Skip to content

Azure network prerequisites

qumulo_filesystem_azure deploys into an existing virtual network and subnet. The provider creates no virtual network, subnet, route, or service endpoint.

Checklist

Requirement Applies to Details
Existing subnet Every deployment subnet_id is the subnet's full resource ID, in the form /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}.
Free addresses Every deployment One per node, one for the provisioner VM, and one per floating IP, on top of the 5 addresses Azure reserves in every subnet.
Microsoft.Storage service endpoint Every deployment The cluster's storage accounts accept traffic only from this subnet. Without the endpoint, the apply stops with must have the "Microsoft.Storage" service endpoint enabled.
Microsoft.KeyVault service endpoint Every deployment Enabled on the same subnet as Microsoft.Storage.
Outbound internet access Every deployment The network security group the provider creates allows all outbound traffic to the Internet service tag, which the nodes and the provisioner use to download packages.
Private DNS zones linked to the virtual network When a private_link_appconfig_dns_zone_id, private_link_keyvault_dns_zone_id, or private_link_storage_dns_zone_id is set See Private endpoint DNS.
Network access from the subnet to the vault When key_vault_id is set See Bring your own Key Vault.

Service endpoint check

In the Azure portal, the service endpoints sit under Virtual networks > your virtual network > Settings > Service endpoints.

  • Microsoft.Storage is listed for the cluster subnet.
  • Microsoft.KeyVault is listed for the cluster subnet.

From the Azure CLI, az network vnet subnet show --ids <subnet_id> --query "serviceEndpoints[].service" -o tsv prints both names.

Network security group rules the provider creates

Direction Protocol and ports Source or destination
Inbound TCP 21, 22, 53, 111, 443, 445, 2049, 3713, 8000, 9000 allow_cidrs
Inbound UDP 53, 111 allow_cidrs
Inbound TCP 3712 The VirtualNetwork service tag
Inbound ICMP allow_cidrs, only when nsg_allow_ingress_icmp = true
Outbound All traffic The Internet service tag

allow_cidrs must hold at least one CIDR block. An empty list fails plan validation.

Private endpoint DNS

Service Zone in Azure public cloud Zone in Azure Government
App Configuration privatelink.azconfig.io privatelink.azconfig.azure.us
Key Vault privatelink.vaultcore.azure.net privatelink.vaultcore.usgovcloudapi.net
Blob storage privatelink.blob.core.windows.net privatelink.blob.core.usgovcloudapi.net

Private endpoints with Azure Private DNS

  • Each zone named by a private_link_appconfig_dns_zone_id, private_link_keyvault_dns_zone_id, or private_link_storage_dns_zone_id must exist and be linked to the cluster virtual network before the apply. The apply fails with private endpoint prerequisite validation failed when either is missing.
  • Each zone ID requires the matching create_appconfig_private_endpoint, create_keyvault_private_endpoint, or create_storage_private_endpoint set to true.
  • disable_appconfig_public_network_access = true requires private_link_appconfig_dns_zone_id, and disable_keyvault_public_network_access = true requires private_link_keyvault_dns_zone_id.
  • The endpoint registers in its zone during create, so public network access can be disabled in the same apply.

Private endpoints with your own DNS

  • Only the create_appconfig_private_endpoint, create_keyvault_private_endpoint, and create_storage_private_endpoint switches are set.
  • Public network access must stay enabled during create. No DNS record can point at an endpoint IP before the apply creates that endpoint.
  • No Azure Private DNS zone for the same service may be linked to the cluster virtual network. A linked zone without a record for the new endpoint answers NXDOMAIN inside the virtual network, and the apply fails.
  • az network private-dns link vnet list --zone-name <zone> --resource-group <rg> lists a zone's links. An Azure Resource Graph query on microsoft.network/privatednszones/virtualnetworklinks checks across subscriptions.

appconfig_private_endpoint and keyvault_private_endpoint are single objects. storage_private_endpoints is a map keyed by storage account name. Every record carries these fields.

Field Contents
fqdn The name your DNS record points at
ip_address The private IP the record resolves to
endpoint_name The Azure private endpoint resource's name
resource_group The resource group that holds the private endpoint
target_resource_id The resource ID of the account, vault, or App Configuration store the endpoint fronts
  • The provider writes network posture only at creation and never reads it back. Disabling public network access on target_resource_id yourself causes no drift.
  • On a capacity increase, the whole storage_private_endpoints map is unknown at plan time. A downstream for_each over it needs -target on the cluster first, or a second apply.
  • Setting create_appconfig_private_endpoint, create_keyvault_private_endpoint, or create_storage_private_endpoint back to false deletes that service's endpoints. Records still pointing at them answer with a dead address.
  • Removing a zone ID while its switch stays true deletes only that endpoint's DNS zone group, and the endpoint stays.
  • create_keyvault_private_endpoint cannot be combined with key_vault_id.

Private endpoint cost

Each private endpoint carries a per-hour Azure charge. create_storage_private_endpoint creates one endpoint per storage account, so a cluster with 30 accounts gets 30 endpoints.