Cluster Settings Example¶

This example demonstrates configuring cluster settings on Qumulo clusters, including:

Cluster name - Set the display name for your cluster
SSL certificates - Configure custom server certificates
CA certificates - Configure CA certificates for outbound connections
TLS cipher suites - Customize TLS 1.2 and TLS 1.3 cipher configurations
Time configuration - Configure NTP servers and AD time synchronization

Prerequisites¶

A running Qumulo cluster accessible via REST API
Admin credentials for the cluster
(Optional) SSL certificate files in PEM format

Resources Created¶

Resource	Description
`qumulo_cluster_settings`	Cluster display name
`qumulo_cluster_ssl`	SSL certificates and TLS ciphers
`qumulo_time_configuration`	NTP servers and AD time synchronization

Usage¶

Create a terraform.tfvars file:

cluster_endpoint = "https://your-cluster:8000"
cluster_username = "admin"
cluster_password = "your-password"
cluster_name     = "production-cluster"

Initialize and apply:

terraform init -upgrade
terraform plan
terraform apply

SSL Certificate Configuration¶

The certificate and private_key attributes are write-only. They cannot be read back from the cluster API, so Terraform preserves their values in state from your configuration.

To configure a custom SSL certificate:

resource "qumulo_cluster_ssl" "main" {
  connection_profile = "cluster1"

  certificate = file("${path.module}/certs/server.pem")
  private_key = file("${path.module}/certs/server-key.pem")
}

Both certificate and private_key must be provided together.

CA Certificate for Outbound Connections¶

Configure a CA certificate when your cluster needs to connect to services with custom CAs (e.g., LDAP or Active Directory servers):

resource "qumulo_cluster_ssl" "main" {
  connection_profile = "cluster1"

  ca_certificate = file("${path.module}/certs/corporate-ca.pem")
}

Multi-Cluster Configuration¶

Use for_each to manage settings across multiple clusters:

variable "clusters" {
  type = map(object({
    endpoint = string
    name     = string
  }))
}

provider "qumulo" {
  connection_profiles = [
    for key, config in var.clusters : {
      name     = key
      endpoint = config.endpoint
      username = var.admin_username
      password = var.admin_password
    }
  ]
}

resource "qumulo_cluster_settings" "all" {
  for_each = var.clusters

  connection_profile = each.key

  cluster_name = each.value.name
}

Time Configuration¶

Configure NTP servers for cluster time synchronization:

resource "qumulo_time_configuration" "main" {
  connection_profile = "cluster1"

  ntp_servers = ["0.pool.ntp.org", "1.pool.ntp.org"]
}

When using Active Directory, you can configure the cluster to use the AD domain controller as the primary time source:

resource "qumulo_time_configuration" "ad_time" {
  connection_profile = "cluster1"

  use_ad_for_primary = true
  ntp_servers        = ["time.windows.com"]
}

The sync_status attribute is read-only and indicates whether the cluster is currently synchronizing time (TIME_SYNCHRONIZING or TIME_NOT_SYNCHRONIZING).

Import¶

Import existing cluster settings:

# Format: connection_profile
terraform import qumulo_cluster_settings.main "prod"
terraform import qumulo_cluster_ssl.main "prod"
terraform import qumulo_time_configuration.main "prod"

Note: The certificate and private_key cannot be imported as they are write-only.

Destroy Behavior¶

Cluster settings: On destroy, the cluster name is left unchanged (no-op)
Cluster SSL: On destroy:
CA certificate is deleted (if configured)
Server certificate remains on cluster (cannot be deleted via API)
Cipher settings remain at last configured values
Time configuration: On destroy, settings are reset to defaults:
use_ad_for_primary is set to false
ntp_servers is set to empty list

Full Configuration¶

# Cluster Settings Example
#
# This example demonstrates configuring cluster settings on Qumulo clusters.
# It shows how to:
# - Set the cluster name
# - Configure SSL certificates
# - Manage TLS cipher suites
# - Configure NTP time synchronization

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

variable "cluster_name" {
  description = "Display name for the cluster"
  type        = string
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

# Basic cluster settings - cluster name
resource "qumulo_cluster_settings" "main" {
  connection_profile = "cluster1"

  cluster_name = var.cluster_name
}

# SSL/TLS settings - certificates and ciphers
resource "qumulo_cluster_ssl" "main" {
  connection_profile = "cluster1"

  # Server certificate (optional, write-only)
  # Uncomment and provide paths to your certificate files:
  # certificate = file("${path.module}/certs/server.pem")
  # private_key = file("${path.module}/certs/server-key.pem")

  # CA certificate for outbound connections (optional)
  # Used when cluster connects to LDAP/AD servers with custom CAs
  # ca_certificate = file("${path.module}/certs/ca.pem")

  # TLS cipher suites (optional)
  # If not specified, cluster defaults are used
  tls_1_2_ciphers = [
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  ]
  tls_1_3_ciphers = [
    "TLS_AES_256_GCM_SHA384",
    "TLS_AES_128_GCM_SHA256",
  ]
}

# Time configuration - NTP servers and AD time sync
resource "qumulo_time_configuration" "main" {
  connection_profile = "cluster1"

  # NTP servers for time synchronization
  ntp_servers = [
    "0.pool.ntp.org",
    "1.pool.ntp.org",
    "2.pool.ntp.org",
  ]

  # Use AD domain controller as primary time source (optional)
  # Set to true when using Active Directory
  use_ad_for_primary = false
}

output "cluster_name" {
  description = "The configured cluster name"
  value       = qumulo_cluster_settings.main.cluster_name
}

output "time_sync_status" {
  description = "Current time synchronization status"
  value       = qumulo_time_configuration.main.sync_status
}