skypilot-nightly 1.0.0.dev20250729__py3-none-any.whl → 1.0.0.dev20250731__py3-none-any.whl

sky/serve/service.py

@@ -222,7 +222,8 @@ def _start(service_name: str, tmp_task_yaml: str, job_id: int):
             requested_resources_str=backend_utils.get_task_resources_str(task),
             load_balancing_policy=service_spec.load_balancing_policy,
             status=serve_state.ServiceStatus.CONTROLLER_INIT,
-            tls_encrypted=service_spec.tls_credential is not None)
+            tls_encrypted=service_spec.tls_credential is not None,
+            pool=service_spec.pool)
         # Directly throw an error here. See sky/serve/api.py::up
         # for more details.
         if not success:
@@ -292,14 +293,17 @@ def _start(service_name: str, tmp_task_yaml: str, job_id: int):
             # TODO(tian): Probably we could enable multiple ports specified in
             # service spec and we could start multiple load balancers.
             # After that, we will have a mapping from replica port to endpoint.
-            load_balancer_process = multiprocessing.Process(
-                target=ux_utils.RedirectOutputForProcess(
-                    load_balancer.run_load_balancer,
-                    load_balancer_log_file).run,
-                args=(controller_addr, load_balancer_port,
-                      service_spec.load_balancing_policy,
-                      service_spec.tls_credential))
-            load_balancer_process.start()
+            # NOTE(tian): We don't need the load balancer for cluster pool.
+            # Skip the load balancer process for cluster pool.
+            if not service_spec.pool:
+                load_balancer_process = multiprocessing.Process(
+                    target=ux_utils.RedirectOutputForProcess(
+                        load_balancer.run_load_balancer,
+                        load_balancer_log_file).run,
+                    args=(controller_addr, load_balancer_port,
+                          service_spec.load_balancing_policy,
+                          service_spec.tls_credential))
+                load_balancer_process.start()
 
             if not is_recovery:
                 serve_state.set_service_load_balancer_port(

sky/serve/service_spec.py

@@ -43,7 +43,33 @@ class SkyServiceSpec:
         upscale_delay_seconds: Optional[int] = None,
         downscale_delay_seconds: Optional[int] = None,
         load_balancing_policy: Optional[str] = None,
+        pool: Optional[bool] = None,
     ) -> None:
+        if pool:
+            for unsupported_field in [
+                    'max_replicas',
+                    'num_overprovision',
+                    'target_qps_per_replica',
+                    'upscale_delay_seconds',
+                    'downscale_delay_seconds',
+                    'base_ondemand_fallback_replicas',
+                    'dynamic_ondemand_fallback',
+                    'spot_placer',
+                    'load_balancing_policy',
+                    'ports',
+                    'post_data',
+                    'tls_credential',
+                    'readiness_headers',
+            ]:
+                if locals()[unsupported_field] is not None:
+                    with ux_utils.print_exception_no_traceback():
+                        raise ValueError(
+                            f'{unsupported_field} is not supported for pool.')
+            if max_replicas is not None and max_replicas != min_replicas:
+                with ux_utils.print_exception_no_traceback():
+                    raise ValueError('Autoscaling is not supported for pool '
+                                     'for now.')
+
         if max_replicas is not None and max_replicas < min_replicas:
             with ux_utils.print_exception_no_traceback():
                 raise ValueError('max_replicas must be greater than or '
@@ -96,6 +122,7 @@ class SkyServiceSpec:
         self._upscale_delay_seconds: Optional[int] = upscale_delay_seconds
         self._downscale_delay_seconds: Optional[int] = downscale_delay_seconds
         self._load_balancing_policy: Optional[str] = load_balancing_policy
+        self._pool: Optional[bool] = pool
 
         self._use_ondemand_fallback: bool = (
             self.dynamic_ondemand_fallback is not None and
@@ -115,7 +142,7 @@ class SkyServiceSpec:
 
         service_config: Dict[str, Any] = {}
 
-        readiness_section = config['readiness_probe']
+        readiness_section = config.get('readiness_probe', '/')
         if isinstance(readiness_section, str):
             service_config['readiness_path'] = readiness_section
             initial_delay_seconds = None
@@ -157,8 +184,29 @@ class SkyServiceSpec:
                     raise ValueError('Port must be between 1 and 65535.')
         service_config['ports'] = str(ports) if ports is not None else None
 
+        pool_config = config.get('pool', None)
+        if pool_config is not None:
+            service_config['pool'] = pool_config
+
         policy_section = config.get('replica_policy', None)
+        if policy_section is not None and pool_config:
+            with ux_utils.print_exception_no_traceback():
+                raise ValueError('Cannot specify `replica_policy` for cluster '
+                                 'pool. Only `workers: <num>` is supported '
+                                 'for cluster pool now.')
+
         simplified_policy_section = config.get('replicas', None)
+        workers_config = config.get('workers', None)
+        if simplified_policy_section is not None and workers_config is not None:
+            with ux_utils.print_exception_no_traceback():
+                raise ValueError('Cannot specify both `replicas` and `workers`.'
+                                 ' Please use one of them.')
+        if simplified_policy_section is not None and pool_config:
+            with ux_utils.print_exception_no_traceback():
+                raise ValueError('Cannot specify `replicas` for cluster pool. '
+                                 'Please use `workers` instead.')
+        if simplified_policy_section is None:
+            simplified_policy_section = workers_config
         if policy_section is None or simplified_policy_section is not None:
             if simplified_policy_section is not None:
                 min_replicas = simplified_policy_section
@@ -239,6 +287,13 @@ class SkyServiceSpec:
                         config[section] = dict()
                     config[section][key] = value
 
+        add_if_not_none('pool', None, self._pool)
+
+        if self.pool:
+            # For pool, currently only `workers: <num>` is supported.
+            add_if_not_none('workers', None, self.min_replicas)
+            return config
+
         add_if_not_none('readiness_probe', 'path', self.readiness_path)
         add_if_not_none('readiness_probe', 'initial_delay_seconds',
                         self.initial_delay_seconds)
@@ -306,10 +361,14 @@ class SkyServiceSpec:
         return ' '.join(policy_strs)
 
     def autoscaling_policy_str(self):
+        if self.pool:
+            # We only support fixed-size pool for now.
+            return f'Fixed-size ({self.min_replicas} workers)'
         # TODO(MaoZiming): Update policy_str
+        noun = 'worker' if self.pool else 'replica'
         min_plural = '' if self.min_replicas == 1 else 's'
         if self.max_replicas == self.min_replicas or self.max_replicas is None:
-            return f'Fixed {self.min_replicas} replica{min_plural}'
+            return f'Fixed {self.min_replicas} {noun}{min_plural}'
         # Already checked in __init__.
         assert self.target_qps_per_replica is not None
         # TODO(tian): Refactor to contain more information
@@ -319,8 +378,8 @@ class SkyServiceSpec:
             overprovision_str = (
                 f' with {self.num_overprovision} overprovisioned replicas')
         return (f'Autoscaling from {self.min_replicas} to {self.max_replicas} '
-                f'replica{max_plural}{overprovision_str} (target QPS per '
-                f'replica: {self.target_qps_per_replica})')
+                f'{noun}{max_plural}{overprovision_str} (target QPS per '
+                f'{noun}: {self.target_qps_per_replica})')
 
     def set_ports(self, ports: str) -> None:
         self._ports = ports
@@ -332,6 +391,10 @@ class SkyServiceSpec:
                 f'Certfile: {self.tls_credential.certfile}')
 
     def __repr__(self) -> str:
+        if self.pool:
+            return textwrap.dedent(f"""\
+                Worker policy:  {self.autoscaling_policy_str()}
+            """)
         return textwrap.dedent(f"""\
             Readiness probe method:           {self.probe_str()}
             Readiness initial delay seconds:  {self.initial_delay_seconds}
@@ -420,3 +483,10 @@ class SkyServiceSpec:
     def load_balancing_policy(self) -> str:
         return lb_policies.LoadBalancingPolicy.make_policy_name(
             self._load_balancing_policy)
+
+    @property
+    def pool(self) -> bool:
+        # This can happen for backward compatibility.
+        if not hasattr(self, '_pool'):
+            return False
+        return bool(self._pool)

sky/server/constants.py

@@ -10,7 +10,7 @@ from sky.skylet import constants
 # based on version info is needed.
 # For more details and code guidelines, refer to:
 # https://docs.skypilot.co/en/latest/developers/CONTRIBUTING.html#backward-compatibility-guidelines
-API_VERSION = 11
+API_VERSION = 12
 
 # The minimum peer API version that the code should still work with.
 # Notes (dev):

sky/server/requests/payloads.py

@@ -478,6 +478,8 @@ class JobsLaunchBody(RequestBody):
     """The request body for the jobs launch endpoint."""
     task: str
     name: Optional[str]
+    pool: Optional[str] = None
+    num_jobs: Optional[int] = None
 
     def to_kwargs(self) -> Dict[str, Any]:
         kwargs = super().to_kwargs()
@@ -500,6 +502,7 @@ class JobsCancelBody(RequestBody):
     job_ids: Optional[List[int]] = None
     all: bool = False
     all_users: bool = False
+    pool: Optional[str] = None
 
 
 class JobsLogsBody(RequestBody):
@@ -671,6 +674,36 @@ class JobsDownloadLogsBody(RequestBody):
     local_dir: str = constants.SKY_LOGS_DIRECTORY
 
 
+class JobsPoolApplyBody(RequestBody):
+    """The request body for the jobs pool apply endpoint."""
+    task: str
+    pool_name: str
+    mode: serve.UpdateMode
+
+    def to_kwargs(self) -> Dict[str, Any]:
+        kwargs = super().to_kwargs()
+        dag = common.process_mounts_in_task_on_api_server(self.task,
+                                                          self.env_vars,
+                                                          workdir_only=False)
+        assert len(
+            dag.tasks) == 1, ('Must only specify one task in the DAG for '
+                              'a pool.', dag)
+        kwargs['task'] = dag.tasks[0]
+        return kwargs
+
+
+class JobsPoolDownBody(RequestBody):
+    """The request body for the jobs pool down endpoint."""
+    pool_names: Optional[Union[str, List[str]]]
+    all: bool = False
+    purge: bool = False
+
+
+class JobsPoolStatusBody(RequestBody):
+    """The request body for the jobs pool status endpoint."""
+    pool_names: Optional[Union[str, List[str]]]
+
+
 class UploadZipFileResponse(pydantic.BaseModel):
     """The response body for the upload zip file endpoint."""
     status: str

sky/server/requests/requests.py

@@ -361,7 +361,24 @@ def managed_job_status_refresh_event():
         managed_job_utils.ha_recovery_for_consolidation_mode()
     # After recovery, we start the event loop.
     from sky.skylet import events
-    event = events.ManagedJobEvent()
+    refresh_event = events.ManagedJobEvent()
+    scheduling_event = events.ManagedJobSchedulingEvent()
+    while True:
+        logger.info('=== Running managed job event ===')
+        refresh_event.run()
+        scheduling_event.run()
+        time.sleep(events.EVENT_CHECKING_INTERVAL_SECONDS)
+
+
+def sky_serve_status_refresh_event():
+    """Refresh the managed job status for controller consolidation mode."""
+    # pylint: disable=import-outside-toplevel
+    from sky.serve import serve_utils
+    if not serve_utils.is_consolidation_mode():
+        return
+    # TODO(tian): Add HA recovery logic.
+    from sky.skylet import events
+    event = events.ServiceUpdateEvent()
     while True:
         time.sleep(events.EVENT_CHECKING_INTERVAL_SECONDS)
         event.run()

sky/server/requests/serializers/decoders.py

@@ -109,9 +109,8 @@ def decode_jobs_queue(return_value: List[dict],) -> List[Dict[str, Any]]:
     return jobs
 
 
-@register_decoders('serve.status')
-def decode_serve_status(return_value: List[dict]) -> List[Dict[str, Any]]:
-    service_statuses = return_value
+def _decode_serve_status(
+        service_statuses: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
     for service_status in service_statuses:
         service_status['status'] = serve_state.ServiceStatus(
             service_status['status'])
@@ -122,6 +121,16 @@ def decode_serve_status(return_value: List[dict]) -> List[Dict[str, Any]]:
     return service_statuses
 
 
+@register_decoders('serve.status')
+def decode_serve_status(return_value: List[dict]) -> List[Dict[str, Any]]:
+    return _decode_serve_status(return_value)
+
+
+@register_decoders('jobs.pool_status')
+def decode_jobs_pool_status(return_value: List[dict]) -> List[Dict[str, Any]]:
+    return _decode_serve_status(return_value)
+
+
 @register_decoders('cost_report')
 def decode_cost_report(
         return_value: List[Dict[str, Any]]) -> List[Dict[str, Any]]:

sky/server/requests/serializers/encoders.py

@@ -112,8 +112,7 @@ def encode_jobs_queue(jobs: List[dict],) -> List[Dict[str, Any]]:
     return jobs
 
 
-@register_encoder('serve.status')
-def encode_serve_status(
+def _encode_serve_status(
         service_statuses: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
     for service_status in service_statuses:
         service_status['status'] = service_status['status'].value
@@ -123,6 +122,18 @@ def encode_serve_status(
     return service_statuses
 
 
+@register_encoder('serve.status')
+def encode_serve_status(
+        service_statuses: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    return _encode_serve_status(service_statuses)
+
+
+@register_encoder('jobs.pool_status')
+def encode_jobs_pool_status(
+        pool_statuses: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    return _encode_serve_status(pool_statuses)
+
+
 @register_encoder('cost_report')
 def encode_cost_report(
         cost_report: List[Dict[str, Any]]) -> List[Dict[str, Any]]:

sky/server/server.py

@@ -882,10 +882,15 @@ async def upload_zip_file(request: fastapi.Request, user_hash: str,
     upload_ids_to_cleanup[(upload_id,
                            user_hash)] = (datetime.datetime.now() +
                                           _DEFAULT_UPLOAD_EXPIRATION_TIME)
+    # For anonymous access, use the user hash from client
+    user_id = user_hash
+    if request.state.auth_user is not None:
+        # Otherwise, the authenticated identity should be used.
+        user_id = request.state.auth_user.id
 
     # TODO(SKY-1271): We need to double check security of uploading zip file.
     client_file_mounts_dir = (
-        common.API_SERVER_CLIENT_DIR.expanduser().resolve() / user_hash /
+        common.API_SERVER_CLIENT_DIR.expanduser().resolve() / user_id /
         'file_mounts')
     client_file_mounts_dir.mkdir(parents=True, exist_ok=True)
 

sky/skylet/events.py

@@ -75,7 +75,16 @@ class ManagedJobEvent(SkyletEvent):
     EVENT_INTERVAL_SECONDS = 300
 
     def _run(self):
+        logger.info('=== Updating managed job status ===')
         managed_job_utils.update_managed_jobs_statuses()
+
+
+class ManagedJobSchedulingEvent(SkyletEvent):
+    """Skylet event for scheduling managed jobs."""
+    EVENT_INTERVAL_SECONDS = 20
+
+    def _run(self):
+        logger.info('=== Scheduling next jobs ===')
         managed_job_scheduler.maybe_schedule_next_jobs()
 
 

sky/skypilot_config.py

@@ -495,6 +495,12 @@ def parse_and_validate_config_file(config_path: str) -> config_utils.Config:
     try:
         config_dict = common_utils.read_yaml(config_path)
         config = config_utils.Config.from_dict(config_dict)
+        # pop the db url from the config, and set it to the env var.
+        # this is to avoid db url (considered a sensitive value)
+        # being printed with the rest of the config.
+        db_url = config.pop_nested(('db',), None)
+        if db_url:
+            os.environ[constants.ENV_VAR_DB_CONNECTION_URI] = db_url
         if sky_logging.logging_enabled(logger, sky_logging.DEBUG):
             logger.debug(f'Config loaded from {config_path}:\n'
                          f'{common_utils.dump_yaml_str(dict(config))}')
@@ -556,21 +562,16 @@ def _reload_config_as_server() -> None:
     _set_loaded_config_path(None)
 
     server_config_path = _resolve_server_config_path()
-    db_url_from_env = os.environ.get(constants.ENV_VAR_DB_CONNECTION_URI)
     server_config = _get_config_from_path(server_config_path)
-    if db_url_from_env:
-        server_config.set_nested(('db',), db_url_from_env)
-
-    if sky_logging.logging_enabled(logger, sky_logging.DEBUG):
-        logger.debug(f'server config: \n'
-                     f'{common_utils.dump_yaml_str(dict(server_config))}')
-
-    db_url = server_config.get_nested(('db',), None)
-    if db_url and len(server_config.keys()) > 1:
-        raise ValueError(
-            'if db config is specified, no other config is allowed')
+    # Get the db url from the env var. _get_config_from_path should have moved
+    # the db url specified in config file to the env var.
+    db_url = os.environ.get(constants.ENV_VAR_DB_CONNECTION_URI)
 
     if db_url:
+        if len(server_config.keys()) > 1:
+            raise ValueError(
+                'If db config is specified, no other config is allowed')
+        logger.debug('retrieving config from database')
         with _DB_USE_LOCK:
             sqlalchemy_engine = sqlalchemy.create_engine(db_url,
                                                          poolclass=NullPool)
@@ -591,14 +592,13 @@ def _reload_config_as_server() -> None:
 
             db_config = _get_config_yaml_from_db(API_SERVER_CONFIG_KEY)
             if db_config:
-                if sky_logging.logging_enabled(logger, sky_logging.DEBUG):
-                    logger.debug(
-                        f'Config loaded from db:\n'
-                        f'{common_utils.dump_yaml_str(dict(db_config))}')
                 server_config = overlay_skypilot_config(server_config,
                                                         db_config)
             # Close the engine to avoid connection leaks
             sqlalchemy_engine.dispose()
+    if sky_logging.logging_enabled(logger, sky_logging.DEBUG):
+        logger.debug(f'server config: \n'
+                     f'{common_utils.dump_yaml_str(dict(server_config))}')
     _set_loaded_config(server_config)
     _set_loaded_config_path(server_config_path)
 
@@ -681,6 +681,10 @@ def override_skypilot_config(
 
     disallowed_diff_keys = []
     for key in constants.SKIPPED_CLIENT_OVERRIDE_KEYS:
+        if key == ('db',):
+            # since db key is popped out of server config, the key is expected
+            # to be different between client and server.
+            continue
         value = override_configs.pop_nested(key, default_value=None)
         if (value is not None and
                 value != original_config.get_nested(key, default_value=None)):
@@ -855,11 +859,11 @@ def update_api_server_config_no_lock(config: config_utils.Config) -> None:
 
     db_updated = False
     if os.environ.get(constants.ENV_VAR_IS_SKYPILOT_SERVER) is not None:
-        existing_db_url = get_nested(('db',), None)
+        existing_db_url = os.environ.get(constants.ENV_VAR_DB_CONNECTION_URI)
+        new_db_url = config.pop_nested(('db',), None)
+        if new_db_url and new_db_url != existing_db_url:
+            raise ValueError('Cannot change db url while server is running')
         if existing_db_url:
-            new_db_url = config.get_nested(('db',), None)
-            if new_db_url and new_db_url != existing_db_url:
-                raise ValueError('Cannot change db url while server is running')
             with _DB_USE_LOCK:
                 sqlalchemy_engine = sqlalchemy.create_engine(existing_db_url,
                                                              poolclass=NullPool)
@@ -869,7 +873,6 @@ def update_api_server_config_no_lock(config: config_utils.Config) -> None:
                 def _set_config_yaml_to_db(key: str,
                                            config: config_utils.Config):
                     assert sqlalchemy_engine is not None
-                    config.pop_nested(('db',), None)
                     config_str = common_utils.dump_yaml_str(dict(config))
                     with orm.Session(sqlalchemy_engine) as session:
                         if (sqlalchemy_engine.dialect.name ==

sky/task.py

@@ -256,6 +256,7 @@ class Task:
         file_mounts_mapping: Optional[Dict[str, str]] = None,
         volume_mounts: Optional[List[volume_lib.VolumeMount]] = None,
         metadata: Optional[Dict[str, Any]] = None,
+        _user_specified_yaml: Optional[str] = None,
     ):
         """Initializes a Task.
 
@@ -381,6 +382,8 @@ class Task:
         if dag is not None:
             dag.add(self)
 
+        self._user_specified_yaml = _user_specified_yaml
+
     def validate(self,
                  skip_file_mounts: bool = False,
                  skip_workdir: bool = False):
@@ -525,6 +528,8 @@ class Task:
         env_overrides: Optional[List[Tuple[str, str]]] = None,
         secrets_overrides: Optional[List[Tuple[str, str]]] = None,
     ) -> 'Task':
+        user_specified_yaml = config.pop('_user_specified_yaml',
+                                         common_utils.dump_yaml_str(config))
         # More robust handling for 'envs': explicitly convert keys and values to
         # str, since users may pass '123' as keys/values which will get parsed
         # as int causing validate_schema() to fail.
@@ -590,19 +595,23 @@ class Task:
 
         # Fill in any Task.envs into file_mounts (src/dst paths, storage
         # name/source).
+        env_vars = config.get('envs', {})
+        secrets = config.get('secrets', {})
+        env_and_secrets = env_vars.copy()
+        env_and_secrets.update(secrets)
         if config.get('file_mounts') is not None:
             config['file_mounts'] = _fill_in_env_vars(config['file_mounts'],
-                                                      config.get('envs', {}))
+                                                      env_and_secrets)
 
         # Fill in any Task.envs into service (e.g. MODEL_NAME).
         if config.get('service') is not None:
             config['service'] = _fill_in_env_vars(config['service'],
-                                                  config.get('envs', {}))
+                                                  env_and_secrets)
 
         # Fill in any Task.envs into workdir
         if config.get('workdir') is not None:
             config['workdir'] = _fill_in_env_vars(config['workdir'],
-                                                  config.get('envs', {}))
+                                                  env_and_secrets)
 
         task = Task(
             config.pop('name', None),
@@ -616,6 +625,7 @@ class Task:
             file_mounts_mapping=config.pop('file_mounts_mapping', None),
             volumes=config.pop('volumes', None),
             metadata=config.pop('_metadata', None),
+            _user_specified_yaml=user_specified_yaml,
         )
 
         # Create lists to store storage objects inlined in file_mounts.
@@ -736,9 +746,19 @@ class Task:
         task.set_resources(sky.Resources.from_yaml_config(resources_config))
 
         service = config.pop('service', None)
+        pool = config.pop('pool', None)
+        if service is not None and pool is not None:
+            with ux_utils.print_exception_no_traceback():
+                raise ValueError(
+                    'Cannot set both service and pool in the same task.')
+
         if service is not None:
             service = service_spec.SkyServiceSpec.from_yaml_config(service)
-        task.set_service(service)
+            task.set_service(service)
+        elif pool is not None:
+            pool['pool'] = True
+            pool = service_spec.SkyServiceSpec.from_yaml_config(pool)
+            task.set_service(pool)
 
         volume_mounts = config.pop('volume_mounts', None)
         if volume_mounts is not None:
@@ -773,7 +793,8 @@ class Task:
             # TODO(zongheng): use
             #  https://github.com/yaml/pyyaml/issues/165#issuecomment-430074049
             # to raise errors on duplicate keys.
-            config = yaml.safe_load(f)
+            user_specified_yaml = f.read()
+            config = yaml.safe_load(user_specified_yaml)
 
         if isinstance(config, str):
             with ux_utils.print_exception_no_traceback():
@@ -782,6 +803,7 @@ class Task:
 
         if config is None:
             config = {}
+        config['_user_specified_yaml'] = user_specified_yaml
         return Task.from_yaml_config(config)
 
     def resolve_and_validate_volumes(self) -> None:
@@ -1537,11 +1559,22 @@ class Task:
                 d[k] = v
         return d
 
-    def to_yaml_config(self, redact_secrets: bool = False) -> Dict[str, Any]:
+    def to_yaml_config(self,
+                       use_user_specified_yaml: bool = False) -> Dict[str, Any]:
         """Returns a yaml-style dict representation of the task.
 
         INTERNAL: this method is internal-facing.
         """
+        if use_user_specified_yaml:
+            if self._user_specified_yaml is None:
+                return self._to_yaml_config(redact_secrets=True)
+            config = yaml.safe_load(self._user_specified_yaml)
+            if config.get('secrets') is not None:
+                config['secrets'] = {k: '<redacted>' for k in config['secrets']}
+            return config
+        return self._to_yaml_config()
+
+    def _to_yaml_config(self, redact_secrets: bool = False) -> Dict[str, Any]:
         config = {}
 
         def add_if_not_none(key, value, no_empty: bool = False):
@@ -1586,13 +1619,9 @@ class Task:
         # Add envs without redaction
         add_if_not_none('envs', self.envs, no_empty=True)
 
-        # Add secrets with redaction if requested
         secrets = self.secrets
         if secrets and redact_secrets:
-            secrets = {
-                k: '<redacted>' if isinstance(v, str) else v
-                for k, v in secrets.items()
-            }
+            secrets = {k: '<redacted>' for k in secrets}
         add_if_not_none('secrets', secrets, no_empty=True)
 
         add_if_not_none('file_mounts', {})
@@ -1615,6 +1644,7 @@ class Task:
             ]
         # we manually check if its empty to not clog up the generated yaml
         add_if_not_none('_metadata', self._metadata if self._metadata else None)
+        add_if_not_none('_user_specified_yaml', self._user_specified_yaml)
         return config
 
     def get_required_cloud_features(

sky/templates/jobs-controller.yaml.j2

@@ -57,6 +57,9 @@ run: |
     --job-id $SKYPILOT_INTERNAL_JOB_ID \
     {%- endif %}
     --env-file {{remote_env_file_path}} \
+    {%- if pool is not none %}
+    --pool {{pool}} \
+    {%- endif %}
     --priority {{priority}}
 
 

sky/templates/sky-serve-controller.yaml.j2

@@ -45,13 +45,29 @@ file_mounts:
 run: |
   # Activate the Python environment, so that cloud SDKs can be found in the
   # PATH.
+  {%- if consolidation_mode_job_id is none %}
   {{ sky_activate_python_env }}
+  {%- endif %}
   # Start sky serve service.
-  python -u -m sky.serve.service \
+  {%- if consolidation_mode_job_id is not none %}
+  {{sky_python_cmd}} \
+  {%- else %}
+  python \
+  {%- endif %}
+   -u -m sky.serve.service \
     --service-name {{service_name}} \
     --task-yaml {{remote_task_yaml_path}} \
+    {%- if consolidation_mode_job_id is not none %}
+    --job-id {{consolidation_mode_job_id}} \
+    {%- else %}
     --job-id $SKYPILOT_INTERNAL_JOB_ID \
-    >> {{controller_log_file}} 2>&1
+    {%- endif %}
+    >> {{controller_log_file}} 2>&1 \
+    {%- if consolidation_mode_job_id is not none %}
+    &
+    {%- endif %}
+    # For consolidation mode, we need to run the service in the background so
+    # that it can immediately return in serve.core.up().
 
 envs:
 {%- for env_name, env_value in controller_envs.items() %}

sky/users/server.py

@@ -414,7 +414,7 @@ async def get_service_account_tokens(
 
 def _generate_service_account_user_id() -> str:
     """Generate a unique user ID for a service account."""
-    random_suffix = secrets.token_hex(16)  # 16 character hex string
+    random_suffix = secrets.token_hex(8)  # 16 character hex string
     service_account_id = (f'sa-{random_suffix}')
     return service_account_id