Export directories over NFS¶

When you finish, the cluster exports /data over NFS with NFSv4 turned on, and only the client networks you name can mount it.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_nfs_settings" "main" {
  connection_profile = "cluster1"

  v4_enabled       = true
  auth_sys_enabled = true
}

resource "qumulo_nfs_export" "data" {
  connection_profile = "cluster1"

  export_path = "/data"
  fs_path     = "/data"
  description = "Project data"

  restriction {
    host_restrictions       = ["10.0.0.0/8"] # <-- Replace with your client networks
    read_only               = false
    require_privileged_port = true
  }
}

output "nfs_export_id" {
  value = qumulo_nfs_export.data.id
}

Replace the three values marked <-- Replace, and leave the rest as written. The export creates /data on the cluster if the directory does not exist yet.

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Choose who can mount the export¶

To export read-only to every host, set host_restrictions = ["*"] and read_only = true.
To squash root, add user_mapping = "NFS_MAP_ROOT" to the restriction block, with map_to_user and map_to_group naming the local user and group that root becomes.
To squash every user, do the same with user_mapping = "NFS_MAP_ALL".
To require Kerberos, set krb5_enabled = true on qumulo_nfs_settings and add required_authentication_mode = "AUTHENTICATION_MODE_KRB5" to the restriction block.
To give another network different access, add a second restriction block with its own host_restrictions.
To export more directories, copy the qumulo_nfs_export block with a new resource name, export_path, and fs_path.

The plan in step 3 shows each change inside the restriction block.

3. Apply¶

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 2 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 2 added, 0 changed, 0 destroyed., followed by the nfs_export_id output.

4. Check the cluster¶

Run terraform plan again. It reports No changes. Your infrastructure matches the configuration., which means the cluster now serves the export exactly as written.

Next¶

Cap how much the export can hold with Set directory quotas, or create the identities root squashing maps to with Create local users and groups. The qumulo_nfs_export reference lists every attribute, and Manage several clusters from one configuration repeats one export across a fleet.

NFS export concepts, including host access rules, are in Qumulo's documentation.