AWS network prerequisites¶
qumulo_filesystem_aws deploys into an existing VPC. The provider creates no VPC, subnet, route, or endpoint.
Checklist¶
| Requirement | Applies to | Details |
|---|---|---|
| S3 gateway VPC endpoint | Every deployment | Service com.amazonaws.<region>.s3, type Gateway, associated with the route table of every subnet in subnet_ids. The provisioner stops with Missing S3 gateway! when it is absent. |
| Outbound internet access | Unless air_gapped = true |
A 0.0.0.0/0 route from every subnet in subnet_ids to a NAT gateway (private subnet, recommended) or an internet gateway (public subnet). The cluster reaches Qumulo Nexus and MissionQ, and nodes download operating system packages, over this route. Cluster nodes keep their Nexus connection to api.nexus.qumulo.com on TCP 443, so a firewall or proxy that filters egress by name must allow that host. For an isolated subnet, see Deploy a cluster into an air-gapped subnet. |
| One VPC | Every deployment | Every subnet in subnet_ids belongs to the same VPC. vpc_id is derived from the subnets when omitted. |
| Distinct availability zones | Multi-AZ deployments | Each subnet in subnet_ids is in a different availability zone. |
| IPv6 (dualstack) subnet | floating_ip_count_ipv6 greater than 0 |
The subnet is IPv6-enabled, and the VPC has an IPv6 CIDR block. |
| Security groups in the VPC owner account | Subnets shared from another AWS account | See AWS Cross-Account VPC. |
Subnet rules per topology¶
| Topology | subnet_ids |
node_count |
Floating IPs |
|---|---|---|---|
| Single-AZ | Exactly 1 subnet | 1, or 3 to 24 | Supported |
| Multi-AZ | 3 or more subnets, one per availability zone | 3, or 5 to 24 | Not configured, with a plan warning |
Two subnets are rejected at plan time.
Security group rules the provider creates¶
These rules apply unless cluster_security_group_id and provisioner_security_group_id are set.
| Security group | Direction | Protocol and ports | Source or destination |
|---|---|---|---|
| Cluster | Ingress | TCP 21, 22, 53, 111, 443, 445, 2049, 3712, 3713, 5201, 8000, 9000 | allow_cidrs |
| Cluster | Ingress | UDP 53, 111, 2049, 5201 | allow_cidrs |
| Cluster | Ingress | All traffic | The cluster security group itself |
| Cluster | Ingress | TCP 443, 8000 | The provisioner security group |
| Cluster | Egress | All traffic | 0.0.0.0/0 |
| Provisioner | Ingress | TCP 22, 443 | allow_cidrs |
| Provisioner | Egress | All traffic | 0.0.0.0/0 |
With an IPv6 floating pool (floating_ip_count_ipv6 greater than 0), the allow_cidrs rules also admit the IPv6 entries in allow_cidrs, or the VPC's IPv6 CIDR when there are none. Both groups then add egress to ::/0.
Additional groups listed in additional_security_group_ids attach to the cluster nodes alongside the cluster security group.