Claude Code mit eigenem Modell auf EU-Kubernetes: die Kette steht

terraform {
  required_version = ">= 1.8"
  required_providers {
    ovh = {
      source  = "ovh/ovh"
      version = "~> 2.0"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 3.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.30"
    }
  }

  # Clientseitige State-Verschlüsselung (OpenTofu ab 1.7): der Kubeconfig
  # des Clusters landet im State, auch im lokalen. Passphrase via
  # TF_VAR_state_passphrase setzen.
  encryption {
    key_provider "pbkdf2" "passphrase" {
      passphrase = var.state_passphrase
    }
    method "aes_gcm" "default" {
      keys = key_provider.pbkdf2.passphrase
    }
    state {
      method   = method.aes_gcm.default
      enforced = true
    }
    plan {
      method   = method.aes_gcm.default
      enforced = true
    }
  }
}

# Authentifizierung via Umgebungsvariablen (erzeugt über
# https://api.ovh.com/createToken/ oder als IAM Service Account):
#   OVH_APPLICATION_KEY, OVH_APPLICATION_SECRET, OVH_CONSUMER_KEY
provider "ovh" {
  endpoint = "ovh-eu"
}

variable "service_name" {
  type        = string
  description = "ID des Public-Cloud-Projekts (OVHcloud Manager -> Public Cloud -> Projekt-ID)"
}

variable "region" {
  type        = string
  description = "MKS-Region; GPU-Flavor-Verfügbarkeit vorab im Manager pruefen"
  default     = "GRA11"
}

variable "gpu_flavor" {
  type        = string
  description = "GPU-Flavor des Worker-Pools; exakten Namen gegen die Region pruefen"
  default     = "l4-90"
}

variable "gpu_node_count" {
  type        = number
  description = "Anzahl GPU-Nodes; 0 = Pool geparkt, es fallen keine GPU-Kosten an"
  default     = 1
}

variable "system_node_count" {
  type        = number
  description = "Anzahl System-Nodes; 0 = Cluster komplett heruntergefahren, nur Control Plane (kostenlos) und PVC bleiben"
  default     = 1
}

variable "state_passphrase" {
  type        = string
  description = "Passphrase fuer die State-Verschluesselung (TF_VAR_state_passphrase)"
  sensitive   = true
}

# Managed-Kubernetes-Cluster; die Control Plane ist bei OVHcloud kostenlos.
resource "ovh_cloud_project_kube" "gpu_lab" {
  service_name = var.service_name
  name         = "gpu-lab"
  region       = var.region
}

# Kleiner Pool fuer System-Workloads (GPU Operator, CoreDNS etc.),
# damit die teure GPU-Maschine keine Infrastruktur-Pods traegt.
resource "ovh_cloud_project_kube_nodepool" "system" {
  service_name  = var.service_name
  kube_id       = ovh_cloud_project_kube.gpu_lab.id
  name          = "system"
  flavor_name   = "b3-8"
  desired_nodes = var.system_node_count
  min_nodes     = 0
  max_nodes     = 1
}

# GPU-Pool, stundenbasiert abgerechnet. Parken nach der Session:
#   tofu apply -var gpu_node_count=0
resource "ovh_cloud_project_kube_nodepool" "gpu" {
  service_name   = var.service_name
  kube_id        = ovh_cloud_project_kube.gpu_lab.id
  name           = "gpu"
  flavor_name    = var.gpu_flavor
  desired_nodes  = var.gpu_node_count
  min_nodes      = 0
  max_nodes      = 2
  monthly_billed = false
}

# Helm spricht direkt mit dem frisch erzeugten Cluster; die Zugangsdaten
# kommen aus dem Kube-Ressource-Attribut, kein kubeconfig-Export noetig.
provider "helm" {
  kubernetes = {
    host                   = ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].host
    cluster_ca_certificate = base64decode(ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].cluster_ca_certificate)
    client_certificate     = base64decode(ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].client_certificate)
    client_key             = base64decode(ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].client_key)
  }
}

# GPU Operator: bringt Treiber, Container-Toolkit und Device-Plugin auf die
# GPU-Nodes; danach ist nvidia.com/gpu als Ressource allokierbar. Er laeuft
# auf dem System-Pool und reagiert auf GPU-Nodes, sobald welche da sind,
# deshalb reicht der System-Pool als Abhaengigkeit.
resource "helm_release" "gpu_operator" {
  name             = "gpu-operator"
  repository       = "https://helm.ngc.nvidia.com/nvidia"
  chart            = "gpu-operator"
  namespace        = "gpu-operator"
  create_namespace = true
  wait             = true
  timeout          = 900

  depends_on = [ovh_cloud_project_kube_nodepool.system]
}

# Gleiche Zugangsdaten wie der Helm-Provider, fuer die vLLM-Ressourcen.
provider "kubernetes" {
  host                   = ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].host
  cluster_ca_certificate = base64decode(ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].cluster_ca_certificate)
  client_certificate     = base64decode(ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].client_certificate)
  client_key             = base64decode(ovh_cloud_project_kube.gpu_lab.kubeconfig_attributes[0].client_key)
}

variable "vllm_model" {
  type        = string
  description = "Hugging-Face-Modell fuer vLLM; AWQ-4-bit passt mit ~16 GB auf die L4"
  default     = "QuantTrio/Qwen3-Coder-30B-A3B-Instruct-AWQ"
}

variable "vllm_served_model_name" {
  type        = string
  description = "Modellname, unter dem die OpenAI-kompatible API das Modell meldet"
  default     = "qwen3-coder"
}

resource "kubernetes_namespace" "vllm" {
  metadata {
    name = "vllm"
  }
}

# Persistenter Hugging-Face-Cache: ohne ihn laedt jeder Pod-Start die
# ~15 GB Modellgewichte neu aus dem Netz.
resource "kubernetes_persistent_volume_claim" "hf_cache" {
  metadata {
    name      = "hf-cache"
    namespace = kubernetes_namespace.vllm.metadata[0].name
  }
  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = {
        storage = "50Gi"
      }
    }
  }

  # Cinder bindet Volumes erst, wenn ein Pod sie nutzt (WaitForFirstConsumer).
  wait_until_bound = false
}

# vLLM hostet das Modell als OpenAI-kompatible API auf Port 8000.
# Qwen3-Coder-30B-A3B (MoE, 3,3B aktiv): auf der bandbreitenschwachen L4
# deutlich schneller als ein dichtes 14B-Modell; AWQ-Gewichte ~16 GB plus
# FP8-KV-Cache ergeben 56k Token Kontext auf 24 GB VRAM (57344 = das
# Claude-Code-Budget aus 49152 Auto-Compact-Fenster + 8192 Output).
# CUDA-Graphs nur fuer Batch 1-8: volle Dekodier-Geschwindigkeit fuer
# den Einzelnutzer-Betrieb, aber ein Bruchteil des VRAM der
# Standard-Capture-Liste (die bis Batch 512 reicht). Der Parser
# qwen3_coder uebersetzt das Function-Call-Format des Modells; beides
# braucht die Anbindung an Claude Code (LiteLLM-Proxy).
resource "kubernetes_deployment" "vllm" {
  metadata {
    name      = "vllm"
    namespace = kubernetes_namespace.vllm.metadata[0].name
    labels = {
      app = "vllm"
    }
  }
  spec {
    replicas = 1

    # Nur eine GPU im Pool: alter Pod muss weichen, bevor der neue startet.
    strategy {
      type = "Recreate"
    }
    selector {
      match_labels = {
        app = "vllm"
      }
    }
    template {
      metadata {
        labels = {
          app = "vllm"
        }
      }
      spec {
        # Kubernetes wuerde sonst VLLM_PORT=tcp://... aus dem Service "vllm"
        # injizieren, was vLLM als eigene (kaputte) Konfiguration liest.
        enable_service_links = false

        container {
          name  = "vllm"
          image = "vllm/vllm-openai:latest"
          args = [
            "--model", var.vllm_model,
            "--served-model-name", var.vllm_served_model_name,
            "--max-model-len", "57344",
            "--kv-cache-dtype", "fp8",
            "--gpu-memory-utilization", "0.93",
            "--max-num-seqs", "8",
            "--compilation-config", "{\"cudagraph_capture_sizes\": [1, 2, 4, 8]}",
            "--enable-auto-tool-choice",
            "--tool-call-parser", "qwen3_coder",
          ]
          env {
            name  = "HF_HOME"
            value = "/root/.cache/huggingface"
          }
          port {
            container_port = 8000
          }
          resources {
            requests = {
              cpu              = "4"
              memory           = "16Gi"
              "nvidia.com/gpu" = "1"
            }
            limits = {
              memory           = "48Gi"
              "nvidia.com/gpu" = "1"
            }
          }
          volume_mount {
            name       = "hf-cache"
            mount_path = "/root/.cache/huggingface"
          }
          volume_mount {
            name       = "shm"
            mount_path = "/dev/shm"
          }

          # Erster Start laedt die Gewichte herunter; grosszuegig warten.
          startup_probe {
            http_get {
              path = "/health"
              port = 8000
            }
            period_seconds    = 15
            failure_threshold = 80
          }
          readiness_probe {
            http_get {
              path = "/health"
              port = 8000
            }
            period_seconds = 10
          }
        }
        volume {
          name = "hf-cache"
          persistent_volume_claim {
            claim_name = kubernetes_persistent_volume_claim.hf_cache.metadata[0].name
          }
        }
        volume {
          name = "shm"
          empty_dir {
            medium     = "Memory"
            size_limit = "2Gi"
          }
        }
      }
    }
  }

  # Nicht auf den Rollout warten: bei geparktem GPU-Pool (gpu_node_count=0)
  # bleibt der Pod absichtlich Pending und apply soll trotzdem durchlaufen.
  wait_for_rollout = false

  depends_on = [helm_release.gpu_operator]
}

resource "kubernetes_service" "vllm" {
  metadata {
    name      = "vllm"
    namespace = kubernetes_namespace.vllm.metadata[0].name
  }
  spec {
    selector = {
      app = "vllm"
    }
    port {
      port        = 8000
      target_port = 8000
    }
  }
}

# LiteLLM-Proxy: uebersetzt die Anthropic Messages API (/v1/messages), die
# Claude Code spricht, auf die OpenAI-API von vLLM. Zugriff nur per
# Port-Forward, deshalb bewusst ohne Master-Key; sobald der Proxy je
# oeffentlich exponiert wird, braucht er Authentifizierung.
resource "kubernetes_config_map" "litellm" {
  metadata {
    name      = "litellm-config"
    namespace = kubernetes_namespace.vllm.metadata[0].name
  }
  data = {
    "config.yaml" = yamlencode({
      model_list = [
        {
          model_name = var.vllm_served_model_name
          litellm_params = {
            model    = "hosted_vllm/${var.vllm_served_model_name}"
            api_base = "http://vllm.${kubernetes_namespace.vllm.metadata[0].name}.svc.cluster.local:8000/v1"
          }
        }
      ]
    })
  }
}

resource "kubernetes_deployment" "litellm" {
  metadata {
    name      = "litellm"
    namespace = kubernetes_namespace.vllm.metadata[0].name
    labels = {
      app = "litellm"
    }
  }
  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "litellm"
      }
    }
    template {
      metadata {
        labels = {
          app = "litellm"
        }
        annotations = {
          # Pod bei Config-Aenderung neu ausrollen; der Kubernetes-Provider
          # macht das nicht von selbst.
          "checksum/config" = sha256(kubernetes_config_map.litellm.data["config.yaml"])
        }
      }
      spec {
        # Gleiche Falle wie bei vLLM: der Service "litellm" wuerde sonst
        # LITELLM_*-Umgebungsvariablen injizieren.
        enable_service_links = false

        container {
          name  = "litellm"
          image = "ghcr.io/berriai/litellm:main-stable"
          args  = ["--config", "/etc/litellm/config.yaml", "--port", "4000"]
          port {
            container_port = 4000
          }
          resources {
            requests = {
              cpu    = "250m"
              memory = "1Gi"
            }
            # Das LiteLLM-Image braucht beim Start deutlich mehr als 1 Gi,
            # darunter wird der Pod OOMKilled.
            limits = {
              memory = "2Gi"
            }
          }
          volume_mount {
            name       = "config"
            mount_path = "/etc/litellm"
            read_only  = true
          }
          readiness_probe {
            http_get {
              path = "/health/readiness"
              port = 4000
            }
            period_seconds = 10
          }
        }
        volume {
          name = "config"
          config_map {
            name = kubernetes_config_map.litellm.metadata[0].name
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "litellm" {
  metadata {
    name      = "litellm"
    namespace = kubernetes_namespace.vllm.metadata[0].name
  }
  spec {
    selector = {
      app = "litellm"
    }
    port {
      port        = 4000
      target_port = 4000
    }
  }
}

output "kubeconfig" {
  description = "Kubeconfig des Clusters; abrufen mit: tofu output -raw kubeconfig > gpu-lab-kubeconfig.yaml"
  value       = ovh_cloud_project_kube.gpu_lab.kubeconfig
  sensitive   = true
}