one '
-                         'config file path with $KUBECONFIG. Current '
-                         f'path(s) are {kubeconfig_path}.')
-    return kubeconfig_path
+    # We should always use the latest KUBECONFIG environment variable to
+    # make sure env var overrides get respected.
+    paths = os.getenv('KUBECONFIG', kubernetes.DEFAULT_KUBECONFIG_PATH)
+    expanded = []
+    for path in paths.split(kubernetes.ENV_KUBECONFIG_PATH_SEPARATOR):
+        expanded.append(os.path.expanduser(path))
+    return expanded

sky/provision/vast/utils.py

@@ -78,7 +78,7 @@ def launch(name: str, instance_type: str, region: str, disk_size: int,
 		 amount of memory.
 
       *  Vast instance types are an invention for skypilot. Refer to
-         service_catalog/vast_catalog.py for the current construction
+         catalog/vast_catalog.py for the current construction
          of the type.
 
     """

sky/provision/vsphere/common/vim_utils.py

@@ -8,8 +8,7 @@ from typing import List
 
 from sky import sky_logging
 from sky.adaptors import vsphere as vsphere_adaptor
-from sky.clouds.service_catalog.data_fetchers.fetch_vsphere import (
-    get_accelerators_from_csv)
+from sky.catalog.data_fetchers.fetch_vsphere import get_accelerators_from_csv
 
 logger = sky_logging.init_logger(__name__)
 DISPLAY_CONTROLLER_CLASS_ID_PREFIXES = ['03']

sky/provision/vsphere/instance.py

@@ -6,7 +6,7 @@ from typing import Any, Dict, List, Optional
 from sky import sky_logging
 from sky.adaptors import common as adaptors_common
 from sky.adaptors import vsphere as vsphere_adaptor
-from sky.clouds.service_catalog.common import get_catalog_path
+from sky.catalog.common import get_catalog_path
 from sky.provision import common
 from sky.provision.vsphere import vsphere_utils
 from sky.provision.vsphere.common import custom_script as custom_script_lib

sky/provision/vsphere/vsphere_utils.py

@@ -10,18 +10,14 @@ from sky import exceptions
 from sky import sky_logging
 from sky.adaptors import common as adaptors_common
 from sky.adaptors import vsphere as vsphere_adaptor
-from sky.clouds.service_catalog import vsphere_catalog
-from sky.clouds.service_catalog.common import get_catalog_path
-from sky.clouds.service_catalog.data_fetchers.fetch_vsphere import (
-    initialize_accelerators_csv)
-from sky.clouds.service_catalog.data_fetchers.fetch_vsphere import (
-    initialize_hosts_csv)
-from sky.clouds.service_catalog.data_fetchers.fetch_vsphere import (
-    initialize_images_csv)
-from sky.clouds.service_catalog.data_fetchers.fetch_vsphere import (
+from sky.catalog import vsphere_catalog
+from sky.catalog.common import get_catalog_path
+from sky.catalog.data_fetchers.fetch_vsphere import initialize_accelerators_csv
+from sky.catalog.data_fetchers.fetch_vsphere import initialize_hosts_csv
+from sky.catalog.data_fetchers.fetch_vsphere import initialize_images_csv
+from sky.catalog.data_fetchers.fetch_vsphere import (
     initialize_instance_image_mapping_csv)
-from sky.clouds.service_catalog.data_fetchers.fetch_vsphere import (
-    initialize_vms_csv)
+from sky.catalog.data_fetchers.fetch_vsphere import initialize_vms_csv
 from sky.provision.vsphere.common import vim_utils
 from sky.provision.vsphere.common.cls_api_client import ClsApiClient
 from sky.provision.vsphere.common.cls_api_helper import ClsApiHelper

sky/resources.py

@@ -7,13 +7,13 @@ from typing import Any, Dict, List, Literal, Optional, Set, Tuple, Union
 import colorama
 
 import sky
+from sky import catalog
 from sky import check as sky_check
 from sky import clouds
 from sky import exceptions
 from sky import sky_logging
 from sky import skypilot_config
 from sky.clouds import cloud as sky_cloud
-from sky.clouds import service_catalog
 from sky.provision import docker_utils
 from sky.provision.gcp import constants as gcp_constants
 from sky.provision.kubernetes import utils as kubernetes_utils
@@ -45,7 +45,9 @@ class AutostopConfig:
     # to be complete.
     enabled: bool
     # If enabled is False, these values are ignored.
-    idle_minutes: int = 5
+    # Keep the default value to 0 to make the behavior consistent with the CLI
+    # flags.
+    idle_minutes: int = 0
     down: bool = False
 
     def to_yaml_config(self) -> Union[Literal[False], Dict[str, Any]]:
@@ -379,7 +381,7 @@ class Resources:
     # if it fails to fetch some account specific catalog information (e.g., AWS
     # zone mapping). It is fine to use the default catalog as this function is
     # only for display purposes.
-    @service_catalog.fallback_to_default_catalog
+    @catalog.fallback_to_default_catalog
     def __repr__(self) -> str:
         """Returns a string representation for display.
 
@@ -883,6 +885,25 @@ class Resources:
             valid_volumes.append(volume)
         self._volumes = valid_volumes
 
+    def override_autostop_config(self,
+                                 down: bool = False,
+                                 idle_minutes: Optional[int] = None) -> None:
+        """Override autostop config to the resource.
+
+        Args:
+            down: If true, override the autostop config to use autodown.
+            idle_minutes: If not None, override the idle minutes to autostop or
+                autodown.
+        """
+        if not down and idle_minutes is None:
+            return
+        if self._autostop_config is None:
+            self._autostop_config = AutostopConfig(enabled=True,)
+        if down:
+            self._autostop_config.down = down
+        if idle_minutes is not None:
+            self._autostop_config.idle_minutes = idle_minutes
+
     def is_launchable(self) -> bool:
         """Returns whether the resource is launchable."""
         return self.cloud is not None and self._instance_type is not None

sky/serve/server/core.py

@@ -17,7 +17,7 @@ from sky import sky_logging
 from sky import skypilot_config
 from sky import task as task_lib
 from sky.backends import backend_utils
-from sky.clouds.service_catalog import common as service_catalog_common
+from sky.catalog import common as service_catalog_common
 from sky.serve import constants as serve_constants
 from sky.serve import serve_state
 from sky.serve import serve_utils

sky/server/constants.py

@@ -7,7 +7,7 @@ from sky.skylet import constants
 # API server version, whenever there is a change in API server that requires a
 # restart of the local API server or error out when the client does not match
 # the server version.
-API_VERSION = '7'
+API_VERSION = '9'
 
 # Prefix for API request names.
 REQUEST_NAME_PREFIX = 'sky.'
@@ -25,8 +25,10 @@ API_SERVER_REQUEST_DB_PATH = '~/.sky/api_server/requests.db'
 CLUSTER_REFRESH_DAEMON_INTERVAL_SECONDS = 60
 
 # Environment variable for a file path to the API cookie file.
+# Keep in sync with websocket_proxy.py
 API_COOKIE_FILE_ENV_VAR = f'{constants.SKYPILOT_ENV_VAR_PREFIX}API_COOKIE_FILE'
 # Default file if unset.
+# Keep in sync with websocket_proxy.py
 API_COOKIE_FILE_DEFAULT_LOCATION = '~/.sky/cookies.txt'
 
 # The path to the dashboard build output

sky/server/requests/executor.py

@@ -239,8 +239,11 @@ def override_request_env_and_config(
         client_command=request_body.entrypoint_command,
         using_remote_api_server=request_body.using_remote_api_server)
     try:
+        logger.debug(
+            f'override path: {request_body.override_skypilot_config_path}')
         with skypilot_config.override_skypilot_config(
-                request_body.override_skypilot_config):
+                request_body.override_skypilot_config,
+                request_body.override_skypilot_config_path):
             yield
     finally:
         # We need to call the save_timeline() since atexit will not be

sky/server/requests/payloads.py

@@ -82,6 +82,17 @@ def get_override_skypilot_config_from_client() -> Dict[str, Any]:
     return config
 
 
+def get_override_skypilot_config_path_from_client() -> Optional[str]:
+    """Returns the override config path from the client."""
+    if annotations.is_on_api_server:
+        return None
+    # Currently, we don't need to check if the client-side config
+    # has been overridden because we only deal with cases where
+    # client has a project-level config/changed config and the
+    # api server has a different config.
+    return skypilot_config.loaded_config_path_serialized()
+
+
 class RequestBody(pydantic.BaseModel):
     """The request body for the SkyPilot API."""
     env_vars: Dict[str, str] = {}
@@ -89,6 +100,7 @@ class RequestBody(pydantic.BaseModel):
     entrypoint_command: str = ''
     using_remote_api_server: bool = False
     override_skypilot_config: Optional[Dict[str, Any]] = {}
+    override_skypilot_config_path: Optional[str] = None
 
     # Allow extra fields in the request body, which is useful for backward
     # compatibility, i.e., we can add new fields to the request body without
@@ -108,6 +120,9 @@ class RequestBody(pydantic.BaseModel):
         data['override_skypilot_config'] = data.get(
             'override_skypilot_config',
             get_override_skypilot_config_from_client())
+        data['override_skypilot_config_path'] = data.get(
+            'override_skypilot_config_path',
+            get_override_skypilot_config_path_from_client())
         super().__init__(**data)
 
     def to_kwargs(self) -> Dict[str, Any]:
@@ -122,6 +137,7 @@ class RequestBody(pydantic.BaseModel):
         kwargs.pop('entrypoint_command')
         kwargs.pop('using_remote_api_server')
         kwargs.pop('override_skypilot_config')
+        kwargs.pop('override_skypilot_config_path')
         return kwargs
 
     @property
@@ -180,8 +196,10 @@ class LaunchBody(RequestBody):
     task: str
     cluster_name: str
     retry_until_up: bool = False
+    # TODO(aylei): remove this field in v0.12.0
     idle_minutes_to_autostop: Optional[int] = None
     dryrun: bool = False
+    # TODO(aylei): remove this field in v0.12.0
     down: bool = False
     backend: Optional[str] = None
     optimize_target: common_lib.OptimizeTarget = common_lib.OptimizeTarget.COST
@@ -315,6 +333,12 @@ class ClusterJobsDownloadLogsBody(RequestBody):
     local_dir: str = constants.SKY_LOGS_DIRECTORY
 
 
+class UserUpdateBody(RequestBody):
+    """The request body for the user update endpoint."""
+    user_id: str
+    role: str
+
+
 class DownloadBody(RequestBody):
     """The request body for the download endpoint."""
     folder_paths: List[str]
@@ -359,6 +383,7 @@ class JobsQueueBody(RequestBody):
     refresh: bool = False
     skip_finished: bool = False
     all_users: bool = False
+    job_ids: Optional[List[int]] = None
 
 
 class JobsCancelBody(RequestBody):

sky/server/requests/serializers/decoders.py

@@ -6,7 +6,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 from sky import jobs as managed_jobs
 from sky import models
-from sky.clouds.service_catalog import common
+from sky.catalog import common
 from sky.data import storage
 from sky.provision.kubernetes import utils as kubernetes_utils
 from sky.serve import serve_state

sky/server/server.py

@@ -26,6 +26,7 @@ from fastapi.middleware import cors
 import starlette.middleware.base
 
 import sky
+from sky import catalog
 from sky import check as sky_check
 from sky import clouds
 from sky import core
@@ -34,7 +35,6 @@ from sky import execution
 from sky import global_user_state
 from sky import models
 from sky import sky_logging
-from sky.clouds import service_catalog
 from sky.data import storage_utils
 from sky.jobs.server import server as jobs_rest
 from sky.provision.kubernetes import utils as kubernetes_utils
@@ -49,6 +49,7 @@ from sky.server.requests import preconditions
 from sky.server.requests import requests as requests_lib
 from sky.skylet import constants
 from sky.usage import usage_lib
+from sky.users import server as users_rest
 from sky.utils import admin_policy_utils
 from sky.utils import common as common_lib
 from sky.utils import common_utils
@@ -100,6 +101,27 @@ logger = sky_logging.init_logger(__name__)
 # response will block other requests from being processed.
 
 
+class RBACMiddleware(starlette.middleware.base.BaseHTTPMiddleware):
+    """Middleware to handle RBAC."""
+
+    async def dispatch(self, request: fastapi.Request, call_next):
+        if request.url.path.startswith('/dashboard/'):
+            return await call_next(request)
+
+        auth_user = _get_auth_user_header(request)
+        if auth_user is None:
+            return await call_next(request)
+
+        permission_service = users_rest.permission_service
+        # Check the role permission
+        if permission_service.check_permission(auth_user.id, request.url.path,
+                                               request.method):
+            return fastapi.responses.JSONResponse(
+                status_code=403, content={'detail': 'Forbidden'})
+
+        return await call_next(request)
+
+
 class RequestIDMiddleware(starlette.middleware.base.BaseHTTPMiddleware):
     """Middleware to add a request ID to each request."""
 
@@ -130,7 +152,10 @@ class AuthProxyMiddleware(starlette.middleware.base.BaseHTTPMiddleware):
 
         # Add user to database if auth_user is present
         if auth_user is not None:
-            global_user_state.add_or_update_user(auth_user)
+            newly_added = global_user_state.add_or_update_user(auth_user)
+            if newly_added:
+                users_rest.permission_service.add_user_if_not_exists(
+                    auth_user.id)
 
         body = await request.body()
         if auth_user and body:
@@ -244,11 +269,13 @@ class PathCleanMiddleware(starlette.middleware.base.BaseHTTPMiddleware):
             parent = pathlib.Path('/dashboard')
             request_path = pathlib.Path(posixpath.normpath(request.url.path))
             if not _is_relative_to(request_path, parent):
-                raise fastapi.HTTPException(status_code=403, detail='Forbidden')
+                return fastapi.responses.JSONResponse(
+                    status_code=403, content={'detail': 'Forbidden'})
         return await call_next(request)
 
 
 app = fastapi.FastAPI(prefix='/api/v1', debug=True, lifespan=lifespan)
+app.add_middleware(RBACMiddleware)
 app.add_middleware(InternalDashboardPrefixMiddleware)
 app.add_middleware(PathCleanMiddleware)
 app.add_middleware(CacheControlStaticMiddleware)
@@ -266,6 +293,7 @@ app.add_middleware(AuthProxyMiddleware)
 app.add_middleware(RequestIDMiddleware)
 app.include_router(jobs_rest.router, prefix='/jobs', tags=['jobs'])
 app.include_router(serve_rest.router, prefix='/serve', tags=['serve'])
+app.include_router(users_rest.router, prefix='/users', tags=['users'])
 app.include_router(workspaces_rest.router,
                    prefix='/workspaces',
                    tags=['workspaces'])
@@ -389,7 +417,7 @@ async def list_accelerators(
         request_id=request.state.request_id,
         request_name='list_accelerators',
         request_body=list_accelerator_counts_body,
-        func=service_catalog.list_accelerators,
+        func=catalog.list_accelerators,
         schedule_type=requests_lib.ScheduleType.SHORT,
     )
 
@@ -404,7 +432,7 @@ async def list_accelerator_counts(
         request_id=request.state.request_id,
         request_name='list_accelerator_counts',
         request_body=list_accelerator_counts_body,
-        func=service_catalog.list_accelerator_counts,
+        func=catalog.list_accelerator_counts,
         schedule_type=requests_lib.ScheduleType.SHORT,
     )
 
@@ -835,13 +863,6 @@ async def logs(
     )
 
 
-@app.get('/users')
-async def users() -> List[Dict[str, Any]]:
-    """Gets all users."""
-    user_list = global_user_state.get_all_users()
-    return [user.to_dict() for user in user_list]
-
-
 @app.post('/download_logs')
 async def download_logs(
         request: fastapi.Request,

sky/server/stream_utils.py

@@ -3,7 +3,7 @@
 import asyncio
 import collections
 import pathlib
-from typing import AsyncGenerator, Deque, List, Optional
+from typing import AsyncGenerator, Deque, Optional
 
 import aiofiles
 import fastapi
@@ -15,12 +15,6 @@ from sky.utils import rich_utils
 
 logger = sky_logging.init_logger(__name__)
 
-# When streaming log lines, buffer the lines in memory and flush them in chunks
-# to improve log tailing throughput. Buffer size is the max size bytes of each
-# chunk and the timeout threshold for flushing the buffer to ensure
-# responsiveness.
-_BUFFER_SIZE = 8 * 1024  # 8KB
-_BUFFER_TIMEOUT = 0.02  # 20ms
 _HEARTBEAT_INTERVAL = 30
 
 
@@ -44,20 +38,6 @@ async def log_streamer(request_id: Optional[str],
                        follow: bool = True) -> AsyncGenerator[str, None]:
     """Streams the logs of a request."""
 
-    # Buffer the lines in memory and flush them in chunks to improve log tailing
-    # throughput.
-    buffer: List[str] = []
-    buffer_bytes = 0
-    last_flush_time = asyncio.get_event_loop().time()
-
-    async def flush_buffer() -> AsyncGenerator[str, None]:
-        nonlocal buffer, buffer_bytes, last_flush_time
-        if buffer:
-            yield ''.join(buffer)
-            buffer.clear()
-            buffer_bytes = 0
-            last_flush_time = asyncio.get_event_loop().time()
-
     if request_id is not None:
         status_msg = rich_utils.EncodedStatusMessage(
             f'[dim]Checking request: {request_id}[/dim]')
@@ -119,14 +99,7 @@ async def log_streamer(request_id: Optional[str],
             # while keeps the loop tight to make log stream responsive.
             await asyncio.sleep(0)
             line: Optional[bytes] = await f.readline()
-
-            current_time = asyncio.get_event_loop().time()
             if not line:
-                if buffer and (current_time -
-                               last_flush_time) >= _BUFFER_TIMEOUT:
-                    async for chunk in flush_buffer():
-                        yield chunk
-
                 if request_id is not None:
                     request_task = requests_lib.get_request(request_id)
                     if request_task.status > requests_lib.RequestStatus.RUNNING:
@@ -165,16 +138,7 @@ async def log_streamer(request_id: Optional[str],
                 # sending invisible characters might be okay.
                 if is_payload:
                     continue
-
-            # Add to buffer
-            buffer.append(line_str)
-            buffer_bytes += len(line_str.encode('utf-8'))
-
-            # Check if we should flush the buffer
-            if (buffer_bytes >= _BUFFER_SIZE or
-                (current_time - last_flush_time) >= _BUFFER_TIMEOUT):
-                async for chunk in flush_buffer():
-                    yield chunk
+            yield line_str
 
 
 def stream_response(

sky/setup_files/MANIFEST.in

@@ -16,3 +16,4 @@ include sky/templates/*
 include sky/utils/kubernetes/*
 include sky/server/html/*
 recursive-include sky/dashboard/out *
+include sky/users/*.conf

sky/setup_files/dependencies.py

@@ -58,6 +58,8 @@ install_requires = [
     'setproctitle',
     'sqlalchemy',
     'psycopg2-binary',
+    'casbin',
+    'sqlalchemy_adapter',
 ]
 
 local_ray = [

sky/skylet/constants.py

@@ -379,7 +379,7 @@ OVERRIDEABLE_CONFIG_KEYS_IN_TASK: List[Tuple[str, ...]] = [
 SKIPPED_CLIENT_OVERRIDE_KEYS: List[Tuple[str, ...]] = [('admin_policy',),
                                                        ('api_server',),
                                                        ('allowed_clouds',),
-                                                       ('workspaces',)]
+                                                       ('workspaces',), ('db',)]
 
 # Constants for Azure blob storage
 WAIT_FOR_STORAGE_ACCOUNT_CREATION = 60
@@ -409,6 +409,12 @@ ENV_VAR_IS_SKYPILOT_SERVER = 'IS_SKYPILOT_SERVER'
 
 SKYPILOT_DEFAULT_WORKSPACE = 'default'
 
-# Experimental - may be deprecated in the future without notice.
-SKYPILOT_API_SERVER_DB_URL_ENV_VAR: str = (
-    f'{SKYPILOT_ENV_VAR_PREFIX}API_SERVER_DB_URL')
+# BEGIN constants used for service catalog.
+HOSTED_CATALOG_DIR_URL = 'https://raw.githubusercontent.com/skypilot-org/skypilot-catalog/master/catalogs'  # pylint: disable=line-too-long
+HOSTED_CATALOG_DIR_URL_S3_MIRROR = 'https://skypilot-catalog.s3.us-east-1.amazonaws.com/catalogs'  # pylint: disable=line-too-long
+CATALOG_SCHEMA_VERSION = 'v7'
+CATALOG_DIR = '~/.sky/catalogs'
+ALL_CLOUDS = ('aws', 'azure', 'gcp', 'ibm', 'lambda', 'scp', 'oci',
+              'kubernetes', 'runpod', 'vast', 'vsphere', 'cudo', 'fluidstack',
+              'paperspace', 'do', 'nebius', 'ssh')
+# END constants used for service catalog.