Size L - Sonatype IQ - GCP Cloud-Native Reference Architecture

This Sonatype IQ Server large reference architecture describes the recommended infrastructure specifications for deploying a high-availability IQ Server environment in Google Cloud Platform (GCP) using cloud-native services. It supports environments with 10,000–19,999 applications and an expected throughput of approximately 310 evaluations per hour per node, or approximately 14,880–22,320 evaluations per day total.

This reference architecture is designed for production environments that require high availability, increased evaluation capacity, and resilient managed infrastructure. The L profile expands the multi-node architecture introduced in the M profile by using three IQ Server nodes and requiring regional database failover capabilities.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – IQ Server application runtime
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, load balancing, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Three IQ Server nodes:

• 8 vCPU
• 64 GB RAM

JVM configuration:

• -Xms48g
• -Xmx48g

Example GCP machine type:

• n4a-highmem-8 (ARM Ampere Altra)

Database Layer (Cloud SQL PostgreSQL)

This layer meets the following specifications:

• Service: Cloud SQL PostgreSQL 15+
• Instance tier: db-custom-8-30720
• Database resources: 8 vCPU, 30 GB RAM
• Edition: Enterprise
• Storage: 200 GB – 1 TB PD-SSD, auto-resize
• Availability: Regional with automatic failover

Storage Layer (Cloud Filestore)

Cloud Filestore provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Cloud Filestore
• Tier: BASIC_HDD
• Capacity: 2.5 TiB
• Protocol: NFS v3
• IOPS: 600 read / 1,000 write

Network and Security

Typical deployment patterns include the following:

• Google Cloud Load Balancer in front of IQ Server nodes
• Private connectivity between IQ Server, Cloud SQL, and Cloud Filestore
• IQ Server nodes distributed across multiple zones where possible

Apply standard network security practices, including the following:

• VPC firewall rules following least-privilege principle
• Cloud NAT for outbound internet access
• Secret Manager for credential and secret management
• Cloud Logging and Cloud Monitoring for centralized logging and monitoring

Limitations

This architecture has the following limitations:

• This architecture requires multiple IQ Server nodes and introduces additional operational complexity compared to smaller single-instance profiles.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may require additional node scaling.
• This architecture does not provide cross-region disaster recovery.
• Shared storage throughput and database performance should be monitored as evaluation workloads increase.
• Regional Cloud SQL deployments provide failover protection within a region only.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for GCP deployments. This automates the creation and configuration of all required GCP resources, including networking, compute, storage, and security components.