Size M - Sonatype IQ - GCP Cloud-Native Reference Architecture

This Sonatype IQ Server medium reference architecture describes the recommended infrastructure specifications for deploying a single-instance or high-availability IQ Server environment in Google Cloud Platform (GCP) using cloud-native services. It supports environments with 2,000–9,999 applications and an expected throughput of approximately 310 evaluations per hour per node, or approximately 7,440 evaluations per day per node.

This reference architecture is appropriate for production environments that require higher evaluation throughput, larger onboarding capacity, and support for either single-instance or high-availability deployments. The M profile represents the transition point from smaller single-node deployments to larger multi-node high-availability architectures.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – IQ Server application runtime
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Two IQ Server nodes:

• 8 vCPU
• 64 GB RAM

JVM configuration:

• -Xms48g
• -Xmx48g

Example GCP machine type:

• n4a-highmem-8 (ARM Ampere Altra)

Database Layer (Cloud SQL PostgreSQL)

This layer meets the following specifications:

• Service: Cloud SQL PostgreSQL 15+
• Instance tier: db-custom-8-30720
• Database resources: 8 vCPU, 30 GB RAM
• Edition: Enterprise
• Storage: 100 GB PD-SSD, auto-resize to 500 GB
• Availability: Zonal deployment (regional recommended for production)

Regional Cloud SQL deployment is recommended for production environments that require improved resilience and automatic failover capabilities.

Storage Layer (Cloud Filestore)

Cloud Filestore provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Cloud Filestore
• Tier: BASIC_HDD
• Capacity: 1 TiB
• Protocol: NFS v3
• IOPS: 600 read / 1,000 write

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node for single-instance deployments
• Google Cloud Load Balancer in front of IQ Server nodes for high-availability deployments
• Private connectivity between IQ Server, Cloud SQL, and Cloud Filestore

Apply standard network security practices, including the following:

• VPC firewall rules following least-privilege principle
• Cloud NAT for outbound internet access
• Secret Manager for credential and secret management
• Cloud Logging and Cloud Monitoring for centralized logging and monitoring

Limitations

This architecture has the following limitations:

• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• Zonal Cloud SQL deployments do not provide automatic failover unless regional deployment is enabled.
• This architecture does not provide cross-region disaster recovery.
• Shared storage throughput and database performance should be monitored as evaluation workloads increase.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for GCP deployments. This automates the creation and configuration of all required GCP resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.