qumulo_neuralsearch_gcp (Resource)¶

Deploys a single-VM Qumulo NeuralSearch appliance next to an existing Qumulo cluster on GCP. The appliance is one Compute Engine instance in the cluster's subnetwork. It needs no Secret Manager dependency or Nexus credentials.

Example Usage¶

resource "qumulo_neuralsearch_gcp" "search" {
  cluster_reference   = qumulo_filesystem_gcp.cluster.cluster_reference
  deletion_protection = true
  # allow_cidrs       = ["10.0.0.0/8"]
}

output "neuralsearch_ui_url" {
  value = qumulo_neuralsearch_gcp.search.ui_url
}

Networking Requirements¶

Outbound internet access at boot. The appliance downloads and installs everything on first boot, so its subnetwork must allow outbound HTTPS to these hosts (typically through Cloud NAT). Without egress the appliance never finishes bootstrapping and the apply fails.
qumulo-neuralsearch.s3.us-west-2.amazonaws.com for the NeuralSearch installer.
get.docker.com and download.docker.com for the Docker install.
public.ecr.aws for the NeuralSearch container images.
The Ubuntu package mirrors for operating system updates.
Google Cloud Storage. The instance reports its first-boot status to a Cloud Storage bucket using the gcloud CLI, so the subnetwork needs access to the Google APIs (over the internet through Cloud NAT, or through Private Google Access).
Appliance to cluster. The appliance must reach the cluster on TCP 8000 (the Qumulo REST API) and over NFS. Allow these from the appliance's subnetwork in the cluster's firewall rules (for qumulo_filesystem_gcp, through its allow_cidrs). The VPC's default egress rule leaves outbound traffic open unless you have added a deny rule.
Private-only web UI. The UI is served on TCP 443 at the appliance's private IP (ui_url), and the VM has no public IP. By default only sources inside the cluster's subnetwork CIDR may connect, which is narrower than the AWS and Azure defaults. Other subnetworks in the VPC, peered VPCs, and on-premises networks reached over Cloud VPN or Cloud Interconnect are blocked until you add their CIDRs to allow_cidrs.

Compute and Storage¶

The appliance runs on n2d-standard-16 by default (16 vCPU, 64 GiB), set with machine_type.

The boot disk is always 1 TiB (1,024 GiB) and cannot be configured. It is a pd-ssd persistent disk, whose performance scales with its size and is capped by the machine type. You are billed for the 1 TiB disk for as long as it exists.

Accessing the NeuralSearch VM¶

The VM has no external IP. Set ssh_public_key to add a key to the instance metadata for the qsadmin user, then connect from inside the network. The firewall rule this resource creates allows only TCP 443, so add your own ingress rule for TCP 22 that targets the VM's network tag (the tag equals the instance name). To connect through Identity-Aware Proxy, allow TCP 22 from 35.235.240.0/20 and use gcloud compute ssh --tunnel-through-iap.

First-Boot Setup and Signing In¶

Open ui_url in a browser. The UI presents a self-signed TLS certificate at first, so expect a certificate warning on the first connection.

The first-boot setup wizard collects the cluster connection. Terraform does not pass cluster credentials to the appliance. In the wizard, enter the cluster's REST endpoint (for example https://<cluster-ip>:8000), an API key, and the NFS export host. The search index is stored on the cluster in the /.neuralsearch NFS export.

Afterwards, sign in with a Qumulo cluster account (password or SSO) that holds the Administrators or Observers role. Sign-in authenticates against the cluster.

Deletion Protection¶

Set deletion_protection = true to protect the appliance Compute Engine instance with GCP's native deletionProtection flag and to refuse terraform destroy until you set this back to false and run terraform apply first.

Import¶

This resource does not support terraform import. To change an immutable attribute, Terraform replaces the appliance.

Schema¶

Required¶

cluster_reference (Attributes) Cluster identity and GCP placement, wired from qumulo_filesystem_gcp..cluster_reference. (see below for nested schema)

Optional¶

allow_cidrs (Set of String) CIDR blocks allowed to reach the NeuralSearch UI on port 443. Omit to leave the default reachability (the cluster's subnetwork CIDR) unchanged. Updatable in place: changing this value reconciles the firewall rule's source ranges without rebuilding the appliance.
deletion_protection (Boolean) Protects the NeuralSearch appliance Compute Engine instance from deletion. When true, the instance carries GCP's native deletionProtection flag and terraform destroy is refused until you set this to false and run terraform apply first. Defaults to false.
machine_type (String) Compute Engine machine type for the NeuralSearch VM. Defaults to n2d-standard-16 (16 vCPU / 64 GiB). Changing this value forces replacement.
ssh_public_key (String) SSH public key content appended to the NeuralSearch VM's instance metadata. Use file(var.ssh_public_key_path) to read from a file. Omit to add no key to the instance metadata. Changing this value forces replacement.
tags (Map of String) Labels to apply to all NeuralSearch resources (GCP "labels").
timeouts (Block, Optional) (see below for nested schema)

Read-Only¶

firewall_rule_name (String) Name of the firewall rule attached to the NeuralSearch VM.
id (String) Unique identifier for the resource.
instance_id (String) Compute Engine instance self-link (or name) of the deployed NeuralSearch VM.
owns_service_account (Boolean) Whether the provider created (and therefore deletes) the NeuralSearch service account.
private_ip (String) Internal IP address assigned to the NeuralSearch VM's network interface.
service_account_email (String) Email of the service account the NeuralSearch VM runs as.
signaling_bucket (String) Name of the GCS bucket the appliance's first-boot startup-script writes its bootstrap status to. Persisted so Delete can remove it.
ui_url (String) URL of the NeuralSearch UI, reachable from within the cluster's network.

Nested Schema for `cluster_reference`¶

Required:

cluster_name (String) Bare cluster name (mirrors qumulo_filesystem_gcp.cluster_reference.cluster_name). Lowercased into the Compute Engine instance, firewall rule, GCS signaling bucket, service account, and network-tag names so GCP console listings show which cluster a NeuralSearch resource belongs to. Must begin with a letter (GCP resource names embedded with this value require a leading letter). Changing it forces replacement.
cluster_uuid (String) UUID of the Qumulo cluster the appliance deploys alongside. Changing it forces replacement.
endpoint_ips (List of String) Endpoint IP addresses of the Qumulo cluster, from the filesystem's cluster_reference. Enter the cluster endpoint in the NeuralSearch setup wizard. Does NOT force replacement.
project_id (String) GCP project the cluster is deployed in. The NeuralSearch VM deploys in the same project. Changing it forces replacement.
region (String) GCP region the cluster is deployed in. The NeuralSearch VM deploys in the <region>-b zone. Changing it forces replacement.
subnet_cidr (String) Primary IPv4 CIDR block of the cluster's subnetwork. Used as the inbound allow source on the NeuralSearch firewall rule. Changing it forces replacement.
subnet_id (String) Subnetwork (name or self-link) the Qumulo cluster lives in. The NeuralSearch VM's network interface is placed in it. Changing it forces replacement.
uses_floating_ips (Boolean) Whether the cluster uses floating IPs, from the filesystem's cluster_reference. Does NOT force replacement.

Optional:

cluster_api_endpoint (String) Cluster API endpoint, from the filesystem's cluster_reference. Enter the cluster endpoint in the NeuralSearch setup wizard. Does NOT force replacement.

Nested Schema for `timeouts`¶