W4118

GCP VM Setup

Before you begin

1. In the Google Cloud Console, select an existing Google Cloud project or create a new one. If you create a new project, follow the prompts to finish setting it up.

2. Verify that billing is enabled for your Google Cloud project.

3. Check your roles on the project:

   • In the Google Cloud Console, go to the IAM page.
   • Select your project.
   • In the Principal column, find all rows that identify you or a group that you are included in.
   • For all rows that specify or include you, check the Role column.

   If you are the project Owner, you already have the necessary permissions and do not need any additional roles assigned.

   Otherwise, make sure that you have the following roles:

   • Compute Instance Admin (v1)
   • Compute Security Admin
   • OSPolicyAssignment Admin
   • Service Account User
   • Service Usage Admin

1. Create the VM

In the Google Cloud Console, go to Compute Engine → VM instances, then click Create VM.

IMPORTANT: Unless specified below, leave all settings at their defaults.

Now we will configure the VM’s machine, OS, and storage.

Machine configuration

In the left navigation menu, select Machine configuration and configure:

• Region: us-central1 (Iowa)
• Zone: Any
• Series: N4A (Google Axion)
• Machine type: n4a-standard-4 (4 vCPUs, 16 GB memory)
• Provisioning model: Standard

Why N4A-standard-4? N4A-standard-4 provides four Google Axion Arm cores and enough memory to compile the kernel efficiently.

OS and storage

In the left navigation menu, select OS and storage. Under Operating system and storage, click Change and configure the boot disk:

• Operating system: Ubuntu
• Version: Ubuntu 26.04 LTS (not Minimal) for ARM
• Size: 100 GB
• Provisioned IOPS: 3000
• Provisioned throughput: 140 MB/s

Click Select to save the boot disk configuration.

At the bottom of the page, click Create.

Wait a couple of minutes for the VM to be created, then check Notifications in the upper-right corner of the Google Cloud Console.

If there is an error indicating that N4A machines are unavailable in the selected zone, edit the VM configuration and try another zone in us-central1. If no Iowa zones have N4A capacity available, change the region to us-west1 (Oregon) and try a zone there.

2. Configure internet access

The VM cannot have an external IP because of the organization policy. It therefore needs Cloud NAT to access Ubuntu repositories and Git.

In the Google Cloud Console, use the search bar at the top of the page to search for Network services and open it. In the left navigation menu, click Cloud NAT.

1. Click Get started or Create Cloud NAT gateway.

2. Configure:

   • Gateway name: os-vm-nat
   • NAT type: Public
   • Network: The VM’s network
   • Region: The same region as the VM. For example, if the VM is in us-west1-c, select us-west1.

3. Create a Cloud Router in the same region as the VM:

   • Name: os-vm-router
   • Leave other settings at their defaults.

4. Under Cloud NAT mapping, configure:

   • Source endpoint type: VM instances, GKE nodes, Serverless
   • Source IP version: IPv4
   • Source subnets: Custom
   • Subnetwork: The VM’s subnet
   • IP ranges: Primary IP ranges

5. Configure:

   • Cloud NAT IP addresses: Automatic
   • Network Service Tier: Standard

6. Leave all other settings at their defaults and click Create.

7. Wait one to three minutes for the configuration to take effect.

Why Cloud NAT? It provides outbound internet access for package and source-code downloads without exposing the VM directly to inbound internet traffic. Do not enable Allow HTTP traffic or Allow HTTPS traffic.

3. Fix sudo on Ubuntu 26.04

In the Google Cloud Console, click Compute Engine in the left navigation menu. In the menu that opens, click VM instances.

Find your VM and click SSH to open a terminal connected to it.

All commands below should be run inside this VM.

Ubuntu 26.04 uses the Rust-based sudo-rs by default. It may fail to recognize the sudo permissions generated by GCP OS Login.

Switch to the traditional sudo implementation:

/usr/bin/sudo.ws update-alternatives --set sudo /usr/bin/sudo.ws

Verify it:

sudo whoami

The result should be:

root

Why is this necessary? The account can have valid GCP administrative permissions while sudo-rs still rejects commands with I'm afraid I can't do that. The traditional sudo.ws correctly reads GCP’s generated sudo configuration.

4. Install development tools

Continue running the following commands inside the VM.

The image ships without a compiler or make. Install the basics you need for the homework assignments:

sudo apt update && sudo apt install -y build-essential git

If apt update hangs or cannot connect, your Cloud NAT is likely misconfigured: check that its region matches your VM’s region (§2), or wait a few minutes if you just created it.

Each assignment lists any additional packages it needs.