# Size M - Sonatype IQ - GCP Cloud-Native Reference Architecture

This Sonatype IQ Server medium reference architecture describes the recommended infrastructure specifications for deploying a single-instance or high-availability IQ Server environment in Google Cloud Platform (GCP) using cloud-native services. It supports environments with **2,000–9,999 applications** and an expected throughput of **approximately 310 evaluations per hour per node**, or approximately **7,440 evaluations per day per node**.

This reference architecture is appropriate for production environments that require higher evaluation throughput, larger onboarding capacity, and support for either single-instance or high-availability deployments. The M profile represents the transition point from smaller single-node deployments to larger multi-node high-availability architectures.

## Infrastructure Specifications

This architecture includes the following layers:

- **Compute Layer** – IQ Server application runtime
- **Database Layer** – PostgreSQL metadata database
- **Storage Layer** – Shared file storage for IQ Server data
- **Network Layer** – Connectivity, access control, and optional load balancing

## Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Two IQ Server nodes:

- 8 vCPU
- 64 GB RAM

JVM configuration:

- `-Xms48g`
- `-Xmx48g`

Example GCP machine type:

- `n4a-highmem-8` (ARM Ampere Altra)

## Database Layer (Cloud SQL PostgreSQL)

This layer meets the following specifications:

- Service: Cloud SQL PostgreSQL 15+
- Instance tier: `db-custom-8-30720`
- Database resources: 8 vCPU, 30 GB RAM
- Edition: Enterprise
- Storage: 100 GB PD-SSD, auto-resize to 500 GB
- Availability: Zonal deployment (regional recommended for production)

Regional Cloud SQL deployment is recommended for production environments that require improved resilience and automatic failover capabilities.

## Storage Layer (Cloud Filestore)

Cloud Filestore provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

- Service: Cloud Filestore
- Tier: BASIC_HDD
- Capacity: 1 TiB
- Protocol: NFS v3
- IOPS: 600 read / 1,000 write

## Network and Security

Typical deployment patterns include the following:

- Direct access to the IQ Server node for single-instance deployments
- Google Cloud Load Balancer in front of IQ Server nodes for high-availability deployments
- Private connectivity between IQ Server, Cloud SQL, and Cloud Filestore

Apply standard network security practices, including the following:

- VPC firewall rules following least-privilege principle
- Cloud NAT for outbound internet access
- Secret Manager for credential and secret management
- Cloud Logging and Cloud Monitoring for centralized logging and monitoring

## Limitations

This architecture has the following limitations:

- Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
- Zonal Cloud SQL deployments do not provide automatic failover unless regional deployment is enabled.
- This architecture does not provide cross-region disaster recovery.
- Shared storage throughput and database performance should be monitored as evaluation workloads increase.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for GCP deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required GCP resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.