Deploy a production Azure cluster

When you finish, a six-node Qumulo cluster spans three availability zones on zone-redundant storage, with SSH key login and your organization's tags.

Before you start

• A virtual network and subnet in a region with availability zones, meeting the Azure network prerequisites
• The Azure CLI signed in with az login, as an identity that holds the Azure permissions the provider needs
• An SSH key pair on the machine that runs Terraform
• Terraform 1.11 or later

1. Copy the configuration

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  azure {
    subscription_id = "00000000-0000-0000-0000-000000000000" # <-- Replace with your subscription ID
  }
}

resource "qumulo_filesystem_azure" "cluster" {
  cluster_name           = "qumuloprod"
  deployment_name        = "qumuloprod"
  location               = "eastus2" # <-- Replace with a region that has availability zones
  resource_group_name    = "rg-qumulo-prod"
  subnet_id              = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-network/providers/Microsoft.Network/virtualNetworks/vnet-main/subnets/subnet-qumulo" # <-- Replace with your subnet resource ID
  availability_zones     = ["1", "2", "3"]
  node_count             = 6
  vm_type                = "Standard_L16s_v3"
  soft_capacity_limit_tb = 1000
  cluster_product_type   = "HOT"
  admin_password         = "YourSecurePassword123!"                                                                             # <-- Replace with your admin password
  allow_cidrs            = ["10.0.0.0/8"]                                                                                       # <-- Replace with your client networks
  ssh_public_key         = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl admin@example.com" # <-- Replace with your SSH public key
  deletion_protection    = true

  tags = {
    Environment = "Production"
    ManagedBy   = "Terraform"
  }
}

output "endpoint_ips" {
  value = qumulo_filesystem_azure.cluster.endpoint_ips
}

output "web_ui" {
  value = "https://${qumulo_filesystem_azure.cluster.endpoint_ips[0]}"
}

Replace the six values marked <-- Replace, and leave the rest as written. To size the cluster differently, check the capacity each node supports in Azure VM sizes.

2. Use your own managed identities

If your organization manages Azure RBAC centrally, add these lines to the qumulo_filesystem_azure block.

cluster_node_identity_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-identities/providers/Microsoft.ManagedIdentity/userAssignedIdentities/qumulo-cluster"     # <-- Replace with your node identity ID
provisioner_identity_id  = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-identities/providers/Microsoft.ManagedIdentity/userAssignedIdentities/qumulo-provisioner" # <-- Replace with your provisioner identity ID

Grant both identities their roles first, as Bring your own managed identity shows. The plan in step 4 shows both attributes set to your identity IDs.

Warning

Changing cluster_node_identity_id or provisioner_identity_id after the cluster exists destroys the cluster and creates a new one. Add them before the first apply or not at all.

3. Add private endpoints

If the cluster must reach its App Configuration store, Key Vault, and storage accounts over Private Link, add these lines to the same block.

create_appconfig_private_endpoint       = true
private_link_appconfig_dns_zone_id      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-dns/providers/Microsoft.Network/privateDnsZones/privatelink.azconfig.io" # <-- Replace with your zone ID
disable_appconfig_public_network_access = true
create_keyvault_private_endpoint        = true
private_link_keyvault_dns_zone_id       = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-dns/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net" # <-- Replace with your zone ID
disable_keyvault_public_network_access  = true
create_storage_private_endpoint         = true
private_link_storage_dns_zone_id        = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-dns/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net" # <-- Replace with your zone ID

Each zone must already exist and be linked to the cluster's virtual network, as Azure network prerequisites describes. After the apply in step 4, the appconfig_private_endpoint, keyvault_private_endpoint, and storage_private_endpoints attributes each carry an fqdn and an ip_address.

4. Apply

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy. The apply runs for up to 90 minutes and ends with Apply complete! Resources: 1 added, 0 changed, 0 destroyed., followed by the endpoint_ips and web_ui outputs.

5. Check the cluster

Open the web_ui address in a browser on a network inside allow_cidrs, and accept the cluster's self-signed certificate. Sign in as admin with the password you set, and the web UI shows the cluster named qumuloprod.

Next

Keep the cluster's secrets in a vault you own with Bring your own Key Vault. The qumulo_filesystem_azure reference lists every attribute.