# Size L - Sonatype IQ - GCP Cloud-Native Reference Architecture

This Sonatype IQ Server large reference architecture describes the recommended infrastructure specifications for deploying a high-availability IQ Server environment in Google Cloud Platform (GCP) using cloud-native services. It supports environments with **10,000–19,999 applications** and an expected throughput of **approximately 310 evaluations per hour per node**, or approximately **14,880–22,320 evaluations per day total**.

This reference architecture is designed for production environments that require high availability, increased evaluation capacity, and resilient managed infrastructure. The L profile expands the multi-node architecture introduced in the M profile by using three IQ Server nodes and requiring regional database failover capabilities.

## Infrastructure Specifications

This architecture includes the following layers:

- **Compute Layer** – IQ Server application runtime
- **Database Layer** – PostgreSQL metadata database
- **Storage Layer** – Shared file storage for IQ Server data
- **Network Layer** – Connectivity, load balancing, and security controls

## Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Three IQ Server nodes:

- 8 vCPU
- 64 GB RAM

JVM configuration:

- `-Xms48g`
- `-Xmx48g`

Example GCP machine type:

- `n4a-highmem-8` (ARM Ampere Altra)

## Database Layer (Cloud SQL PostgreSQL)

This layer meets the following specifications:

- Service: Cloud SQL PostgreSQL 15+
- Instance tier: `db-custom-8-30720`
- Database resources: 8 vCPU, 30 GB RAM
- Edition: Enterprise
- Storage: 200 GB – 1 TB PD-SSD, auto-resize
- Availability: Regional with automatic failover

## Storage Layer (Cloud Filestore)

Cloud Filestore provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

- Service: Cloud Filestore
- Tier: BASIC_HDD
- Capacity: 2.5 TiB
- Protocol: NFS v3
- IOPS: 600 read / 1,000 write

## Network and Security

Typical deployment patterns include the following:

- Google Cloud Load Balancer in front of IQ Server nodes
- Private connectivity between IQ Server, Cloud SQL, and Cloud Filestore
- IQ Server nodes distributed across multiple zones where possible

Apply standard network security practices, including the following:

- VPC firewall rules following least-privilege principle
- Cloud NAT for outbound internet access
- Secret Manager for credential and secret management
- Cloud Logging and Cloud Monitoring for centralized logging and monitoring

## Limitations

This architecture has the following limitations:

- This architecture requires multiple IQ Server nodes and introduces additional operational complexity compared to smaller single-instance profiles.
- Increasing scan volume or concurrent evaluations beyond the recommended profile may require additional node scaling.
- This architecture does not provide cross-region disaster recovery.
- Shared storage throughput and database performance should be monitored as evaluation workloads increase.
- Regional Cloud SQL deployments provide failover protection within a region only.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for GCP deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required GCP resources, including networking, compute, storage, and security components.