qumulo_neuralsearch_azure (Resource)¶

Deploys a single-VM Qumulo NeuralSearch appliance next to an existing Qumulo cluster on Azure. The appliance is one VM in the cluster's VNet and subnet. It needs no managed identity, Key Vault, or Nexus credentials.

Example Usage¶

resource "qumulo_neuralsearch_azure" "search" {
  cluster_reference   = qumulo_filesystem_azure.cluster.cluster_reference
  deletion_protection = true
  # allow_cidrs       = ["10.0.0.0/8"]
}

output "neuralsearch_ui_url" {
  value = qumulo_neuralsearch_azure.search.ui_url
}

Networking Requirements¶

Outbound internet access at boot. The appliance downloads and installs everything on first boot, so its subnet must allow outbound HTTPS to these hosts (typically through a NAT gateway). Without egress the appliance never finishes bootstrapping and the apply fails.
qumulo-neuralsearch.s3.us-west-2.amazonaws.com for the NeuralSearch installer.
get.docker.com and download.docker.com for the Docker install.
public.ecr.aws for the NeuralSearch container images.
The Ubuntu package mirrors for operating system updates.
Azure management plane. The provider checks first-boot progress by running a command on the VM through Azure Run Command, so the VM needs its normal Azure agent connectivity.
Appliance to cluster. The appliance must reach the cluster on TCP 8000 (the Qumulo REST API) and over NFS. Allow these from the appliance's subnet in the cluster's network security group (for qumulo_filesystem_azure, through its allow_cidrs). The appliance's own network security group leaves outbound traffic open.
Private-only web UI. The UI is served on TCP 443 at the appliance's private IP (ui_url), and the VM has no public IP. By default the VirtualNetwork service tag may connect. The tag covers the cluster's virtual network, peered virtual networks, and on-premises networks connected through a VPN gateway or ExpressRoute. Set allow_cidrs to replace it with specific ranges.

Compute and Storage¶

The appliance runs on Standard_D16as_v5 by default (16 vCPU, 64 GiB), set with vm_type.

The OS disk is always 1 TiB (1,024 GiB) and cannot be configured. It is a Premium SSD that the provider raises to the P50 performance tier (7,500 IOPS, 250 MB/s). You are billed at the P50 rate for this disk. The VM size's own disk limits can cap the performance you actually get below the disk's provisioned figures.

Accessing the NeuralSearch VM¶

Password login is disabled and the VM has no public IP. There are two ways in.

Azure Run Command. Run shell commands without any SSH access, using the resource group (resource_group_name, default <cluster_rg>-search) and the VM name (the last segment of vm_id):

az vm run-command invoke --resource-group <resource-group> --name <vm-name> \
  --command-id RunShellScript --scripts "systemctl status neuralsearch"

SSH. Set ssh_public_key and connect as qsadmin from inside the VNet (the network security group's default VNet inbound rule allows it). Without ssh_public_key there is no SSH access.

First-Boot Setup and Signing In¶

Open ui_url in a browser. The UI presents a self-signed TLS certificate at first, so expect a certificate warning on the first connection.

The first-boot setup wizard collects the cluster connection. Terraform does not pass cluster credentials to the appliance. In the wizard, enter the cluster's REST endpoint (for example https://<cluster-ip>:8000), an API key, and the NFS export host. The search index is stored on the cluster in the /.neuralsearch NFS export.

Afterwards, sign in with a Qumulo cluster account (password or SSO) that holds the Administrators or Observers role. Sign-in authenticates against the cluster.

Deletion Protection¶

Set deletion_protection = true to protect the appliance VM from deletion (a CanNotDelete management lock) and to refuse terraform destroy until you set this back to false and run terraform apply first.

Import¶

This resource does not support terraform import. To change an immutable attribute, Terraform replaces the appliance.

Schema¶

Required¶

cluster_reference (Attributes) Cluster identity and Azure placement, wired from qumulo_filesystem_azure..cluster_reference. (see below for nested schema)

Optional¶

allow_cidrs (Set of String) CIDR blocks allowed to reach the NeuralSearch UI on port 443. Omit to leave the default reachability (the cluster's virtual network, via the "VirtualNetwork" service tag) unchanged. Updatable in place: changing this value reconciles the NSG's 443 ingress rule without rebuilding the appliance.
deletion_protection (Boolean) Protects the NeuralSearch appliance VM from deletion. When true, the VM carries a CanNotDelete management lock and terraform destroy is refused until you set this to false and run terraform apply first. Defaults to false.
resource_group_name (String) Azure resource group where the NeuralSearch VM and supporting resources will be created. Defaults to <cluster_rg>-search when omitted.
ssh_public_key (String) SSH public key added to the NeuralSearch VM's authorized_keys. The VM has no password login, so omitting this leaves no SSH access. Use file(var.ssh_public_key_path) to read from a file. Changing this value forces replacement.
tags (Map of String) Tags to apply to all NeuralSearch resources.
timeouts (Block, Optional) (see below for nested schema)
vm_type (String) Azure VM size for the NeuralSearch VM. Defaults to Standard_D16as_v5 (16 vCPU / 64 GiB). Changing this value forces replacement.

Read-Only¶

id (String) Unique identifier for the resource.
nsg_id (String) Azure resource ID of the network security group attached to the NeuralSearch VM's NIC.
private_ip (String) Private IP address assigned to the NeuralSearch VM.
resource_group_created (Boolean) Whether Terraform created the resource group on first apply. Tracked so destroy only removes the resource group when this provider created it.
ui_url (String) URL of the NeuralSearch UI, reachable from within the cluster's VNet.
vm_id (String) Azure resource ID of the deployed NeuralSearch VM.

Nested Schema for `cluster_reference`¶

Required:

cluster_name (String) Bare cluster name (mirrors qumulo_filesystem_azure.cluster_reference.cluster_name). Used to construct operator-recognizable Azure resource names. Changing it forces replacement.
cluster_uuid (String) UUID of the Qumulo cluster the appliance deploys alongside. Changing it forces replacement.
endpoint_ips (List of String) Endpoint IP addresses of the Qumulo cluster, from the filesystem's cluster_reference. Enter the cluster endpoint in the NeuralSearch setup wizard. Does NOT force replacement.
resource_group_name (String) Azure resource group containing the Qumulo cluster. Used to derive the NeuralSearch resource group default (<cluster_rg>-search) when this resource's resource_group_name is omitted. Changing it forces replacement.
subnet_id (String) Subnet resource ID where the NeuralSearch VM's NIC will be placed. Typically the same subnet as the Qumulo cluster. Changing it forces replacement.
uses_floating_ips (Boolean) Whether the cluster uses floating IPs, from the filesystem's cluster_reference. Does NOT force replacement.

Optional:

cluster_api_endpoint (String) Cluster API endpoint, from the filesystem's cluster_reference. Enter the cluster endpoint in the NeuralSearch setup wizard. Does NOT force replacement.

Nested Schema for `timeouts`¶