Azure network prerequisites

qumulo_filesystem_azure deploys into an existing virtual network and subnet. The provider creates no virtual network, subnet, route, or service endpoint.

Checklist

Requirement	Applies to	Details
Existing subnet	Every deployment	subnet_id is the subnet's full resource ID, in the form /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}.
Free addresses	Every deployment	One per node, one for the provisioner VM, and one per floating IP, on top of the 5 addresses Azure reserves in every subnet.
Microsoft.Storage service endpoint	Every deployment	The cluster's storage accounts accept traffic only from this subnet. Without the endpoint, the apply stops with must have the "Microsoft.Storage" service endpoint enabled.
Microsoft.KeyVault service endpoint	Every deployment	Enabled on the same subnet as Microsoft.Storage.
Outbound internet access	Unless air_gapped = true	The network security group the provider creates allows all outbound traffic to the Internet service tag. The cluster reaches Qumulo Nexus and MissionQ, and nodes download operating system packages and the Azure CLI, over it. Cluster nodes keep their Nexus connection to api.nexus.qumulo.com on TCP 443, so a firewall or proxy that filters egress by name must allow that host. For an isolated subnet, see Deploy a cluster into an air-gapped subnet.
Private DNS zones linked to the virtual network	When a private_link_appconfig_dns_zone_id, private_link_keyvault_dns_zone_id, or private_link_storage_dns_zone_id is set	See Private endpoint DNS.
Network access from the subnet to the vault	When key_vault_id is set	See Bring your own Key Vault.

Service endpoint check

In the Azure portal, the service endpoints sit under Virtual networks > your virtual network > Settings > Service endpoints.

• Microsoft.Storage is listed for the cluster subnet.
• Microsoft.KeyVault is listed for the cluster subnet.

From the Azure CLI, az network vnet subnet show --ids <subnet_id> --query "serviceEndpoints[].service" -o tsv prints both names.

Network security group rules the provider creates

Direction	Protocol and ports	Source or destination
Inbound	TCP 21, 22, 53, 111, 443, 445, 2049, 3713, 8000, 9000	allow_cidrs
Inbound	UDP 53, 111	allow_cidrs
Inbound	TCP 3712	The VirtualNetwork service tag
Inbound	ICMP	allow_cidrs, only when nsg_allow_ingress_icmp = true
Outbound	All traffic	The Internet service tag

allow_cidrs must hold at least one CIDR block. An empty list fails plan validation.

Private endpoint DNS

Service	Zone in Azure public cloud	Zone in Azure Government
App Configuration	privatelink.azconfig.io	privatelink.azconfig.azure.us
Key Vault	privatelink.vaultcore.azure.net	privatelink.vaultcore.usgovcloudapi.net
Blob storage	privatelink.blob.core.windows.net	privatelink.blob.core.usgovcloudapi.net

Private endpoints with Azure Private DNS

• Each zone named by a private_link_appconfig_dns_zone_id, private_link_keyvault_dns_zone_id, or private_link_storage_dns_zone_id must exist and be linked to the cluster virtual network before the apply. The apply fails with private endpoint prerequisite validation failed when either is missing.
• Each zone ID requires the matching create_appconfig_private_endpoint, create_keyvault_private_endpoint, or create_storage_private_endpoint set to true.
• disable_appconfig_public_network_access = true requires private_link_appconfig_dns_zone_id, and disable_keyvault_public_network_access = true requires private_link_keyvault_dns_zone_id.
• The endpoint registers in its zone during create, so public network access can be disabled in the same apply.

Private endpoints with your own DNS

• Only the create_appconfig_private_endpoint, create_keyvault_private_endpoint, and create_storage_private_endpoint switches are set.
• Public network access must stay enabled during create. No DNS record can point at an endpoint IP before the apply creates that endpoint.
• No Azure Private DNS zone for the same service may be linked to the cluster virtual network. A linked zone without a record for the new endpoint answers NXDOMAIN inside the virtual network, and the apply fails.
• az network private-dns link vnet list --zone-name <zone> --resource-group <rg> lists a zone's links. An Azure Resource Graph query on microsoft.network/privatednszones/virtualnetworklinks checks across subscriptions.

appconfig_private_endpoint and keyvault_private_endpoint are single objects. storage_private_endpoints is a map keyed by storage account name. Every record carries these fields.

Field	Contents
fqdn	The name your DNS record points at
ip_address	The private IP the record resolves to
endpoint_name	The Azure private endpoint resource's name
resource_group	The resource group that holds the private endpoint
target_resource_id	The resource ID of the account, vault, or App Configuration store the endpoint fronts

• The provider writes network posture only at creation and never reads it back. Disabling public network access on target_resource_id yourself causes no drift.
• On a capacity increase, the whole storage_private_endpoints map is unknown at plan time. A downstream for_each over it needs -target on the cluster first, or a second apply.
• Setting create_appconfig_private_endpoint, create_keyvault_private_endpoint, or create_storage_private_endpoint back to false deletes that service's endpoints. Records still pointing at them answer with a dead address.
• Removing a zone ID while its switch stays true deletes only that endpoint's DNS zone group, and the endpoint stays.
• create_keyvault_private_endpoint cannot be combined with key_vault_id.

Private endpoint cost

Each private endpoint carries a per-hour Azure charge. create_storage_private_endpoint creates one endpoint per storage account, so a cluster with 30 accounts gets 30 endpoints.