Vast.ai Enterprise RBAC
Overview
Control access to Vast.ai GPU instances and spending through API key management, team-level budgets, and GPU allocation policies. Vast.ai uses a marketplace model with per-GPU-hour pricing (RTX 4090 ~$0.20/hr, A100 ~$1.50/hr, H100 ~$3.00/hr).
Prerequisites
- Vast.ai account(s) with API keys
- Understanding of team GPU usage patterns
- Budget allocation per team/project
Instructions
Step 1: Team API Key Strategy
# Separate API keys per team for billing isolation
# Option A: Separate Vast.ai accounts per team
# Option B: Single account with application-level controls
TEAM_CONFIGS = {
"ml-research": {
"api_key_env": "VASTAI_KEY_RESEARCH",
"gpu_whitelist": ["A100", "H100_SXM"],
"max_instances": 8,
"daily_budget": 200.00,
"max_dph": 4.00,
},
"ml-engineering": {
"api_key_env": "VASTAI_KEY_ENGINEERING",
"gpu_whitelist": ["RTX_4090", "A100"],
"max_instances": 4,
"daily_budget": 50.00,
"max_dph": 2.00,
},
"data-science": {
"api_key_env": "VASTAI_KEY_DATASCIENCE",
"gpu_whitelist": ["RTX_4090", "RTX_3090"],
"max_instances": 2,
"daily_budget": 10.00,
"max_dph": 0.30,
},
}
Step 2: Policy Enforcement Layer
class VastPolicyEnforcer:
def __init__(self, team_config):
self.config = team_config
self.client = VastClient(api_key=os.environ[team_config["api_key_env"]])
def can_provision(self, gpu_name, num_gpus=1):
"""Check if provisioning is allowed by team policy."""
if gpu_name not in self.config["gpu_whitelist"]:
return False, f"GPU {gpu_name} not in team whitelist"
running = len([i for i in self.client.show_instances()
if i.get("actual_status") == "running"])
if running >= self.config["max_instances"]:
return False, f"Instance limit reached ({running}/{self.config['max_instances']})"
return True, "OK"
def provision_with_policy(self, gpu_name, image, disk_gb=20):
allowed, reason = self.can_provision(gpu_name)
if not allowed:
raise PermissionError(f"Policy violation: {reason}")
offers = self.client.search_offers({
"gpu_name": {"eq": gpu_name},
"dph_total": {"lte": self.config["max_dph"]},
"reliability2": {"gte": 0.95},
"rentable": {"eq": True},
})
if not offers.get("offers"):
raise RuntimeError("No offers matching policy constraints")
return self.client.create_instance(
offers["offers"][0]["id"], image, disk_gb)
