Size L - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server large reference architecture describes the recommended infrastructure specifications for deploying a high-availability IQ Server environment in Microsoft Azure using cloud-native services. It supports environments with 10,000–19,999 applications and an expected throughput of approximately 310 evaluations per hour per node, or approximately 14,880–22,320 evaluations per day total.

This reference architecture is designed for production environments that require high availability, increased evaluation capacity, and resilient managed infrastructure.

Infrastructure Specifications

This reference architecture defines a high-availability IQ Server deployment supported by Azure-managed infrastructure services.

This architecture includes the following layers:

• Compute Layer – High-availability IQ Server application cluster
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Load balancing, connectivity, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Three IQ Server nodes:

• 8 vCPU per node
• 64 GB RAM per node

JVM configuration per node:

• -Xms48g
• -Xmx48g

Example Azure instance types:

• Standard_E8ps_v6 for ARM-based deployments
• Standard_E8_v5 for x86-based deployments

This architecture requires a high-availability IQ Server deployment. IQ Server nodes should be deployed behind a load balancer and distributed across availability zones where possible.

Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

• Service: Azure Database for PostgreSQL - Flexible Server
• SKU: GP_Standard_D8s_v3
• Database resources:
  • 8 vCores
  • 32 GB RAM
• Storage:
  • 200 GB – 1 TB
  • Auto-scaling enabled
• Zone redundancy required

Zone redundancy is required at this tier to support production availability and reduce the risk of database downtime caused by zone-level failures.

Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

• Service: Azure Files - Standard HDD
• Protocol: SMB 3.0
• Zone-redundant storage (ZRS)
• Estimated capacity: 500 GB – 1.5 TB

ZRS is required for this architecture because it replicates storage data across multiple Azure availability zones within a region.

Network and Security

This architecture uses load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

• Azure Application Gateway or Load Balancer in front of IQ Server nodes
• Private connectivity between IQ Server, PostgreSQL, and Azure Files
• IQ Server nodes distributed across availability zones
• Private subnets for database and storage infrastructure

Apply standard network security practices, including the following:

• Network Security Groups following least-privilege principle
• Azure NAT Gateway for outbound internet access
• Azure Key Vault for credential and secret management
• Azure Monitor and Log Analytics for centralized logging and monitoring
• Private networking for database and storage services where possible
• TLS encryption for inbound and internal service communication

Limitations

This architecture has the following limitations:

• This architecture requires high availability and introduces additional operational complexity compared to smaller single-instance profiles.
• This architecture does not provide cross-region disaster recovery.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• Shared storage throughput and database performance may become bottlenecks if infrastructure sizing is not adjusted alongside workload growth.
• Azure Files Standard HDD is appropriate for the stated profile, but storage performance should be monitored as evaluation volume and reporting activity increase.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for Azure deployments. This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.