This tutorial shows you how to fine-tune a Gemma 3 large language model (LLM) on a multi-node, multi-GPU GKE cluster on Google Cloud. This cluster uses an A4 virtual machine (VM) instance which has 8 NVIDIA B200 GPUs.
The two main processes described in this tutorial are as follows:
- Deploy a high-performance GKE cluster by using GKE Autopilot. As part of this deployment, you create a custom VM image with the necessary software pre-installed.
- After the cluster is deployed, you run a distributed fine-tuning job by using the set of scripts that accompany this tutorial. The job leverages the Hugging Face Accelerate library .
This tutorial is intended for machine learning (ML) engineers, researchers, platform administrators and operators, and for data and AI specialists who are interested in deploying GKE clusters on Google Cloud to train LLMs.
Objectives
-
Access the Gemma 3 model by using Hugging Face.
-
Prepare your environment.
-
Create and deploy an A4 GKE cluster.
-
Fine-tune the Gemma 3 model by using the Hugging Face Accelerate library with fully sharded data parallel (FSDP).
-
Monitor your job.
-
Clean up.
Costs
In this document, you use the following billable components of Google Cloud:
To generate a cost estimate based on your projected usage, use the pricing calculator .
Before you begin
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
Install the Google Cloud CLI.
-
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
Create or select a Google Cloud project .
Roles required to select or create a project
- Select a project : Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project
: To create a project, you need the Project Creator role
(
roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.createpermission. Learn how to grant roles .
-
Create a Google Cloud project:
gcloud projects create PROJECT_IDReplace
PROJECT_IDwith a name for the Google Cloud project you are creating. -
Select the Google Cloud project that you created:
gcloud config set project PROJECT_IDReplace
PROJECT_IDwith your Google Cloud project name.
-
Verify that billing is enabled for your Google Cloud project .
-
Enable the required APIs:
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (
roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enablepermission. Learn how to grant roles .gcloud services enable compute.googleapis.com
container.googleapis.com file.googleapis.com logging.googleapis.com cloudresourcemanager.googleapis.com servicenetworking.googleapis.com -
Install the Google Cloud CLI.
-
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
Create or select a Google Cloud project .
Roles required to select or create a project
- Select a project : Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project
: To create a project, you need the Project Creator role
(
roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.createpermission. Learn how to grant roles .
-
Create a Google Cloud project:
gcloud projects create PROJECT_IDReplace
PROJECT_IDwith a name for the Google Cloud project you are creating. -
Select the Google Cloud project that you created:
gcloud config set project PROJECT_IDReplace
PROJECT_IDwith your Google Cloud project name.
-
Verify that billing is enabled for your Google Cloud project .
-
Enable the required APIs:
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (
roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enablepermission. Learn how to grant roles .gcloud services enable compute.googleapis.com
container.googleapis.com file.googleapis.com logging.googleapis.com cloudresourcemanager.googleapis.com servicenetworking.googleapis.com -
Grant roles to your user account. Run the following command once for each of the following IAM roles:
roles/compute.admin, roles/iam.serviceAccountUser, roles/cloudbuild.builds.editor, roles/artifactregistry.admin, roles/storage.admin, roles/serviceusage.serviceUsageAdmingcloud projects add-iam-policy-binding PROJECT_ID --member = "user: USER_IDENTIFIER " --role = ROLE
Replace the following:
-
PROJECT_ID: Your project ID. -
USER_IDENTIFIER: The identifier for your user account. For example,myemail@example.com. -
ROLE: The IAM role that you grant to your user account.
-
- Enable the default service account for your Google Cloud project:
export PROJECT_NUMBER = " $( gcloud projects describe " PROJECT_ID " --format "value(project_number)" ) " gcloud iam service-accounts enable " ${ PROJECT_NUMBER } -compute@developer.gserviceaccount.com \ --project= PROJECT_ID
- Grant the Editor role (
roles/editor) to the default service account:gcloud projects add-iam-policy-binding PROJECT_ID \ --member = "serviceAccount: PROJECT_NUMBER -compute@developer.gserviceaccount.com" \ --role = roles/editor
- Create local authentication credentials for your user account:
gcloud auth application-default login
- Enable OS Login for your project:
gcloud compute project-info add-metadata --metadata = enable-oslogin = TRUE
- Sign in to or create a Hugging Face account .
Access Gemma 3 by using Hugging Face
To use Hugging Face to access Gemma 3, do the following:
- Sign in to Hugging Face
- Create a Hugging Face
writeaccess token .
Click Your Profile > Settings > Access tokens > +Create new token - Copy and save the
write accesstoken value. You use it later in this tutorial.
Prepare your environment
To prepare your environment, set the following:
Replace the following:
-
PROJECT_ID: the name of the Google Cloud project where you want to create the GKE cluster. -
RESERVATION: the identifier for your reserved capacity. -
CLUSTER_NAME: the name of the GKE cluster to create. -
CLUSTER_REGION: the region where you want to create your GKE cluster. You can only create the cluster in the region where you reservation exists. -
HF_TOKEN: the Hugging Face access token that you created in the previous section. -
ARTIFACT_REPO_LOCATION: the location where you want to create your Artifact Registry repository.
Create a GKE cluster in Autopilot mode
To create a GKE cluster in Autopilot mode, run the following command:
Creating the GKE cluster might take some time to complete. To verify that Google Cloud has finished creating your cluster, go to Kubernetes clusters on the Google Cloud console.
Create a Kubernetes secret for Hugging Face credentials
To create a Kubernetes secret for Hugging Face credentials, follow these steps:
-
Configure
kubectlto communicate with your GKE cluster: -
Create a Kubernetes secret to store your Hugging Face token:
Prepare your workload
To prepare your workload, you do the following:
Create workload scripts
To create the scripts that your fine-tuning workload uses, do the following:
-
Create a directory for the workload scripts. Use this directory as your working directory.
-
Create the
cloudbuild.yamlfile to use Google Cloud Build. This file creates your workload container and stores it in Artifact Registry: -
Create a
Dockerfilefile to execute the fine-tuning job: -
Create the
accel_fsdp_gemma3_config.yamlfile. This configuration file directs Hugging Face Accelerate to split the tuning job across multiple GPUs. -
Create the
finetune.yamlfile: -
Create the
finetune.pyfile:
Use Docker and Cloud Build to create a fine-tuning container
-
Create an Artifact Registry Docker Repository:
-
In the
llm-finetuning-gemmadirectory that you created in an earlier step, run the following command to create the fine-tuning image and push it to Artifact Registry. -
Export the image URL. You use it at a later step in this tutorial:
Start your fine-tuning workload
To start your fine-tuning workload, do the following:
-
Apply the finetune manifest to create the fine-tuning job:
Because you're using clusters in GKE Autopilot mode, it might take a few minutes to start your GPU enabled node.
-
Monitor the job by running the following command:
-
Check the logs of the job by running the following command:
The job resource downloads the model data then fine-tunes the model across all eight of the GPUs. The download takes around five minutes to complete. After the download is complete, the fine-tuning process takes approximately two hours and 30 minutes to complete.
Monitor your workload
You can monitor the use of the GPUs in your GKE cluster to verify that your fine-tuning job is efficiently running. To do so, open the following link in your browser:
When you monitor your workload, you can see the following:
- GPUs usage: for a healthy fine-tuning job, you can expect to see the usage of all of your 8 GPUs rise and stabilize to a high level throughout your training.
- Job duration: the job should take approximately 10 minutes to complete on the specified A4 cluster.
Clean up
To avoid incurring charges to your Google Cloud account for the resources used in this tutorial, either delete the project that contains the resources, or keep the project and delete the individual resources.
Delete your resources
-
To delete your fine-tuning job, run the following command:
-
To delete your GKE cluster, run the following command:
Delete your project
Delete a Google Cloud project:
gcloud projects delete PROJECT_ID

