Cluster RBAC Roles Example

This example demonstrates how to manage RBAC roles and role memberships on a Qumulo cluster.

Features

• Add AD groups to roles (common first-step when setting up a new cluster)
• Create custom RBAC roles with specific privileges
• Assign users and groups to roles
• Support for multiple role assignments per user
• Dynamic role assignment using for_each

Usage

1. Create a terraform.tfvars file:

cluster_endpoint = "https://your-cluster:8000"
cluster_username = "admin"
cluster_password = "your-admin-password"

1. Initialize and apply:

terraform init -upgrade
terraform plan
terraform apply

Resources Created

• Roles: BackupOperators, Observers, FileOperators, CustomRole
• Groups: backup-team
• Users: alice, bob, charlie, david
• Role Memberships: Various user-to-role assignments (including AD group example)

Adding AD Groups to Roles

A common first step when setting up a new cluster is adding an AD group to the Administrators role. This allows your AD admins to manage the cluster without sharing the local admin credentials.

Prerequisites: - Cluster must be joined to Active Directory (see cluster-active-directory example) - You need the SID of the AD group

Finding an AD group's SID:

# PowerShell
(Get-ADGroup "Domain Admins").SID.Value

# Linux with Samba
wbinfo -n "DOMAIN\\Group Name"

Example configuration:

resource "qumulo_role_member" "ad_admins" {
  connection_profile = "cluster1"

  role_name = "Administrators"
  domain    = "ACTIVE_DIRECTORY"
  auth_id   = "S-1-5-21-xxxxxxxxxx-512"  # Your Domain Admins SID
}

Common Privilege Categories

Category	Example Privileges
Filesystem	PRIVILEGE_FS_ATTRIBUTES_READ, PRIVILEGE_FS_ATTRIBUTES_WRITE, PRIVILEGE_FS_DELETE_TREE
Snapshots	PRIVILEGE_SNAPSHOT_READ, PRIVILEGE_SNAPSHOT_WRITE, PRIVILEGE_SNAPSHOT_DELETE
Quotas	PRIVILEGE_QUOTA_READ, PRIVILEGE_QUOTA_WRITE
Cluster	PRIVILEGE_CLUSTER_READ, PRIVILEGE_CLUSTER_WRITE
Analytics	PRIVILEGE_ANALYTICS_READ
Network	PRIVILEGE_NETWORK_READ, PRIVILEGE_NETWORK_WRITE

Import Existing Roles

# Import a role (format: connection_profile,role_name)
terraform import qumulo_role.existing prod,ExistingRoleName

# Import a role membership (format: connection_profile,role_name,domain,auth_id)
terraform import qumulo_role_member.existing prod,RoleName,LOCAL,1001

Notes

• Role names cannot be changed after creation (triggers replacement)
• Role memberships are identified by domain + auth_id
• Common domains: LOCAL, ACTIVE_DIRECTORY, LDAP
• Users can be assigned to multiple roles
• Groups can also be assigned to roles (all group members inherit the role)
• For AD role assignments, the cluster must first be joined to AD (see cluster-active-directory example)

Full Configuration

# Example: Managing RBAC Roles on a Qumulo Cluster
#
# This example demonstrates how to create and manage RBAC roles
# and role memberships on a Qumulo cluster.

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint (e.g., https://cluster:8000)"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

variable "ad_admin_group_sid" {
  description = "SID of the AD group to grant administrator access (e.g., S-1-5-21-xxx-512 for Domain Admins)"
  type        = string
  default     = "" # Set this to your Domain Admins or custom admin group SID
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

# =============================================================================
# RBAC Roles
# =============================================================================

# Role for backup operations
resource "qumulo_role" "backup_operators" {
  connection_profile = "cluster1"

  name        = "BackupOperators"
  description = "Role for managing snapshots and backups"
  privileges = [
    "PRIVILEGE_SNAPSHOT_READ",
    "PRIVILEGE_SNAPSHOT_WRITE",
    "PRIVILEGE_SNAPSHOT_DELETE",
    "PRIVILEGE_SNAPSHOT_POLICY_READ",
    "PRIVILEGE_SNAPSHOT_POLICY_WRITE",
  ]
}

# Role for read-only monitoring
resource "qumulo_role" "observers" {
  connection_profile = "cluster1"

  name        = "Observers"
  description = "Read-only monitoring and reporting access"
  privileges = [
    "PRIVILEGE_FS_ATTRIBUTES_READ",
    "PRIVILEGE_CLUSTER_READ",
    "PRIVILEGE_QUOTA_READ",
    "PRIVILEGE_ANALYTICS_READ",
    "PRIVILEGE_NETWORK_READ",
  ]
}

# Role for file operations
resource "qumulo_role" "file_operators" {
  connection_profile = "cluster1"

  name        = "FileOperators"
  description = "File and directory management operations"
  privileges = [
    "PRIVILEGE_FS_ATTRIBUTES_READ",
    "PRIVILEGE_FS_ATTRIBUTES_WRITE",
    "PRIVILEGE_FS_DELETE_TREE",
    "PRIVILEGE_FS_LOCK_READ",
    "PRIVILEGE_FS_LOCK_WRITE",
  ]
}

# Empty role (privileges can be added later)
resource "qumulo_role" "custom" {
  connection_profile = "cluster1"

  name        = "CustomRole"
  description = "Custom role for specific use cases"
  privileges  = []
}

# =============================================================================
# Local Groups and Users (for role assignments)
# =============================================================================

# Create a group for backup operators
resource "qumulo_local_group" "backup_team" {
  connection_profile = "cluster1"

  name = "backup-team"
}

# Create a user
resource "qumulo_local_user" "alice" {
  connection_profile = "cluster1"

  name          = "alice"
  primary_group = qumulo_local_group.backup_team.id
}

resource "qumulo_local_user" "bob" {
  connection_profile = "cluster1"

  name          = "bob"
  primary_group = qumulo_local_group.backup_team.id
}

# =============================================================================
# Role Memberships
# =============================================================================

# Assign alice to backup operators role
resource "qumulo_role_member" "alice_backup" {
  connection_profile = "cluster1"

  role_name = qumulo_role.backup_operators.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_user.alice.id
}

# Assign alice to observers role (users can have multiple roles)
resource "qumulo_role_member" "alice_observer" {
  connection_profile = "cluster1"

  role_name = qumulo_role.observers.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_user.alice.id
}

# Assign bob to file operators role
resource "qumulo_role_member" "bob_file_ops" {
  connection_profile = "cluster1"

  role_name = qumulo_role.file_operators.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_user.bob.id
}

# Assign entire backup-team group to observers role
resource "qumulo_role_member" "backup_team_observer" {
  connection_profile = "cluster1"

  role_name = qumulo_role.observers.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_group.backup_team.id
}

# =============================================================================
# Active Directory Role Assignments
# =============================================================================
#
# Adding an AD group to the Administrators role is typically one of the first
# things done when setting up a new Qumulo cluster. This allows your AD admins
# to manage the cluster without using the local admin account.
#
# Prerequisites:
# - Cluster must be joined to Active Directory (see cluster-active-directory example)
# - You need the SID of the AD group (e.g., "S-1-5-21-xxx-512" for Domain Admins)
#
# To find an AD group's SID:
#   PowerShell: (Get-ADGroup "Domain Admins").SID.Value
#   Linux:      wbinfo -n "DOMAIN\\Group Name"

# Add an AD group to the built-in Administrators role
resource "qumulo_role_member" "ad_admins" {
  count = var.ad_admin_group_sid != "" ? 1 : 0

  connection_profile = "cluster1"

  role_name = "Administrators" # Built-in admin role
  domain    = "ACTIVE_DIRECTORY"
  auth_id   = var.ad_admin_group_sid
}

# =============================================================================
# Dynamic Role Membership Using for_each
# =============================================================================

# Map of users to their roles
variable "user_roles" {
  description = "Map of user names to role names"
  type        = map(string)
  default = {
    "charlie" = "Observers"
    "david"   = "FileOperators"
  }
}

# Create users dynamically
resource "qumulo_local_user" "dynamic" {
  for_each = var.user_roles

  connection_profile = "cluster1"

  name          = each.key
  primary_group = qumulo_local_group.backup_team.id
}

# Assign roles dynamically based on the map
resource "qumulo_role_member" "dynamic" {
  for_each = var.user_roles

  connection_profile = "cluster1"

  role_name = each.value
  domain    = "LOCAL"
  auth_id   = qumulo_local_user.dynamic[each.key].id

  depends_on = [
    qumulo_role.observers,
    qumulo_role.file_operators,
  ]
}

# =============================================================================
# Outputs
# =============================================================================

output "backup_operators_role" {
  description = "Name of the backup operators role"
  value       = qumulo_role.backup_operators.name
}

output "backup_operators_privileges" {
  description = "Privileges granted by the backup operators role"
  value       = qumulo_role.backup_operators.privileges
}

output "alice_user_id" {
  description = "ID of the alice user"
  value       = qumulo_local_user.alice.id
}

output "alice_roles" {
  description = "Roles assigned to alice"
  value = [
    qumulo_role_member.alice_backup.role_name,
    qumulo_role_member.alice_observer.role_name,
  ]
}

output "dynamic_user_roles" {
  description = "Map of dynamically created users to their assigned roles"
  value = {
    for name, role in var.user_roles : name => {
      user_id = qumulo_local_user.dynamic[name].id
      role    = role
    }
  }
}