qumulo_neuralsearch_aws (Resource)¶

Deploys a single-VM Qumulo NeuralSearch appliance next to an existing Qumulo cluster on AWS. The appliance is one EC2 instance in the cluster's VPC and subnet. It needs no Nexus credentials.

Example Usage¶

resource "qumulo_neuralsearch_aws" "search" {
  cluster_reference   = qumulo_filesystem_aws.cluster.cluster_reference
  deletion_protection = true
  # allow_cidrs       = ["10.0.0.0/8"]
}

output "neuralsearch_ui_url" {
  value = qumulo_neuralsearch_aws.search.ui_url
}

Networking Requirements¶

Outbound internet access at boot. The appliance downloads and installs everything on first boot, so its subnet must allow outbound HTTPS to these hosts (typically through a NAT gateway). Without egress the appliance never finishes bootstrapping and the apply fails.
qumulo-neuralsearch.s3.us-west-2.amazonaws.com for the NeuralSearch installer.
get.docker.com and download.docker.com for the Docker install.
public.ecr.aws for the NeuralSearch container images.
The Ubuntu package mirrors for operating system updates.
AWS Systems Manager. The instance reports its first-boot status to an SSM parameter through ssm.<region>.amazonaws.com on TCP 443, so the subnet needs a route to that endpoint or an SSM VPC interface endpoint with private DNS enabled. If the status never arrives, the apply waits until its create timeout expires.
Appliance to cluster. The appliance must reach the cluster on TCP 8000 (the Qumulo REST API) and over NFS. Allow these from the appliance's subnet in the cluster's security group (for qumulo_filesystem_aws, through its allow_cidrs or your own bring-your-own security groups). The appliance's own security group leaves outbound traffic open.
Private-only web UI. The UI is served on TCP 443 at the appliance's private IP (ui_url), and the VM has no public IP. By default only sources inside the cluster's VPC CIDR may connect. Peered VPCs and on-premises networks reached over Site-to-Site VPN or Direct Connect fall outside that range, so add their CIDRs to allow_cidrs.

Compute and Storage¶

The appliance runs on m6a.4xlarge by default (16 vCPU, 64 GiB), set with instance_type.

The OS disk is always 1 TiB (1,024 GiB) and cannot be configured. It is a gp3 volume provisioned at 80,000 IOPS and 2,000 MiB/s. gp3 includes 3,000 IOPS and 125 MiB/s, so you are billed for the provisioned IOPS and throughput above that baseline in addition to the volume itself. The instance type's own EBS limits can cap the performance you actually get below the volume's provisioned figures.

Accessing the NeuralSearch VM¶

The VM has no public IP. Reach it with AWS Systems Manager Session Manager:

aws ssm start-session --target <instance-id> --region <region>

The instance ID is the instance_id attribute of this resource, and the instance role includes the AmazonSSMManagedInstanceCore policy that Session Manager needs. To use SSH instead, set ec2_key_pair and add your own ingress rule for TCP 22 to the appliance's security group (security_group_id), because the security group this resource creates allows only TCP 443.

First-Boot Setup and Signing In¶

Open ui_url in a browser. The UI presents a self-signed TLS certificate at first, so expect a certificate warning on the first connection.

The first-boot setup wizard collects the cluster connection. Terraform does not pass cluster credentials to the appliance. In the wizard, enter the cluster's REST endpoint (for example https://<cluster-ip>:8000), an API key, and the NFS export host. The search index is stored on the cluster in the /.neuralsearch NFS export.

Afterwards, sign in with a Qumulo cluster account (password or SSO) that holds the Administrators or Observers role. Sign-in authenticates against the cluster.

Deletion Protection¶

Set deletion_protection = true to protect the appliance EC2 instance from termination and to refuse terraform destroy until you set this back to false and run terraform apply first.

Import¶

This resource does not support terraform import. To change an immutable attribute, Terraform replaces the appliance.

Schema¶

Required¶

cluster_reference (Attributes) Cluster identity and AWS placement, wired from qumulo_filesystem_aws..cluster_reference. (see below for nested schema)

Optional¶

allow_cidrs (Set of String) CIDR blocks allowed to reach the NeuralSearch UI on port 443. Omit to leave the default reachability (the cluster's VPC CIDR) unchanged. Updatable in place: changing this value reconciles the security group's 443 ingress rule without rebuilding the appliance.
deletion_protection (Boolean) Protects the NeuralSearch appliance EC2 instance from deletion. When true, the instance carries EC2 termination protection (DisableApiTermination) and terraform destroy is refused until you set this to false and run terraform apply first. Defaults to false.
ec2_key_pair (String) EC2 key pair name for SSH access to the NeuralSearch VM. Omit to rely on AWS Systems Manager Session Manager only. Changing this value forces replacement.
instance_type (String) EC2 instance type for the NeuralSearch VM. Defaults to m6a.4xlarge (16 vCPU / 64 GiB / AMD). Changing this value forces replacement.
tags (Map of String) Tags to apply to all NeuralSearch resources.
timeouts (Block, Optional) (see below for nested schema)

Read-Only¶

bootstrap_status_parameter (String) Name of the SSM parameter the appliance's cloud-init writes its first-boot bootstrap status to.
iam_role_name (String) Name of the IAM role attached to the NeuralSearch VM via its instance profile.
id (String) Unique identifier for the resource.
instance_id (String) EC2 instance ID of the deployed NeuralSearch VM.
instance_profile_arn (String) ARN of the IAM instance profile attached to the NeuralSearch VM.
private_ip (String) Private IP address assigned to the NeuralSearch VM.
security_group_id (String) ID of the security group attached to the NeuralSearch VM.
ui_url (String) URL of the NeuralSearch UI, reachable from within the cluster's VPC.

Nested Schema for `cluster_reference`¶

Required:

cluster_name (String) Bare cluster name (mirrors qumulo_filesystem_aws.cluster_reference.cluster_name). Used to construct operator-recognizable AWS resource names. Changing it forces replacement.
cluster_uuid (String) UUID of the Qumulo cluster the appliance deploys alongside. Changing it forces replacement.
endpoint_ips (List of String) Endpoint IP addresses of the Qumulo cluster, from the filesystem's cluster_reference. Enter the cluster endpoint in the NeuralSearch setup wizard. Does NOT force replacement.
region (String) AWS region the cluster is deployed in. The NeuralSearch VM deploys in the same region. Changing it forces replacement.
subnet_ids (List of String) Subnet IDs the Qumulo cluster spans. The NeuralSearch VM is placed in the first subnet. Changing it forces replacement.
uses_floating_ips (Boolean) Whether the cluster uses floating IPs, from the filesystem's cluster_reference. Does NOT force replacement.
vpc_cidr (String) Primary IPv4 CIDR block of the cluster's VPC. Used as the inbound allow source on the NeuralSearch security group. Changing it forces replacement.
vpc_id (String) ID of the VPC the cluster is deployed in. The NeuralSearch VM deploys in the same VPC. Changing it forces replacement.

Optional:

cluster_api_endpoint (String) Cluster API endpoint, from the filesystem's cluster_reference. Enter the cluster endpoint in the NeuralSearch setup wizard. Does NOT force replacement.

Nested Schema for `timeouts`¶