Size S - Sonatype IQ - GCP Cloud-Native Reference Architecture

This Sonatype IQ Server small reference architecture describes the recommended infrastructure specifications for deploying a single IQ Server instance in Google Cloud Platform (GCP) using cloud-native services. It supports environments with 500–1,999 applications and an expected throughput of approximately 150–220 evaluations per hour, or approximately 3,600–5,280 evaluations per day.

This reference architecture is appropriate for small-to-medium production environments that require increased evaluation throughput, larger onboarding capacity, and improved infrastructure resilience compared to the XS profile. This sizing profile is projected based on extrapolation from validated M, L, and XL testing tiers and has not been independently validated.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – IQ Server application runtime
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

• 4 vCPU
• 32 GB RAM

JVM configuration:

• -Xms24g
• -Xmx24g

Example GCP machine type:

• n4a-highmem-4 (ARM Ampere Altra)

Database Layer (Cloud SQL PostgreSQL)

This layer meets the following specifications:

• Service: Cloud SQL PostgreSQL 15+
• Instance tier: db-custom-2-13312
• Database resources: 2 vCPU, 13 GB RAM
• Edition: Enterprise
• Storage: 50 GB PD-SSD, auto-resize to 200 GB
• Availability: Zonal deployment (regional recommended for production)

Storage Layer (Cloud Filestore)

Cloud Filestore provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Cloud Filestore
• Tier: BASIC_HDD
• Capacity: 1 TiB minimum
• Protocol: NFS v3
• IOPS: 600 read / 1,000 write

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node
• Optional Google Cloud Load Balancer in front of the IQ Server node
• Private connectivity between IQ Server, Cloud SQL, and Cloud Filestore

Apply standard network security practices, including the following:

• VPC firewall rules following least-privilege principle
• Cloud NAT for outbound internet access
• Secret Manager for credential and secret management
• Cloud Logging and Cloud Monitoring for centralized logging and monitoring

Limitations

This architecture has the following limitations:

• This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment unless additional HA infrastructure is introduced.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• The sizing guidance for this profile is projected and has not been independently validated.
• Zonal Cloud SQL deployments do not provide automatic failover unless regional deployment is enabled.
• Cloud Filestore minimum storage allocation may exceed actual storage requirements for smaller environments.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for GCP deployments. This automates the creation and configuration of all required GCP resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.