---
name: hpc-ibm-spectrumlsf-before-deploying
title: Before you begin deploying
description: ''
last-updated: 2026-02-25
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/hpc-ibm-spectrumlsf?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:shortdesc: .shortdesc}
{:codeblock: .codeblock}
{:screen: .screen}
{:external: target="_blank" .external}
{:pre: .pre}
{:tip: .tip}
{:note: .note}
{:important: .important}
{:step: data-tutorial-type='step'}
{:table: .aria-labeledby="caption"}

# Before you begin deploying
{: #getting-started-tutorial}
{: toc-content-type="tutorial"}

IBM® Spectrum LSF allows users to deploy HPC clusters with LSF as the scheduling software, leveraging Terraform and IBM Cloud Schematics for automation.

IBM Spectrum LSF solution does not support bare metal-based deployments. All the deployments are based on the VSI. Make sure to provide the valid instance profiles.
{: important}

## Confirm your IBM Cloud® settings
{: #confirm-cloud-settings}

Complete the following steps before you deploy the IBM® Spectrum LSF deployable architecture.

1. Confirm that you have an IBM Cloud Pay-As-You-Go or Subscription account. If you have a Trial or Lite account, [upgrade your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account&format=markdown).

2. Log in to your [IBM Cloud](https://cloud.ibm.com){: external} account with your IBM ID.

## Setting IAM permissions - CLI
{: #setting-iam-permissions}

Before deploying an IBM Spectrum LSF cluster, specific IAM permissions must be assigned to either a user or an access group. The automation script enables this process.

User has the flexibility to run the specific scripts to gain the required IAM permissions to perform the LSF deployment. The automation ensures that if the user has a certain permissions, then the script omits them and add only the required permissions to perform the deployment.

For example, for the **App configuration** service, the user requires Administrator and Manager permissions. If the user already has the Administrator permission, then the script omits this and provide only Manager permission.

As an admin, you need to have the following permissions to perform the deployment:
* Administrator for All Identity and Access enabled service
* Administrator for IAM Identity Service
* Administrator for All Account Management services

Benefits of the scripts:

* **Interactive input collection** - The script prompts for the IBMid (admin email), Account ID, and target (User or Access Group).
* **Permission check** - The script verifies that the admin has account-level Administrator rights which are required to assign policies.
* **Assigns required permissions for LSF deployment** - This script grants the appropriate permissions across IBM Cloud services that LSF depends upon (for example, VPC, COS, DNS services, KMS, Secrets Manager, and Sysdig Monitoring).
* **Avoids duplicates** - The script skips the assignment if a matching policy already exists.

You can get the scripts by performing **gitclone** on the branch:

```pre
git clone -b main https://github.com/terraform-ibm-modules/terraform-ibm-hpc.git
```

1. Navigate to `cd tools/access-management`, you get the `permissions.sh` file.
2. Login to the IBM Cloud with your API key. Run the following command:

    ```pre
    a. ibmcloud login --apikey <YOUR_API_KEY> -g <RESOURCE_GROUP>
    b. chmod +x permissions.sh
    c. ./permissions.sh
    ```

3. Enter the admin email or IBMid.
4. Enter the Account ID.

    For the Account ID, login to the IBM Cloud account by using your unique credentials. Go to **Manage** > **Account** > **Account settings**. You will find the Account ID.
5. You are asked to assign the roles:
    1. **Access Group** - Select this option, if you want to assign the access to the entire access group.
    2. **User** - Select this option, if you want to assign the access to an individual user.

    Select the required option.
6. Enter the target user email, if you select the option 2.
7. User policy is successfully created.

If the user skips to enter the `ACCOUNT_ID`, then script displays the error message:

```pre
:x: ACCOUNT_ID is required.
```

This script ensures the user or access group has all the required IAM permissions to successfully deploy an LSF environment.

## Setting IAM permissions - UI
{: #verify-access-policies}

IBM Cloud&reg; Identity and Access Management (IAM) access policies are required to install this deployable architecture and provision clusters.

To view access policies, complete the following steps:

1. In the IBM Cloud console, select **Manage > Access (IAM)**.
2. In the _IAM_ navigation menu, select **Users** and then select the account user.
3. Select **Access** to view the associated access policies and access groups. See the following table for the permissions that you need for this deployable architecture:

   | Service | Resources | Platform roles | Service roles |
   | ------- | --------- | ---- | ---- |
   | App configuration | All | Administrator | Manager |
   | All Identity and Access enabled services | All | Administrator | Manager |
   | Cloud Object Storage | All | Service Configuration Reader | Writer |
   | DNS Services | All | Editor | Manager |
   | IAM Identity Service | All | Administrator | -- |
   | Cloud Monitoring | All | Administrator | Manager |
   | Key Protect | All | Service Configuration Reader | Manager |
   | Secrets Manager | All | Administrator | Manager |
   | Security and Compliance Center Workload Protection | All | Administrator | -- |
   | VPC Infrastructure Services | All | Editor | -- |
   {: caption="Verify access policies" caption-side="bottom"}

   The above-mentioned permissions are mandatory, failing to have these permissions lead to deployment failure. Contact the account administrator for the permissions.
   {: tip}

## Gather LSF entitlement information
{: #gather-lsf-entitlement-information}

The offering uses Bring Your Own Licenses (BYOL) for Spectrum LSF when you deploy an LSF cluster on IBM Cloud. For production clusters, work with your business owners or license management team to make sure that your organization has procured enough licenses to deploy the HPC cluster by using IBM Spectrum LSF. Failure to comply with licenses for production use of software is a violation of the [IBM International Program License Agreement](https://www.ibm.com/software/passportadvantage/licensing){: external}.

The current solution no longer requires `ibm_customer_number`(ICN) for entitlement check before deploying the solution for non-production use. The solution is now available for use without ICN validation. Users can provision up to a maximum of 10 static worker nodes for evaluation or non-production use cases. If the number of worker nodes exceeds 10, it becomes the user responsibility to obtain the necessary entitlement check and licensing for those additional nodes in the production environment. For production use or for evaluating greater than 10 worker nodes, the user must purchase the necessary LSF licenses. To purchase the license, go to [Purchasing licenses](https://www.ibm.com/docs/en/devops-test-embedded/9.0.0?topic=licenses-purchasing).
{: important}

## Before you begin
{: #before-begin}

Before you can deploy your Spectrum LSF cluster, you need to create or gather some information. To get started, complete the following steps.

## Create an IBM Cloud API key
{: #create-api-key}
{: step}

Verify that you have an IBM Cloud API key. `ibmcloud_api_key` is the value required for this variable. For more information, see [Creating an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=ui&format=markdown#create_user_key).

## Create an SSH key
{: #create-ssh-key}
{: step}

Make sure that you have an SSH key that you can use for authentication and that it is uploaded to IBM Cloud VPC. The IBM&reg; Spectrum LSF deployable architecture supports either RSA or Ed 25519 key types. This key is used to log in to all VSIs that you create. Make sure that you use the same key types in an LSF cluster (for example, deploy management and compute nodes with the same key). `ssh_keys` is the value required for this variable. For more information about creating SSH keys, see [SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&format=markdown).

## Generate the remote IP to access Spectrum LSF cluster
{: #generate-remote-ip}
{: step}

This is a mandatory value configured through the Catalog tile and requires a valid IP address range or CIDR format to allow access to the LSF cluster. This value is required for variable `remote_allowed_ips`.

If this field is left empty (for example, [""]) or not provided, then the cluster deployment fails during the initial setup phase. It is essential to supply a valid entry to proceed with a successful deployment.

For more information on mandatory and optional deployment values, see [Deployment values](https://cloud.ibm.com/docs/hpc-ibm-spectrumlsf?topic=hpc-ibm-spectrumlsf-deployment-values&format=markdown) topic.

## Application center password
{: #app-center}
{: step}

For FP15, Application Center is enabled by default to support job submission, workflow management, and monitoring.
To access the GUI, a valid password must be provided. If an appropriate password is not specified, the deployment fails. `app_center_gui_password` is the value required for this variable.

## Enabling optional values
{: #optional-values}
{: step}

IBM Spectrum LSF also provides some optional or advanced features such as Observability, Monitoring, Cloud Logs, SCC integration, Hyperthreading, Existing Bastion Support, KMS and more.

If you want to enable and configure any of these features for your cluster, ensure to update the corresponding values accordingly. Note that certain features may be enabled by default.

Also, ensure that the necessary IAM permissions are in place when enabling these features. The required IAM permissions are mentioned in the above section [Verify access policies](https://cloud.ibm.com/docs/hpc-ibm-spectrumlsf?topic=hpc-ibm-spectrumlsf-getting-started-tutorial&format=markdown#verify-access-policies).

## Next steps
{: #getting-started-next-steps}
{: step}

After you create and gathered your information and reviewed any additional prerequisites for your interface of choice, you are ready to begin [Deploying IBM Spectrum LSF](https://cloud.ibm.com/docs/hpc-ibm-spectrumlsf?topic=hpc-ibm-spectrumlsf-deploy-architecture&interface=ui&format=markdown).

Before an actual deployment is done, you need to analysis the required amount of capacity in terms of vCPU and memory, so that the deployment does not fail due to capacity concerns.
{: note}

## Select the method for accessing the cluster (Post deployment)
{: #select-method-for-accessing-cluster}

The values for `remote_allowed_ips` must be provided to identify a list of IP addresses of systems that can access the bastion node. All the cluster nodes can be directly accessed through bastion nodes (except dynamic nodes).

See the following example SSH command syntax for accessing different types of nodes:

* Deployer node:

    ```ssh
    ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -J ubuntu@<replace this with your bastion_node IP address> vpcuser@<replace this with your deployer_node IP address>
    ```
    {: codeblock}

* Login node:

    ```ssh
    ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -J ubuntu@<replace this with your bastion_node IP address> lsfadmin@<replace this with your login_node IP address>
    ```
    {: codeblock}

* Management node:

    ```ssh
    ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -J ubuntu@<replace this with your bastion_node IP address> lsfadmin@<replace this with your management_node IP address>
    ```
    {: codeblock}

* Static compute node:

    ```ssh
    ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -J ubuntu@<replace this with your bastion_node IP address> lsfadmin@<replace this with your static_compute_node IP address>
    ```
    {: codeblock}

![Command output](images/SSH_command_output.png "Command output"){: caption="Command output" caption-side="bottom"}

This worker node instance type supports a combination of multiple instance profile type that might be chosen for different number of instance count.
For example, you might choose 100 instance to be created from `bx2-4x16` and 10 instance from `mx3d-8x80`. So, you would get a total count of 110 static worker nodes with different instance profile, based on your requirement.