GCP project prerequisites

qumulo_filesystem_gcp deploys into an existing GCP project, VPC, and subnetwork. The provider creates no project, network, or subnetwork, and enables no API.

Checklist

Requirement	Applies to	Details
Billing	Every deployment	Billing is enabled on the project.
Compute Engine API	Every deployment	compute.googleapis.com is enabled.
Cloud Storage API	Every deployment	storage.googleapis.com is enabled.
IAM API	Every deployment	iam.googleapis.com is enabled.
Secret Manager API	Every deployment	secretmanager.googleapis.com is enabled.
Cloud KMS API	kms_key_name is set	cloudkms.googleapis.com is enabled.
Subnetwork	Every deployment	An existing subnetwork in the cluster's region, in the cluster's own project. Shared VPC host-project subnetworks are not supported.
Private Google Access	Every deployment	Turned on for the subnetwork.
Outbound internet access	Unless air_gapped = true	Cluster nodes have no external IP addresses, so the subnetwork needs a route to the internet, typically Cloud NAT. The cluster reaches Qumulo Nexus and MissionQ, and nodes download operating system packages, over it. Cluster nodes keep their Nexus connection to api.nexus.qumulo.com on TCP 443, so a firewall or proxy that filters egress by name must allow that host. For an isolated subnetwork, see Deploy a cluster into an air-gapped subnet.
Credentials	Every deployment	Application Default Credentials (gcloud auth application-default login) or GOOGLE_APPLICATION_CREDENTIALS.
Service account credentials	air_gapped = true and package_url is not set	Application Default Credentials for a service account: a key file in GOOGLE_APPLICATION_CREDENTIALS, or an impersonated or federated service account, such as gcloud auth application-default login --impersonate-service-account. The provider signs the staging bucket URLs that nodes download Qumulo Core from, and a user's own login cannot sign them.

Roles for the deploying principal

The deploying principal is the identity that runs terraform apply.

Role	Granted on	Applies to
roles/compute.admin	The project	Every deployment. It includes compute.instances.setDeletionProtection, so deletion_protection needs no further role.
roles/storage.admin	The project	Every deployment
roles/secretmanager.admin	The project	Every deployment. The provider keeps the provisioner's inputs during each run in a Secret Manager secret stored only in the cluster's region. A narrower custom role needs secretmanager.secrets.create, secretmanager.secrets.get, secretmanager.versions.add, secretmanager.versions.get, secretmanager.versions.destroy, secretmanager.secrets.delete, secretmanager.secrets.getIamPolicy, and secretmanager.secrets.setIamPolicy.
roles/iam.serviceAccountAdmin	The project	service_account_email is omitted
roles/cloudkms.cryptoKeyEncrypterDecrypter	The KMS key	kms_key_name is set
roles/compute.imageUser	The image, or the project that holds it	node_image, node_image_project, provisioner_image, or provisioner_image_project names an image in another project
roles/iam.serviceAccountTokenCreator	The deploying service account itself	The credentials are an impersonated or federated service account, air_gapped = true, and package_url is not set. Signing then goes through the IAM signBlob API as that account. A service account key signs locally and needs no grant

Node service account

When service_account_email is omitted, the provider creates a service account for the cluster nodes and grants it these roles on the project.

Role	Permissions
roles/storage.objectAdmin	Predefined role
roles/logging.logWriter	Predefined role
roles/monitoring.metricWriter	Predefined role
A custom role created per cluster	compute.instances.get, compute.instances.list, compute.instances.updateNetworkInterface, compute.regions.get

Whether the provider creates the account or you supply it, the provider grants it roles/secretmanager.secretAccessor on the one secret that holds the provisioner's inputs, <deployment_unique_name>-provisioner-secrets. The provider deletes that secret when the cluster is destroyed.

For an account supplied through service_account_email, the provider also grants roles/storage.objectAdmin, roles/logging.logWriter, and roles/monitoring.metricWriter on the project at each provisioner run. It creates no custom role and no service account for it. A cross-project custom image also needs roles/compute.imageUser granted to this account.