Create local users and groups¶

When you finish, the cluster has a users group, a developers group, and a user named alice who belongs to both.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_local_group" "users" {
  connection_profile = "cluster1"

  name = "users"
}

resource "qumulo_local_group" "developers" {
  connection_profile = "cluster1"

  name = "developers"
}

resource "qumulo_local_user" "alice" {
  connection_profile = "cluster1"

  name          = "alice"
  primary_group = qumulo_local_group.users.id
  password      = "AlicePassword123!" # <-- Replace with alice's password
}

resource "qumulo_local_group_member" "alice_developers" {
  connection_profile = "cluster1"

  group_id = qumulo_local_group.developers.id
  user_id  = qumulo_local_user.alice.id
}

output "alice_sid" {
  value = qumulo_local_user.alice.sid
}

Replace the three values marked <-- Replace, and leave the rest as written. users is alice's primary group, and qumulo_local_group_member adds her to developers as a secondary group.

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

To pin a group's NFS GID, add a line such as gid = "2000" to its block. Without it, the cluster assigns one.
To pin a user's NFS UID, add a line such as uid = "3001" to the user's block.
To give a user a home directory, add home_directory = "/home/alice".
For an account that never signs in with a password, such as a service account, delete the password line.
To add another user, copy the qumulo_local_user and qumulo_local_group_member blocks with new resource names.

2. Apply¶

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 4 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 4 added, 0 changed, 0 destroyed., followed by the alice_sid output.

Note

The cluster refuses to delete a group while it is any user's primary_group. Move those users to another group and apply before you remove it.

3. Check the cluster¶

Run terraform output alice_sid. It prints the Windows SID the cluster assigned to alice when it created her.

Next¶

Give alice rights on the cluster with cluster roles, or map NFS root to one of these accounts in Export directories over NFS. The qumulo_local_user, qumulo_local_group, and qumulo_local_group_member references list every attribute.