Skip to content

qumulo_ad (Resource)

Manages Active Directory configuration on a Qumulo cluster.

This resource joins a Qumulo cluster to an Active Directory domain and configures the AD protocol settings (signing, sealing, encryption). It is a singleton resource (one per cluster).

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic AD Join

resource "qumulo_ad" "main" {
  connection_profile = "prod"

  domain      = "corp.example.com"
  ad_username = "svc-qumulo@corp.example.com"
  ad_password = var.ad_service_account_password
}

AD Join with Custom OU and Settings

resource "qumulo_ad" "main" {
  connection_profile = "prod"

  domain      = "corp.example.com"
  ad_username = "svc-qumulo@corp.example.com"
  ad_password = var.ad_service_account_password

  ou                      = "OU=Storage,OU=Servers,DC=corp,DC=example,DC=com"
  use_ad_posix_attributes = true

  signing = "REQUIRE_SIGNING"
  sealing = "REQUIRE_SEALING"
  crypto  = "REQUIRE_AES"

  timeouts {
    create = "15m"
    update = "15m"
    delete = "15m"
  }
}

Multi-Cluster with for_each

variable "clusters" {
  type    = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_ad" "main" {
  for_each = var.clusters

  connection_profile = each.value

  domain      = "corp.example.com"
  ad_username = "svc-qumulo@corp.example.com"
  ad_password = var.ad_service_account_password
}

Import

using the connection profile name (singleton resource, one AD config per cluster):

terraform import qumulo_ad.main prod

Note: After import, you must provide ad_username and ad_password in the configuration for future reconfigure operations. If a destroy is run before credentials are provided, the cluster will force-leave the domain (orphaning the AD computer account).

Schema

Required

  • ad_password (String, Sensitive) AD password for the join account. This is write-only and not stored in state.
  • ad_username (String) AD username with permission to join computers to the domain.
  • connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}
- domain (String) Active Directory domain name to join (e.g., corp.example.com).

Optional

  • base_dn (String) Base DN for LDAP searches. If not specified, uses the domain root.
  • crypto (String) Kerberos encryption requirement: NO_AES, WANT_AES, or REQUIRE_AES. Defaults to WANT_AES.
  • dns_config_id (Number) DNS configuration ID to use for domain lookups. Defaults to 0 (system default).
  • domain_controllers (String) Comma-separated list of domain controller hostnames or IP addresses.
  • domain_netbios (String) NetBIOS name for the domain. If not specified, derived from the domain name.
  • force_leave (Boolean) If true, leave the domain without AD credentials (orphans the computer account in AD). Defaults to false.
  • ou (String) Organizational Unit (OU) path where the computer account will be created.
  • sealing (String) SMB encryption (sealing) requirement: NO_SEALING, WANT_SEALING, or REQUIRE_SEALING. Defaults to WANT_SEALING.
  • search_trusted_domains (Boolean) Search trusted domains for user/group lookups. Defaults to false.
  • signing (String) SMB signing requirement: NO_SIGNING, WANT_SIGNING, or REQUIRE_SIGNING. Defaults to WANT_SIGNING.
  • timeouts (Block, Optional) (see below for nested schema)
  • use_ad_posix_attributes (Boolean) Use POSIX attributes from AD for UID/GID mapping. Defaults to false.

Read-Only

  • dcs (Attributes List) List of discovered domain controllers. (see below for nested schema)
  • id (String) Resource identifier (always 'singleton' as there is one AD config per cluster).
  • status (String) Current AD domain membership status (JOINED, NOT_IN_DOMAIN, etc.).

Nested Schema for timeouts

Optional:

  • create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
  • delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
  • update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

Nested Schema for dcs

Read-Only:

  • address (String) Domain controller IP address.
  • name (String) Domain controller hostname.