hackathon-gpu/vm.tf at main · Instalily/hackathon-gpu · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
# --- Service account ---

resource "google_service_account" "team" {
  account_id   = "hackathon-${var.team_name}"
  display_name = "Hackathon SA - ${var.team_name}"
  project      = var.project_id

  depends_on = [google_project_service.apis]
}

locals {
  team_roles = [
    "roles/logging.logWriter",
    "roles/monitoring.metricWriter",
  ]
  reservation_name = "${var.reservation_prefix}-${replace(var.zone, "-", "")}"
}

resource "google_project_iam_member" "team_roles" {
  for_each = toset(local.team_roles)

  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.team.email}"
}

# --- Per-team GCS bucket ---

resource "google_storage_bucket" "team_data" {
  name                        = "${var.project_id}-${var.team_name}"
  location                    = var.region
  project                     = var.project_id
  uniform_bucket_level_access = true
  force_destroy               = true

  versioning {
    enabled = true
  }

  depends_on = [google_project_service.apis]
}

resource "google_storage_bucket_iam_member" "team_data_admin" {
  bucket = google_storage_bucket.team_data.name
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.team.email}"
}

# --- Per-team firewall rule (isolates teams from each other) ---

resource "google_compute_firewall" "team_internal" {
  name    = "hackathon-internal-${var.team_name}"
  network = data.google_compute_network.hackathon.self_link
  project = var.project_id

  allow {
    protocol = "tcp"
  }

  allow {
    protocol = "udp"
  }

  allow {
    protocol = "icmp"
  }

  source_tags = [var.team_name]
  target_tags = [var.team_name]

  depends_on = [google_project_service.apis]
}

# --- Static external IP ---

resource "google_compute_address" "team" {
  name    = "hackathon-ip-${var.team_name}"
  region  = var.region
  project = var.project_id

  depends_on = [google_project_service.apis]
}

# --- GPU VM ---

resource "google_compute_instance" "team" {
  name         = "hackathon-vm-${var.team_name}"
  machine_type = var.machine_type
  zone         = var.zone
  project      = var.project_id

  boot_disk {
    initialize_params {
      image = "projects/deeplearning-platform-release/global/images/family/pytorch-2-7-cu128-ubuntu-2204-nvidia-570"
      size  = 200
      type  = "hyperdisk-balanced"
    }
  }

  network_interface {
    network    = data.google_compute_network.hackathon.self_link
    subnetwork = data.google_compute_subnetwork.hackathon.self_link

    access_config {
      nat_ip = google_compute_address.team.address
    }
  }

  guest_accelerator {
    type  = "nvidia-rtx-pro-6000"
    count = 1
  }

  scheduling {
    on_host_maintenance = "TERMINATE"
    automatic_restart   = true
  }

  reservation_affinity {
    type = "SPECIFIC_RESERVATION"
    specific_reservation {
      key    = "compute.googleapis.com/reservation-name"
      values = [local.reservation_name]
    }
  }

  service_account {
    email  = google_service_account.team.email
    scopes = [
      "https://www.googleapis.com/auth/devstorage.read_write",
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring.write",
    ]
  }

  metadata = {
    install-nvidia-driver = "True"
    startup-script        = "iptables -A OUTPUT -d 169.254.169.254 -m owner ! --uid-owner root -j REJECT"
  }

  tags = ["hackathon", var.team_name]

  labels = {
    team      = var.team_name
    hackathon = "sf-2026"
    managed   = "terraform"
  }

  depends_on = [google_project_service.apis]
}