Troubleshoot an Azure deployment¶

Find the symptom you see in the tables below, then apply the fix beside it. Each table covers one stage of a qumulo_filesystem_azure run.

Fix plan errors¶

Symptom	Fix
`Invalid Node Count`	Use `node_count = 1`, or 3 to 24.
`Invalid node_count for multi-zone deployment`	Use `node_count = 3` or 5 and up, or list a single zone in `availability_zones`.
`Unsupported vm_type`	Choose a size from Azure VM sizes.
`Requested capacity exceeds instance capacity`	Lower `soft_capacity_limit_tb`, add nodes, or choose a larger size from Azure VM sizes.
`Cannot decrease soft_capacity_limit_tb`	Keep the value at or above the current one, since capacity only grows.
`storage_class requires zone-redundant storage`	Set `storage_replication_type = "ZRS"`, or set `storage_class = "STANDARD"` to keep `LRS`.
`Private endpoint requested for a customer-managed Key Vault`	Remove `create_keyvault_private_endpoint`, and build the vault's endpoint outside Terraform as Bring your own Key Vault shows.
`allow_cidrs` fails validation	List at least one CIDR block.
The plan warns that every node will be replaced	No fix needed. Changing `vm_type`, `availability_zones`, `custom_image_id`, or `marketplace_image` replaces every node in service, and node IP addresses change.

Fix apply errors¶

Symptom	Fix
`the operator is missing` followed by a list of Azure permissions	Grant the listed actions, for example with Owner, or with Contributor plus User Access Administrator. See Azure permissions.
`must have the "Microsoft.Storage" service endpoint enabled`	Enable the `Microsoft.Storage` service endpoint on the cluster subnet, then apply again.
`Storage type requires availability zones`	In a region without availability zones, set `storage_replication_type = "LRS"` and `storage_class = "STANDARD"`, and omit `availability_zones`.
`object_storage_uri_validate_error` with `ForbiddenByFirewall`	Let the cluster subnet reach the vault named in the error, as Bring your own Key Vault shows, then apply again.
`private endpoint prerequisite validation failed`	Create the private DNS zone the error names, or link it to the cluster virtual network, then apply again.
`to build the private endpoint the DNS zone registers`	Set the switch the error names to `true`, or remove the zone ID.
`private_link_keyvault_dns_zone_id is required when disable_keyvault_public_network_access is true`	Set the zone ID with `create_keyvault_private_endpoint = true`, or leave public access enabled.
`private_link_appconfig_dns_zone_id is required when disable_appconfig_public_network_access is true`	Set the zone ID with `create_appconfig_private_endpoint = true`, or leave public access enabled.
The Key Vault or storage stops resolving inside the virtual network mid-create	Pass the already-linked zone's ID in the matching `private_link_appconfig_dns_zone_id`, `private_link_keyvault_dns_zone_id`, or `private_link_storage_dns_zone_id`.
Floating IPs do not attach, and the debug log shows `Unable to ensure subnet-join custom role`	Grant the deploying identity `Microsoft.Authorization/roleDefinitions/write` at the subscription, or grant the node identity `Microsoft.Network/virtualNetworks/subnets/join/action` on the cluster subnet.

Fix destroy errors¶

Symptom	Fix
`Cluster is protected from deletion`	Set `deletion_protection = false`, run `terraform apply`, then run `terraform destroy`.
The apply that turns off `deletion_protection` fails on management locks	Grant `Microsoft.Authorization/locks/*`, which Owner and User Access Administrator carry and Contributor does not.

Get more detail¶

Run TF_LOG=DEBUG terraform apply for the provider's full log.