NFS Exports Example¶

This example demonstrates how to manage NFS exports and server settings on an existing Qumulo cluster.

Features¶

NFS server settings configuration (NFSv4, Kerberos)
Basic read-only export for public access
Secure export with host restrictions and user mapping
Department exports using for_each for scalable management

Prerequisites¶

An existing Qumulo cluster with REST API access
Admin credentials for the cluster
Network connectivity to the cluster endpoint

Usage¶

Initialize, plan, and apply with your cluster variables:

terraform init -upgrade
terraform plan \
  -var="cluster_endpoint=https://your-cluster:8000" \
  -var="cluster_password=your-password"
terraform apply \
  -var="cluster_endpoint=https://your-cluster:8000" \
  -var="cluster_password=your-password"

Or create a terraform.tfvars file with your values and run terraform apply without -var flags.

Configuration¶

Variables¶

Name	Description	Type	Required
`cluster_endpoint`	Qumulo cluster REST API endpoint	`string`	Yes
`cluster_username`	Cluster admin username	`string`	No (default: `admin`)
`cluster_password`	Cluster admin password	`string`	Yes
`departments`	Map of department export configs	`map(object)`	No

Outputs¶

Name	Description
`nfs_settings_v4_enabled`	Whether NFSv4 is enabled
`public_export_id`	ID of the public data export
`secure_export_id`	ID of the secure data export
`department_export_ids`	Map of department names to export IDs

NFS Settings¶

The qumulo_nfs_settings resource configures global NFS server settings:

resource "qumulo_nfs_settings" "main" {
  connection_profile = "cluster1"

  v4_enabled       = true   # Enable NFSv4
  auth_sys_enabled = true   # Enable AUTH_SYS (UNIX auth)
  krb5_enabled     = false  # Kerberos 5
  krb5i_enabled    = false  # Kerberos 5 with integrity
  krb5p_enabled    = false  # Kerberos 5 with privacy
}

NFS Export Restrictions¶

Exports can have multiple restrictions with different settings:

resource "qumulo_nfs_export" "example" {
  # ...

  restriction {
    host_restrictions            = ["10.0.0.0/8"]
    require_privileged_port      = true
    read_only                    = false
    required_authentication_mode = "AUTHENTICATION_MODE_NONE"
    user_mapping                 = "NFS_MAP_ROOT"

    map_to_user = {
      id_type  = "LOCAL_USER"
      id_value = "nfsnobody"
    }

    map_to_group = {
      id_type  = "LOCAL_GROUP"
      id_value = "nobody"
    }
  }
}

User Mapping Options¶

Value	Description
`NFS_MAP_NONE`	No user mapping (default)
`NFS_MAP_ROOT`	Map root user to specified identity
`NFS_MAP_ALL`	Map all users to specified identity

Authentication Modes¶

Value	Description
`AUTHENTICATION_MODE_NONE`	No authentication required (default)
`AUTHENTICATION_MODE_KRB5`	Kerberos 5 authentication required

Security Considerations¶

Store cluster_password in a secure location (environment variable, secrets manager)
Use host_restrictions to limit access to trusted networks
Enable require_privileged_port for additional security
Use NFS_MAP_ROOT or NFS_MAP_ALL to squash users for shared exports
Consider enabling Kerberos for enterprise environments

Full Configuration¶

# Example: Managing NFS Exports on a Qumulo Cluster
#
# This example demonstrates how to create and manage NFS exports
# on an existing Qumulo cluster using the qumulo_nfs_export
# and qumulo_nfs_settings resources.

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint (e.g., https://cluster:8000)"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

# Configure NFS server settings
resource "qumulo_nfs_settings" "main" {
  connection_profile = "cluster1"

  v4_enabled       = true
  auth_sys_enabled = true
  krb5_enabled     = false
  krb5i_enabled    = false
  krb5p_enabled    = false
}

# Basic export for all hosts
resource "qumulo_nfs_export" "public_data" {
  connection_profile = "cluster1"

  export_path = "/public"
  fs_path     = "/public"
  description = "Public read-only NFS export"

  restriction {
    host_restrictions = ["*"]
    read_only         = true
  }
}

# Secure export with host restrictions and user mapping
resource "qumulo_nfs_export" "secure_data" {
  connection_profile = "cluster1"

  export_path = "/secure"
  fs_path     = "/secure"
  description = "Secure NFS export with restricted access"

  restriction {
    host_restrictions       = ["10.0.0.0/8", "192.168.0.0/16"]
    require_privileged_port = true
    read_only               = false
    user_mapping            = "NFS_MAP_ROOT"

    map_to_user = {
      id_type  = "LOCAL_USER"
      id_value = "nfsnobody"
    }

    map_to_group = {
      id_type  = "LOCAL_GROUP"
      id_value = "nobody"
    }
  }
}

# Department exports using for_each
variable "departments" {
  description = "Map of department names to their export configuration"
  type = map(object({
    path          = string
    allowed_hosts = list(string)
    read_only     = bool
  }))
  default = {
    engineering = {
      path          = "/departments/engineering"
      allowed_hosts = ["10.1.0.0/16"]
      read_only     = false
    }
    marketing = {
      path          = "/departments/marketing"
      allowed_hosts = ["10.2.0.0/16"]
      read_only     = true
    }
    research = {
      path          = "/departments/research"
      allowed_hosts = ["10.3.0.0/16"]
      read_only     = false
    }
  }
}

resource "qumulo_nfs_export" "departments" {
  for_each = var.departments

  connection_profile = "cluster1"

  export_path = "/${each.key}"
  fs_path     = each.value.path
  description = "NFS export for ${each.key} department"

  restriction {
    host_restrictions = each.value.allowed_hosts
    read_only         = each.value.read_only
  }
}

# Outputs
output "nfs_settings_v4_enabled" {
  description = "Whether NFSv4 is enabled"
  value       = qumulo_nfs_settings.main.v4_enabled
}

output "public_export_id" {
  description = "ID of the public data export"
  value       = qumulo_nfs_export.public_data.id
}

output "secure_export_id" {
  description = "ID of the secure data export"
  value       = qumulo_nfs_export.secure_data.id
}

output "department_export_ids" {
  description = "Map of department names to export IDs"
  value       = { for k, v in qumulo_nfs_export.departments : k => v.id }
}