qumulo_cluster_ssl (Resource)

Manages SSL/TLS settings on a Qumulo cluster.

This resource configures the cluster's SSL certificate, CA certificate for outbound connections, and TLS cipher suites.

~> Note: The certificate and private_key attributes are write-only. They cannot be read back from the cluster, so they are preserved in state from the configuration. If you change these values outside of Terraform, the state will not reflect the change.

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Server Certificate Only

resource "qumulo_cluster_ssl" "main" {
  connection_profile = "prod"

  certificate = file("server.pem")
  private_key = file("server-key.pem")
}

Full SSL Configuration

resource "qumulo_cluster_ssl" "main" {
  connection_profile = "prod"

  # Server certificate (write-only)
  certificate = file("server.pem")
  private_key = file("server-key.pem")

  # CA for outbound connections (e.g., to LDAP servers)
  ca_certificate = file("ca.pem")

  # TLS cipher suites
  tls_1_2_ciphers = [
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  ]
  tls_1_3_ciphers = [
    "TLS_AES_256_GCM_SHA384",
    "TLS_AES_128_GCM_SHA256",
  ]
}

Cipher Configuration Only

resource "qumulo_cluster_ssl" "main" {
  connection_profile = "prod"

  tls_1_2_ciphers = [
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
  ]
  tls_1_3_ciphers = [
    "TLS_AES_256_GCM_SHA384",
  ]
}

Schema

Required

• connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

Optional

• ca_certificate (String) PEM-encoded CA certificate for outbound connections (e.g., to LDAP or AD servers with custom CAs).
• certificate (String, Sensitive) PEM-encoded SSL certificate for the cluster's HTTPS interface. This is write-only and cannot be read back from the cluster.
• private_key (String, Sensitive) PEM-encoded private key for the SSL certificate. This is write-only and cannot be read back from the cluster.
• tls_1_2_ciphers (List of String) List of TLS 1.2 cipher suites to enable. If not specified, cluster defaults are used.
• tls_1_3_ciphers (List of String) List of TLS 1.3 cipher suites to enable. If not specified, cluster defaults are used.