Set cluster-wide settings¶

When you finish, the cluster carries the name you chose and keeps time from your NTP servers, and it presents your own TLS certificate if you have one.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later
NTP servers the cluster can reach
For a custom certificate, the certificate and its private key as PEM files

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_cluster_settings" "main" {
  connection_profile = "cluster1"

  cluster_name = "qumulo-prod" # <-- Replace with a name of 2 to 15 characters
}

resource "qumulo_time_configuration" "main" {
  connection_profile = "cluster1"

  ntp_servers = ["0.pool.ntp.org", "1.pool.ntp.org"] # <-- Replace with your NTP servers
}

output "time_sync_status" {
  value = qumulo_time_configuration.main.sync_status
}

Replace the four values marked <-- Replace, and leave the rest as written. The cluster name must be 2 to 15 characters.

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Install your TLS certificate¶

Skip this step to keep the cluster's current certificate. Otherwise, put the PEM files beside main.tf and add this block.

resource "qumulo_cluster_ssl" "main" {
  connection_profile = "cluster1"

  certificate = file("${path.module}/server.pem")     # <-- Replace with your certificate file
  private_key = file("${path.module}/server-key.pem") # <-- Replace with your private key file
}

If the cluster connects out to LDAP or AD servers whose certificates come from a private CA, add ca_certificate = file("${path.module}/ca.pem") to the same block.
To limit the TLS cipher suites the cluster offers, add tls_1_2_ciphers and tls_1_3_ciphers lists.

The plan in step 4 adds qumulo_cluster_ssl.main, with certificate and private_key shown as sensitive.

Note

certificate and private_key are write-only. Terraform never reads them back, so it cannot notice a certificate replaced outside Terraform.

3. Take time from Active Directory¶

Skip this step unless the cluster is joined to Active Directory. Add use_ad_for_primary = true to the qumulo_time_configuration block to make the domain controller the cluster's primary time source.

The plan in step 4 shows use_ad_for_primary = true.

4. Apply¶

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 2 to add, 0 to change, 0 to destroy., or Plan: 3 to add with a certificate. The apply ends with Apply complete!, followed by the time_sync_status output.

5. Check the cluster¶

Run terraform output time_sync_status. It prints "TIME_SYNCHRONIZING" while the cluster syncs with your time sources, and "TIME_NOT_SYNCHRONIZING" means the cluster cannot use them.

Next¶

Choose how permissions and access times behave in Tune file system settings, or join the domain first with Join a cluster to Active Directory. The qumulo_cluster_settings, qumulo_cluster_ssl, and qumulo_time_configuration references list every attribute.

Certificate requirements are in Qumulo's documentation.