Skip to main content

Deploying on a Preexisting Cluster


As of release 2023.3 of InterSystems IRIS, InterSystems Cloud Manager (ICM) is deprecated; it will be removed from future versions.

ICM provides you with the option of allocating your own cloud or virtual host nodes or physical servers to deploy containers on. The provisioning phase usually includes allocation and configuration subphases, but when the Provider field is set to PreExisting, ICM bypasses the allocation phase and moves directly to configuration. There is no unprovisioning phase for a preexisting cluster.

The sections that follow describe the requirements for deploying on existing infrastructure using the provider PreExisting.


ICM cannot deploy containers on the host on which it is running. Because ICM has no way to determine the IP address of its host, it is the user’s responsibility to avoid specifying the ICM host as a host node for Preexisting deployment.


ICM requires that SSH be installed and the SSH daemon running.

Additionally, a nonroot account must be specified in the SSHUser field in the defaults file. This account should have the following properties:

  • It must provide sudo access without requiring a password. You can enable this by creating or modifying a file in /etc/sudoers.d/ to contain the following line:

    <accountname> ALL=(ALL) NOPASSWD:ALL

    To prohibit password logins altogether, you can use set the SSHOnly parameter to true. Because this prevents ICM from logging in using a password, it requires that you stage your public SSH key (as specified by the SSHPublicKey field) on each node.

  • If the home directory is located anywhere other than /home, it should be specified in the Home field in the defaults file, for example:

    "Home": "/users/"

    Note that the home directory must not be a network directory shared among nodes (for example /nethome), because this would cause configuration files to overwrite one another.

ICM can log in as SSHUser using SSH keys or password login. Even if password logins are enabled, ICM will always try to log in using SSH first.

If you've configured your machines with SSH keys, you must specify the SSH public/private key pair your configuration file using the SSHPublicKey and SSHPrivateKey fields.

During the configuration phase, ICM configures SSH login and disables password login by default. If you don't wish password login to be disabled, you can touch the following sentinel file in the home directory of the SSHUser account:

mkdir -p ICM
touch ICM/disable_password_login.done

If you've configured your machines with a password, specify it using the SSHPassword field in your configuration file. ICM assumes these credentials are not secure.

Enabling password login and specifying the SSHPassword field does not remove the requirement that ICM be able to carry out all postconfiguration operations via SSH.


To avoid conflicting with local security policies and because of variations among operating systems, ICM does not attempt to open any ports. The following table contains the default ports that must be opened to make use of various ICM features. As described in Port and Protocol Parameters, the ports are configurable, for example:

"SuperServerPort": "51777"

If you change one or more of these fields from the defaults as illustrated, you must ensure that the ports you specify are open.

Port Protocol Service Notes
22 tcp SSH Required.
2376 tcp Docker (TLS mode) Required.
80 tcp Web Required to access the public Apache web server on nodes of role WS (web server).
53 tcp


DNS Required for Weave DNS.




Weave Net Required for Overlay=Weave (default for all providers).
1972 tcp InterSystems IRIS Superserver Required. A different port may be specified using the SuperServerPort field.
52773 tcp InterSystems IRIS Webserver Required. A different port may be specified using the WebServerPort field.
2188 tcp InterSystems IRIS ISCAgent Required for mirroring. A different port may be specified using the ISCAgentPort field.
4002 tcp InterSystems IRIS License Server Required. Note: A different port may be specified using the LicenseServerPort field.

Storage Volumes

As described in Storage Volumes Mounted by ICM, ICM mounts the storage volumes it provides to be used by InterSystems IRIS and Docker under /dev, using names specified by the fields listed in Device Name Parameters; the default mount point of any of these devices can be changed by specifying another location in the corresponding mount point parameter.

To have ICM mount a volume you have prepared on your preexisting infrastructure for use by InterSystems IRIS, you can specify a directory in a mount point parameter and use one of two values for the corresponding device name parameter, as follows:

  • existing (the default) — If the directory specified in the mount point parameter exists, ICM uses it as the storage volume in question; for example, if the value of DataDeviceName is existing or no value is provided, and the value of DataMountPoint is /mnt/data, ICM mounts /mnt/data as the data volume for InterSystems IRIS instances. If the directory specified in the mount point parameter does not exist, no data volume is mounted.

  • create — The same as existing, except that if the directory specified in the mount point parameter does not exist, ICM attempts to create it, and if successful mounts it as the storage volume in question. If ICM cannot create the directory, no storage volume is mounted.

Definitions File for PreExisting

The primary difference between PreExisting and the other providers is the contents of the definitions file, which contains exactly one entry per node, rather than one entry per role with a Count field to specify the number of nodes of that role. Each node is identified by its IP address, using the IPAddress field.

FeedbackOpens in a new tab