GCP project prerequisites¶

qumulo_filesystem_gcp deploys into an existing GCP project, VPC, and subnetwork. The provider creates no project, network, or subnetwork, and enables no API.

Checklist¶

Requirement	Applies to	Details
Billing	Every deployment	Billing is enabled on the project.
Compute Engine API	Every deployment	`compute.googleapis.com` is enabled.
Cloud Storage API	Every deployment	`storage.googleapis.com` is enabled.
IAM API	Every deployment	`iam.googleapis.com` is enabled.
Cloud KMS API	`kms_key_name` is set	`cloudkms.googleapis.com` is enabled.
Subnetwork	Every deployment	An existing subnetwork in the cluster's region, in the cluster's own project. Shared VPC host-project subnetworks are not supported.
Private Google Access	Every deployment	Turned on for the subnetwork.
Credentials	Every deployment	Application Default Credentials (`gcloud auth application-default login`) or `GOOGLE_APPLICATION_CREDENTIALS`.

Roles for the deploying principal¶

The deploying principal is the identity that runs terraform apply.

Role	Granted on	Applies to
`roles/compute.admin`	The project	Every deployment. It includes `compute.instances.setDeletionProtection`, so `deletion_protection` needs no further role.
`roles/storage.admin`	The project	Every deployment
`roles/iam.serviceAccountAdmin`	The project	`service_account_email` is omitted
`roles/cloudkms.cryptoKeyEncrypterDecrypter`	The KMS key	`kms_key_name` is set
`roles/compute.imageUser`	The image, or the project that holds it	`node_image`, `node_image_project`, `provisioner_image`, or `provisioner_image_project` names an image in another project

Node service account¶

When service_account_email is omitted, the provider creates a service account for the cluster nodes and grants it these roles on the project.

Role	Permissions
`roles/storage.objectAdmin`	Predefined role
`roles/logging.logWriter`	Predefined role
`roles/monitoring.metricWriter`	Predefined role
A custom role created per cluster	`compute.instances.get`, `compute.instances.list`, `compute.instances.updateNetworkInterface`, `compute.regions.get`

An account supplied through service_account_email is used as it is, and the provider grants it nothing. A cross-project custom image also needs roles/compute.imageUser granted to this account.