skypilot-nightly 1.0.0.dev20250807__py3-none-any.whl → 1.0.0.dev20250812__py3-none-any.whl

sky/workspaces/core.py

@@ -1,5 +1,6 @@
 """Workspace management core."""
 
+from dataclasses import dataclass
 from typing import Any, Callable, Dict, List, Tuple
 
 import filelock
@@ -9,12 +10,14 @@ from sky import exceptions
 from sky import models
 from sky import sky_logging
 from sky import skypilot_config
+from sky.backends import backend_utils
 from sky.skylet import constants
 from sky.usage import usage_lib
 from sky.users import permission
 from sky.utils import annotations
 from sky.utils import common_utils
 from sky.utils import config_utils
+from sky.utils import locks
 from sky.utils import resource_checker
 from sky.utils import schemas
 from sky.workspaces import utils as workspaces_utils
@@ -24,6 +27,37 @@ logger = sky_logging.init_logger(__name__)
 # Lock for workspace configuration updates to prevent race conditions
 _WORKSPACE_CONFIG_LOCK_TIMEOUT_SECONDS = 60
 
+
+@dataclass
+class WorkspaceConfigComparison:
+    """Result of comparing current and new workspace configurations.
+
+    This class encapsulates the results of analyzing differences between
+    workspace configurations, particularly focusing on user access changes
+    and their implications for resource validation.
+
+    Attributes:
+        only_user_access_changes: True if only allowed_users or private changed
+        private_changed: True if private setting changed
+        private_old: Old private setting value
+        private_new: New private setting value
+        allowed_users_changed: True if allowed_users changed
+        allowed_users_old: Old allowed users list
+        allowed_users_new: New allowed users list
+        removed_users: Users removed from allowed_users
+        added_users: Users added to allowed_users
+    """
+    only_user_access_changes: bool
+    private_changed: bool
+    private_old: bool
+    private_new: bool
+    allowed_users_changed: bool
+    allowed_users_old: List[str]
+    allowed_users_new: List[str]
+    removed_users: List[str]
+    added_users: List[str]
+
+
 # =========================
 # = Workspace Management =
 # =========================
@@ -95,6 +129,153 @@ def _validate_workspace_config(workspace_name: str,
         raise ValueError(str(e)) from e
 
 
+def _compare_workspace_configs(
+    current_config: Dict[str, Any],
+    new_config: Dict[str, Any],
+) -> WorkspaceConfigComparison:
+    """Compare current and new workspace configurations.
+
+    Args:
+        current_config: The current workspace configuration.
+        new_config: The new workspace configuration.
+
+    Returns:
+        WorkspaceConfigComparison object containing the comparison results.
+    """
+    # Get private settings
+    private_old = current_config.get('private', False)
+    private_new = new_config.get('private', False)
+    private_changed = private_old != private_new
+
+    # Get allowed users (resolve to user IDs for comparison)
+    allowed_users_old = workspaces_utils.get_workspace_users(
+        current_config) if private_old else []
+    allowed_users_new = workspaces_utils.get_workspace_users(
+        new_config) if private_new else []
+
+    # Convert to sets for easier comparison
+    old_users_set = set(allowed_users_old)
+    new_users_set = set(allowed_users_new)
+
+    allowed_users_changed = old_users_set != new_users_set
+    removed_users = list(old_users_set - new_users_set)
+    added_users = list(new_users_set - old_users_set)
+
+    # Check if only user access related fields changed
+    # Create copies without the user access fields for comparison
+    current_without_access = {
+        k: v
+        for k, v in current_config.items()
+        if k not in ['private', 'allowed_users']
+    }
+    new_without_access = {
+        k: v
+        for k, v in new_config.items()
+        if k not in ['private', 'allowed_users']
+    }
+
+    only_user_access_changes = current_without_access == new_without_access
+
+    return WorkspaceConfigComparison(
+        only_user_access_changes=only_user_access_changes,
+        private_changed=private_changed,
+        private_old=private_old,
+        private_new=private_new,
+        allowed_users_changed=allowed_users_changed,
+        allowed_users_old=allowed_users_old,
+        allowed_users_new=allowed_users_new,
+        removed_users=removed_users,
+        added_users=added_users)
+
+
+def _validate_workspace_config_changes(workspace_name: str,
+                                       current_config: Dict[str, Any],
+                                       new_config: Dict[str, Any]) -> None:
+    """Validate workspace configuration changes based on active resources.
+
+    This function implements the logic:
+    - If only allowed_users or private changed:
+      - If private changed from true to false: allow it
+      - If private changed from false to true: check that all active resources
+        belong to allowed_users
+      - If private didn't change: check that removed users don't have active
+        resources
+    - Otherwise: check that workspace has no active resources
+
+    Args:
+        workspace_name: The name of the workspace.
+        current_config: The current workspace configuration.
+        new_config: The new workspace configuration.
+
+    Raises:
+        ValueError: If the configuration change is not allowed due to active
+        resources.
+    """
+    config_comparison = _compare_workspace_configs(current_config, new_config)
+
+    if config_comparison.only_user_access_changes:
+        # Only user access settings changed
+        if config_comparison.private_changed:
+            if (config_comparison.private_old and
+                    not config_comparison.private_new):
+                # Changed from private to public - always allow
+                logger.info(
+                    f'Workspace {workspace_name!r} changed from private to'
+                    f' public.')
+                return
+            elif (not config_comparison.private_old and
+                  config_comparison.private_new):
+                # Changed from public to private - check that all active
+                # resources belong to the new allowed users
+                logger.info(
+                    f'Workspace {workspace_name!r} changed from public to'
+                    f' private. Checking that all active resources belong'
+                    f' to allowed users.')
+
+                error_summary, missed_users_names = (
+                    resource_checker.check_users_workspaces_active_resources(
+                        config_comparison.allowed_users_new, [workspace_name]))
+                if error_summary:
+                    error_msg=f'Cannot change workspace {workspace_name!r}' \
+                    f' to private '
+                    if missed_users_names:
+                        missed_users_list = ', '.join(missed_users_names)
+                        if len(missed_users_names) == 1:
+                            error_msg += f'because the user ' \
+                            f'{missed_users_list!r} has {error_summary}'
+                        else:
+                            error_msg += f'because the users ' \
+                            f'{missed_users_list!r} have {error_summary}'
+                        error_msg += ' but not in the allowed_users list.' \
+                        ' Please either add the users to allowed_users or' \
+                        ' ask them to terminate their resources.'
+                    raise ValueError(error_msg)
+        else:
+            # Private setting didn't change, but allowed_users changed
+            if (config_comparison.allowed_users_changed and
+                    config_comparison.removed_users):
+                # Check that removed users don't have active resources
+                logger.info(
+                    f'Checking that removed users'
+                    f' {config_comparison.removed_users} do not have'
+                    f' active resources in workspace {workspace_name!r}.')
+                user_operations = []
+                for user_id in config_comparison.removed_users:
+                    user_operations.append((user_id, 'remove'))
+                resource_checker.check_no_active_resources_for_users(
+                    user_operations)
+    else:
+        # Other configuration changes - check that workspace has no active
+        # resources
+        logger.info(
+            f'Non-user-access configuration changes detected for'
+            f' workspace {workspace_name!r}. Checking that workspace has'
+            f' no active resources.')
+        resource_checker.check_no_active_resources_for_workspaces([
+            (workspace_name, 'update')
+        ])
+
+
 @usage_lib.entrypoint
 def update_workspace(workspace_name: str, config: Dict[str,
                                                        Any]) -> Dict[str, Any]:
@@ -109,17 +290,40 @@ def update_workspace(workspace_name: str, config: Dict[str,
 
     Raises:
         ValueError: If the workspace configuration is invalid, or if there are
-            active clusters or managed jobs in the workspace.
+            active clusters or managed jobs that prevent the configuration
+            change.
+            The validation logic depends on what changed:
+            - If only allowed_users or private changed:
+              - Private true->false: Always allowed
+              - Private false->true: All active resources must belong to
+                allowed_users
+              - allowed_users changes: Removed users must not have active
+                resources
+            - Other changes: Workspace must have no active resources
         FileNotFoundError: If the config file cannot be found.
         PermissionError: If the config file cannot be written.
     """
     _validate_workspace_config(workspace_name, config)
 
-    # Check for active clusters and managed jobs in the workspace
-    # TODO(zhwu): we should allow the edits that only contain changes to
-    # allowed_users or private.
-    resource_checker.check_no_active_resources_for_workspaces([(workspace_name,
-                                                                'update')])
+    # Get the current workspace configuration for comparison
+    current_workspaces = skypilot_config.get_nested(('workspaces',),
+                                                    default_value={})
+    current_config = current_workspaces.get(workspace_name, {})
+
+    if current_config:
+        lock_id = backend_utils.workspace_lock_id(workspace_name)
+        lock_timeout = backend_utils.WORKSPACE_LOCK_TIMEOUT_SECONDS
+        try:
+            with locks.get_lock(lock_id, lock_timeout):
+                # Validate the configuration changes based on active resources
+                _validate_workspace_config_changes(workspace_name,
+                                                   current_config, config)
+        except locks.LockTimeout as e:
+            raise RuntimeError(
+                f'Failed to validate workspace {workspace_name!r} due to '
+                'a timeout when trying to access database. Please '
+                f'try again or manually remove the lock at {lock_id}. '
+                f'{common_utils.format_exception(e)}') from None
 
     def update_workspace_fn(workspaces: Dict[str, Any]) -> None:
         """Function to update workspace inside the lock."""

{skypilot_nightly-1.0.0.dev20250807.dist-info → skypilot_nightly-1.0.0.dev20250812.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skypilot-nightly
-Version: 1.0.0.dev20250807
+Version: 1.0.0.dev20250812
 Summary: SkyPilot: Run AI on Any Infra — Unified, Faster, Cheaper.
 Author: SkyPilot Team
 License: Apache 2.0
@@ -238,7 +238,7 @@ Dynamic: summary
 ----
 
 :fire: *News* :fire:
-- [Aug 2025] Run and serve **OpenAI GPT-OSS models** (gpt-oss-120b, gpt-oss-20b) with one command on any infra: [**example**](./llm/gpt-oss/)
+- [Aug 2025] Serve and finetune **OpenAI GPT-OSS models** (gpt-oss-120b, gpt-oss-20b) with one command on any infra: [**serve**](./llm/gpt-oss/) + [**LoRA and full finetuning**](./llm/gpt-oss-finetuning/)
 - [Jul 2025] Run distributed **RL training for LLMs** with Verl (PPO, GRPO) on any cloud: [**example**](./llm/verl/)
 - [Jul 2025] 🎉 SkyPilot v0.10.0 released! [**blog post**](https://blog.skypilot.co/announcing-skypilot-0.10.0/), [**release notes**](https://github.com/skypilot-org/skypilot/releases/tag/v0.10.0)
 - [Jul 2025] Finetune **Llama4** on any distributed cluster/cloud: [**example**](./llm/llama-4-finetuning/)