AWS network prerequisites¶
qumulo_filesystem_aws deploys into an existing VPC. The provider creates no VPC, subnet, route, or endpoint.
Checklist¶
| Requirement | Applies to | Details |
|---|---|---|
| S3 gateway VPC endpoint | Every deployment | Service com.amazonaws.<region>.s3, type Gateway, associated with the route table of every subnet in subnet_ids. The provisioner stops with Missing S3 gateway! when it is absent. |
| Outbound internet access | Every deployment | A 0.0.0.0/0 route from every subnet in subnet_ids to a NAT gateway (private subnet, recommended) or an internet gateway (public subnet). Cluster nodes and the provisioner download images and register the cluster over this route. |
| One VPC | Every deployment | Every subnet in subnet_ids belongs to the same VPC. vpc_id is derived from the subnets when omitted. |
| Distinct availability zones | Multi-AZ deployments | Each subnet in subnet_ids is in a different availability zone. |
| IPv6 (dualstack) subnet | floating_ip_count_ipv6 greater than 0 |
The subnet is IPv6-enabled, and the VPC has an IPv6 CIDR block. |
| Security groups in the VPC owner account | Subnets shared from another AWS account | See AWS Cross-Account VPC. |
Subnet rules per topology¶
| Topology | subnet_ids |
node_count |
Floating IPs |
|---|---|---|---|
| Single-AZ | Exactly 1 subnet | 1, or 3 to 24 | Supported |
| Multi-AZ | 3 or more subnets, one per availability zone | 3, or 5 to 24 | Not configured, with a plan warning |
Two subnets are rejected at plan time.
Security group rules the provider creates¶
These rules apply unless cluster_security_group_id and provisioner_security_group_id are set.
| Security group | Direction | Protocol and ports | Source or destination |
|---|---|---|---|
| Cluster | Ingress | TCP 21, 22, 53, 111, 443, 445, 2049, 3712, 3713, 5201, 8000, 9000 | allow_cidrs |
| Cluster | Ingress | UDP 53, 111, 2049, 5201 | allow_cidrs |
| Cluster | Ingress | All traffic | The cluster security group itself |
| Cluster | Ingress | TCP 443, 8000 | The provisioner security group |
| Cluster | Egress | All traffic | 0.0.0.0/0 |
| Provisioner | Ingress | TCP 22, 443 | allow_cidrs |
| Provisioner | Egress | All traffic | 0.0.0.0/0 |
With an IPv6 floating pool (floating_ip_count_ipv6 greater than 0), the allow_cidrs rules also admit the IPv6 entries in allow_cidrs, or the VPC's IPv6 CIDR when there are none. Both groups then add egress to ::/0.
Additional groups listed in additional_security_group_ids attach to the cluster nodes alongside the cluster security group.