Deployment values
The following deployment values can be used to configure the Spectrum LSF cluster instance on IBM Cloud®.
All the permissions are mandatory, therefore all your permissions are set, failing to have these permissions lead to deployment failure. Contact the account administrator for the permissions.
Mandatory deployment values
The following are the mandatory deployment values used to configure the Spectrum LSF cluster instance on IBM Cloud®:
| Value | Description | Is it required? | Default value |
|---|---|---|---|
app_center_gui_password |
Password required to access the IBM Spectrum LSF Application Center (App Center) GUI, which is enabled by default in Fix Pack 15 with HTTPS. This is a mandatory value and omitting it results in deployment failure. The password must meet the following requirements, at least 15 characters in length, and must include one uppercase letter, one lowercase letter, one number, and one special character. | Yes | "" |
existing_resource_group |
Specify the name of the existing resource group in your IBM Cloud account where VPC resources will be deployed. By default, the resource group is set to 'Default.' In some older accounts, it may be default, verify the resource
group name before proceeding. If the value is set to "null", the automation will create two separate resource groups: workload-rg and service-rg. For more details, see Manage Resource Groups. |
Yes | Default |
enable_license_scheduler |
Enable the license scheduler to optimize expensive software license usage by managing license tokens and enabling efficient sharing across projects and clusters. This option is enabled by default, set it to false to disable. | Yes | "" |
enable_webservice |
Enable IBM Spectrum LSF Web Services to allow remote management and interaction with LSF clusters over standard HTTPS. This enables capabilities such as job submission, monitoring, and management without requiring a direct LSF client installation. This option is enabled by default, to disable set it to false. | Yes | true |
enable_appcenter |
Enable IBM Spectrum LSF Application Center to provide a flexible, web-based user interface for cluster users and administrators. This option is disabled by default, to enable set it to true. | Yes | false |
webservice_appcenter_password |
Password required to access IBM Spectrum LSF Web Services and the Application Center GUI over HTTPS. This is a mandatory parameter whenever either Web Services or Application Center is enabled, and must be provided to ensure proper functionality. If omitted, the services will not function as expected and deployment may fail. The password must be at least 15 characters long and include at least one uppercase letter, one lowercase letter, one number, and one special character. Spaces are not allowed. | Yes | "" |
ibmcloud_api_key |
Provide the IBM Cloud API key associated with the account to deploy the IBM Spectrum LSF cluster. This key is used to authenticate your deployment and grant the necessary access to create and manage resources in your IBM Cloud environment, see Managing user API keys. | Yes | None |
remote_allowed_ips |
Comma-separated list of IP addresses that can access the IBM Spectrum LSF cluster instance through an SSH interface. For security purposes, provide the public IP addresses assigned to the devices that are authorized to establish SSH connections (for example, ["169.45.117.34"]). To fetch the IP address of the device, use https://ipv4.icanhazip.com/. | Yes | None |
ssh_keys |
Provide a list of existing SSH key names configured in your IBM Cloud account to enable access to the Spectrum LSF nodes. The solution does not create new SSH keys, so only existing keys must be specified. Ensure that the SSH keys are available in the same resource group and region where the cluster is being provisioned. To pass multiple SSH keys, use the format ["key-name-1", "key-name-2"]. If you don't have an SSH key in your IBM Cloud account, create one by following the provided instructions. For more information, see Create SSH Keys. | Yes | None |
zones |
Specify the IBM Cloud zone within the selected region where the Spectrum LSF cluster will be deployed. All required infrastructure for the solution including cluster nodes, VPC resources, and file storage shares will be provisioned within this single zone. For more information, see Creating a VPC in a different region. | Yes | "us-east-1" |
Optional deployment values
The following are the optional deployment values used to configure the Spectrum LSF cluster instance on IBM Cloud®:
| Value | Description | Is it required? | Default value |
|---|---|---|---|
app_config_plan |
Specify the IBM service pricing plan for the app configuration. Allowed values are 'basic', 'lite', 'standardv2', 'enterprise'. | No | basic |
enable_cspm |
Cloud Security Posture Management (CSPM) is a set of tools and practices that continuously monitor and secure cloud infrastructure. When enabled, it creates a trusted profile with viewer access to the App Configuration and Enterprise services for the SCC Workload Protection instance. Make sure the required IAM permissions are in place, as missing permissions will cause deployment to fail. If CSPM is disabled, dashboard data will not be available. For more information, see About IBM Cloud Security Posture Management (CSPM). | No | true |
sccwp_service_plan |
Specify the plan type for the Security and Compliance Center (SCC) Workload Protection instance. Valid values are free-trial and graduated-tier only. | No | free-trial |
enable_sccwp |
Set this flag to true to create an instance of IBM Security and Compliance Center (SCC) Workload Protection. When enabled, it provides tools to discover and prioritize vulnerabilities, monitor for security threats, and enforce configuration, permission, and compliance policies across the full lifecycle of your workloads. To view the data on the dashboard, enable the CSPM to create the app configuration and required trusted profile policies.For more information, see About IBM Cloud Security Posture Management (CSPM). | No | true |
enable_baremetal |
Set this option to true to provision static compute nodes using bare metal servers. By default, this option is false. When enabled, ensure that the static_compute_instances configuration uses a valid bare metal profile; otherwise,
the deployment will fail. |
No | false |
bastion_instance |
Define the configuration for the bastion node, including the image and instance profile. Only stock Ubuntu 22.04 images are supported. | No | {image = "ibm-ubuntu-22-04-5-minimal-amd64-12" profile = "cx2-4x8"} |
deployer_instance |
Defines the configuration of the deployer node, including the image and instance profile. By default, the deployer node is provisioned using the Fix Pack 15 image, which contains the required software packages, dependencies, and configuration needed for the deployment workflow. Customer-provided or custom images are not supported for the deployer node, as they may not contain the required components, resulting in deployment failures. | No | {image = "hpc-lsf-fp15-deployer-rhel810-v4" profile = "bx2-8x32"} |
vpc_name |
Provide the name of an existing VPC in your IBM Cloud account to deploy the IBM Spectrum LSF cluster and its associated resources. This option is useful when reusing an existing VPC for the cluster deployment. If no value is specified, the solution automatically provisions a new VPC as part of the deployment. For more information, see Create New VPC. | No | None |
vpc_cidr |
An address prefix is created for the new VPC when the vpc_name variable is set to null. This prefix is required to provision subnets within a single zone, and the subnets will be created using the specified CIDR blocks. For more information, see Setting IP ranges. | No | "10.241.0.0/18" |
vpc_cluster_login_private_subnets_cidr_blocks |
Specify the CIDR block for the private subnet used by the login cluster. Only a single CIDR block is required. In hybrid environments, ensure the CIDR range does not overlap with any on-premises networks. Since this subnet is dedicated to login virtual server instances, a /28 CIDR range is recommended. | No | "10.241.16.0/28" |
vpc_cluster_private_subnets_cidr_blocks |
Provide the CIDR block required for the creation of the compute cluster's private subnet. One CIDR block is required. If using a hybrid environment, modify the CIDR block to avoid conflicts with any on-premises CIDR blocks. Ensure the selected CIDR block size can accommodate the maximum number of management and dynamic compute nodes expected in your cluster. For more information on CIDR block size selection, see Choosing IP ranges for your VPC. | No | "10.241.0.0/20" |
mtu_value |
MTU is set to 9000 by default. For deployments using Spectrum Scale with LSF and PPNLB enabled, set the MTU to 8500 or lower to maintain compatibility. It is recommended to use the same MTU value configured on the Spectrum Scale cluster for consistency. | No | 9000 |
login_subnet_id |
Provide the ID of an existing subnet to provision bastion, deployer, and login nodes. If no id is provided, solution creates a new subnet. When providing an existing subnet ID, make sure that the subnet has an associated public gateway. For more information, see IBM Cloud VPC docs. | No | None |
compute_subnet_id |
Provide the ID of an existing subnet to provision VPC file storage shares, management, and compute nodes. If not id is provided, solution creates a new subnet. Ensure that a public gateway is attached to enable VPC API communication. For more information, see IBM Cloud VPC docs. | No | None |
cluster_prefix |
Provide a unique prefix to identify the Spectrum LSF cluster and all associated resources created during cluster deployment. Ensure the value is globally unique to avoid naming conflicts. The prefix must start with a lowercase letter and can include only lowercase letters, digits, and hyphens. Hyphens must always be followed by a lowercase letter or digit, and leading, trailing, or consecutive hyphens are not permitted. The total length must not exceed 15 characters. | No | "hpc-lsf" |
login_instance |
Defines the login node configuration, including the instance profile, image, and optional boot volume settings. By default, the login node is provisioned using the Fix Pack 15 image. You can provision the login node using your own custom image by specifying the desired image name. Boot volume profiles can be general-purpose or sdp. The general-purpose profile supports volumes up to 250 GB, while the sdp profile supports volumes from 100 GB to 32,000 GB with a minimum of 3000 IOPS. Using SDP provides enhanced storage performance, throughput, and scalability for LSF workloads. For more information on selecting the right size, see Boot volume profiles. | No | [{profile = "bx2-2x8" image = "hpc-lsf-fp15-compute-rhel810-v4" boot_volume = {profile = "general-purpose" size = 100 iops = null # null for general-purpose bandwidth = null # only for sdp}}] |
management_instances |
Specify the list of management node configurations, including instance profile, image name, and count. By default, all management nodes are created using Fix Pack 15. The solution allows customization of instance profiles and counts, IBM stock images is not supported. Solution also supports provisioning instances on AMD-based profiles for parallel workloads, with the supported profile hx4da-248x680 available in the Dallas region. In addition, GPU-based profiles are supported, including gx3d-160x1792x8gaudi3, available in the Dallas, Washington, and Frankfurt regions. Boot volume profiles can be general-purpose or sdp. The general-purpose profile supports volumes up to 250 GB, while the sdp profile supports volumes from 100 GB to 32,000 GB with a minimum of 3000 IOPS. Using SDP provides enhanced storage performance, throughput, and scalability for LSF workloads. For more information on selecting the right size, see Boot volume profiles. | No | management_instances = [{profile = "bx2-16x64" count = 2 image = "hpc-lsf-fp15-rhel810-v4" boot_volume = {profile = "general-purpose" size = 100 iops = null # null for general-purpose bandwidth = null # only for sdp}}] |
static_compute_instances |
Specify the list of static compute node configurations, including instance profile, image name, and count. By default, all compute nodes are created using Fix Pack 15. The solution allows customization of instance profiles and counts, IBM Stock image are not supported. You can provision the static compute node using your own custom image by specifying the desired image name. Solution also supports provisioning instances on AMD-based profiles for parallel workloads, with the supported profile hx4da-248x680 available in the Dallas region. In addition, GPU-based profiles are supported, including gx3d-160x1792x8gaudi3, available in the Dallas, Washington, and Frankfurt regions. Boot volume profiles can be general-purpose or sdp. The general-purpose profile supports volumes up to 250 GB, while the sdp profile supports volumes from 100 GB to 32,000 GB with a minimum of 3000 IOPS. Using SDP provides enhanced storage performance, throughput, and scalability for LSF workloads. For more information on selecting the right size, see Boot volume profiles. | No | static_compute_instances = [{profile = "bx2-4x16" count = 0 image = "hpc-lsf-fp15-compute-rhel810-v4" boot_volume = {profile = "general-purpose" size = 100 iops = null # null for general-purpose bandwidth = null # only for sdp}}] |
dynamic_compute_instances |
Specify the list of dynamic compute node configurations, including instance profile, image name, and count. By default, all dynamic compute nodes are created using Fix Pack 15. Currently, only a single instance profile is supported, multiple profiles are not yet supported. Solution supports provision the dynamic compute node using your own custom image by specifying the desired image name. Instances can also be provisioned using AMD-based profiles for parallel workloads, with the supported profile hx4da-248x680 available in the Dallas region. In addition, GPU-based profiles are supported, including gx3d-160x1792x8gaudi3, available in the Dallas, Washington, and Frankfurt regions. Boot volume profiles can be general-purpose or sdp. The general-purpose profile supports volumes up to 250 GB, while the sdp profile supports volumes from 100 GB to 32,000 GB with a minimum of 3000 IOPS. Using SDP provides enhanced storage performance, throughput, and scalability for LSF workloads. For more information on selecting the right size, see Boot volume profiles | No | dynamic_compute_instances = [{profile = "bx2-4x16" count = 500 image = "hpc-lsf-fp15-compute-rhel810-v4" enable_spot_instances = false boot_volume = {profile = "general-purpose" size = 100 iops = null bandwidth = null}}] |
storage_security_group_id |
Provide the storage security group ID from the Spectrum Scale storage cluster when an nfs_share value is specified for a given mount_path in the cluster_file_share variable. This security group is
necessary to enable network connectivity between the Spectrum LSF cluster nodes and the NFS mount point, ensuring successful access to the shared file system. |
No | None |
custom_file_shares |
Provide details for customizing your shared file storage layout, including mount points, sizes (in GB), and IOPS ranges for up to five file shares if using VPC file storage as the storage option.If using IBM Storage Scale as an NFS mount,
update the appropriate mount path and nfs_share values created from the Storage Scale cluster. Note that VPC file storage supports attachment to a maximum of 256 nodes. Exceeding this limit may result in mount point failures
due to attachment restrictions.For more information, see Storage options. |
No | [{ mount_path = "/mnt/vpcstorage/tools", size = 100, iops = 2000 }, { mount_path = "/mnt/vpcstorage/data", size = 100, iops = 6000 }, { mount_path = "/mnt/scale/tools", nfs_share = "" }] |
enable_cos_integration |
Set to true to create an extra COS bucket to integrate with HPC cluster deployment. | No | true |
cos_instance_name |
Provide the name of the existing COS instance where the logs for the enabled functionalities will be stored. | No | None |
enable_vpc_flow_logs |
This flag determines whether VPC flow logs are enabled. When set to true, a flow log collector will be created to capture and monitor network traffic data within the VPC. Enabling flow logs provides valuable insights for troubleshooting, performance monitoring, and security auditing by recording information about the traffic passing through your VPC. Consider enabling this feature to enhance visibility and maintain robust network management practices. | No | true |
enable_vpn |
Enable deployment of a VPN gateway for the VPC in the cluster to establish secure, encrypted connectivity between on-premises infrastructure and cloud resources. By default, this option is set to false; set it to true to enable. The solution supports only the creation of the VPN gateway, and the VPN tunnel must be configured separately based on requirements. | No | false |
enable_hyperthreading |
Enable hyper-threading on the worker nodes of the cluster to allow each physical core to run multiple threads. This can improve performance for parallel or I/O-bound workloads. However, for compute-intensive HPC workloads, the impact may vary depending on the application. This option is disabled by default. | No | true |
observability_atracker_enable |
Activity Tracker Event Routing to configure how to route auditing events. While multiple Activity Tracker instances can be created, only one tracker is needed to capture all events. Creating additional trackers is unnecessary if an existing Activity Tracker is already integrated with a COS bucket. In such cases, set the value to false, as all events can be monitored and accessed through the existing Activity Tracker. | No | true |
observability_atracker_target_type |
Specify the target where Atracker events will be stored—either IBM Cloud Logs or a Cloud Object Storage (COS) bucket—based on the selected value. This allows the logs to be accessed or integrated with external systems. | No | "cloudlogs" |
observability_logs_enable_for_management |
Set false to disable IBM Cloud Logs integration. If enabled, infrastructure and LSF application logs from Management Nodes will be ingested. | No | false |
observability_logs_enable_for_compute |
Set false to disable IBM Cloud Logs integration. If enabled, infrastructure and LSF application logs from Compute Nodes will be ingested. | No | false |
observability_enable_platform_logs |
Setting this to true will create a tenant in the same region that the Cloud Logs instance is provisioned to enable platform logs for that region. Note: You can only have 1 tenant per region in an account. | No | false |
observability_enable_metrics_routing |
Enable metrics routing to manage metrics at the account-level by configuring targets and routes that define where data points are routed. | No | false |
observability_logs_retention_period |
The number of days IBM Cloud Logs will retain the logs data in Priority insights. Allowed values: 7, 14, 30, 60, 90. | No | 7 |
observability_monitoring_enable |
Enables or disables IBM Cloud Monitoring integration. When enabled, metrics from both the infrastructure and LSF application running on Management Nodes will be collected. This must be set to true if monitoring is required on management nodes. | No | true |
observability_monitoring_on_compute_nodes_enable |
Enables or disables IBM Cloud Monitoring integration. When enabled, metrics from both the infrastructure and LSF application running on compute Nodes will be collected. This must be set to true if monitoring is required on compute nodes. | No | false |
observability_monitoring_plan |
Type of service plan for IBM Cloud Monitoring instance. You can choose one of the following: lite, graduated-tier. For all details visit IBM Cloud Monitoring Service Plans. | No | "graduated-tier" |
dns_instance_id |
Specify the ID of an existing IBM Cloud DNS service instance. When provided, domain names are created within the specified instance. If set to null, a new DNS service instance is created, and the required DNS zones are associated with it. | No | None |
dns_domain_name |
IBM Cloud DNS Services domain name to be used for the IBM Spectrum LSF cluster. | No | {compute = "hpc.local"} |
dns_custom_resolver_id |
Specify the ID of an existing IBM Cloud DNS custom resolver to avoid creating a new one. If set to null, a new custom resolver will be created and associated with the VPC. Note: A VPC can be associated with only one custom resolver. When using an existing VPC, if a custom resolver is already associated and this ID is not provided, the deployment will fail. | No | None |
enable_ldap |
Set this option to true to enable LDAP for IBM Spectrum LSF, with the default value set to false. | No | false |
ldap_basedns |
The dns domain name is used for configuring the LDAP server. If an LDAP server is already in existence, ensure to provide the associated DNS domain name. | No | "hpc.local" |
ldap_server |
Provide the IP address for the existing LDAP server. If no address is given, a new LDAP server will be created. | No | None |
ldap_server_cert |
Provide the existing LDAP server certificate. This value is required if the 'ldap_server' variable is not set to null. If the certificate is not provided or is invalid, the LDAP configuration may fail. For more information, see existing LDAP server certificate. | No | None |
ldap_admin_password |
The LDAP admin password must be 15 to 32 characters long and include at least two alphabetic characters (with one uppercase and one lowercase), one number, and one special character from the set (!@#$%^&*()_+=-). The password must not contain the username or any spaces. [This value is ignored for an existing LDAP server]. | No | None |
ldap_user_name |
Custom LDAP User for performing cluster operations. Note: Username should be between 4 to 32 characters, (any combination of lowercase and uppercase letters).[This value is ignored for an existing LDAP server]. | No | "" |
ldap_user_password |
The LDAP user password must be 15 to 32 characters long and include at least two alphabetic characters (with one uppercase and one lowercase), one numeric digit, and at least one special character from the set (!@#$%^&*()_+=-). Spaces are not allowed. The password must not contain the username for enhanced security. [This value is ignored for an existing LDAP server]. | No | "" |
ldap_instance |
Specify the compute instance profile and image to be used for deploying LDAP instances. Only Debian-based operating systems, such as Ubuntu, are supported for LDAP functionality. | No | [{profile = "cx2-2x4" image = "ibm-ubuntu-22-04-5-minimal-amd64-3"}] |
enable_lsf_pay_per_use |
Enabling lsf_pay_per_use provisions LSF cluster nodes using predefined custom images under a pay-per-use pricing model. Billing is based on vCPU usage per hour, considering the enable_hyperthreading configuration.
In this mode, Bring Your Own Image (BYOI) is not supported for any cluster nodes. If enable_lsf_pay_per_use is false, solution provisions all cluster nodes using default images and supports BYOI. Setting enable_lsf_pay_per_use as false does not apply pay-per-use billing. |
No | true |
enable_dedicated_host |
Set this option to true to enable dedicated hosts for the VSIs provisioned as workload servers. The default value is false. When dedicated hosts are enabled, multiple vsi instance profiles from the same or different families (for example, bx2, cx2, mx2) can be used. If you plan to deploy a static cluster with a third-generation profile, ensure that dedicated host support is available in the selected region, as not all regions support third-gen profiles on dedicated hosts. For more information, see x86-64 dedicated host profiles. | No | false |
existing_bastion_instance_name |
Provide the name of the bastion instance. If none given then new bastion will be created. | No | None |
existing_bastion_instance_public_ip |
Provide the public IP address of the existing bastion instance to establish the remote connection. Also using this public IP address, connection to the LSF cluster nodes shall be established. | No | None |
existing_bastion_security_group_id |
Specify the security group ID for the bastion server. This ID will be added as an allowlist rule on the HPC cluster nodes to facilitate secure SSH connections through the bastion node. By restricting access through a bastion server, this setup enhances security by controlling and monitoring entry points into the cluster environment. Ensure that the specified security group is correctly configured to permit only authorized traffic for secure and efficient management of cluster resources. | No | None |
existing_bastion_ssh_private_key |
Provide the private SSH key (named id_rsa) used during the creation and configuration of the bastion server to securely authenticate and connect to the bastion server. This allows access to internal network resources from a secure entry
point. Note: The corresponding public SSH key (named id_rsa.pub) must already be available in the ~/.ssh/authorized_keys file on the bastion host to establish authentication. |
No | None |
key_management |
Set the value as key_protect to enable customer managed encryption for boot volume and file share. If the key_management is set as null, IBM Cloud resources will be always be encrypted through provider managed. |
No | "key_protect" |
kms_instance_name |
Provide the name of the existing Key Protect instance associated with the Key Management Service. Note: To use existing kms_instance_name set key_management as key_protect. For more information,
see View key-protect ID. |
No | None |
kms_key_name |
Provide the existing kms key name that you want to use for the IBM Spectrum LSF cluster. Note: kms_key_name to be considered only if key_management value is set as key_protect(for example kms_key_name:
my-encryption-key). |
No | None |
skip_iam_block_storage_authorization_policy |
When using an existing KMS instance name, set this value to true if authorization is already enabled between KMS instance and the block storage volume. Otherwise, default is set to false. Ensuring proper authorization avoids access issues during deployment. For more information on how to create authorization policy manually, see Creating authorization policies for block storage volume. | No | false |
skip_flowlogs_s2s_auth_policy |
When using an existing COS instance, set this value to true if authorization is already enabled between COS instance and the flow logs service. Otherwise, default is set to false. Ensuring proper authorization avoids access issues during deployment. | No | false |
skip_kms_s2s_auth_policy |
When using an existing COS instance, set this value to true if authorization is already enabled between COS instance and the KMS. Otherwise, default is set to false. Ensuring proper authorization avoids access issues during deployment. | No | false |
skip_iam_share_authorization_policy |
When using an existing KMS instance name, set this value to true if authorization is already enabled between KMS instance and the VPC file share. Otherwise, default is set to false. Ensuring proper authorization avoids access issues during deployment. For more information on how to create authorization policy manually, see creating authorization policies for VPC file share. | No | false |