Size XL - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server extra-large reference architecture describes the recommended infrastructure specifications for deploying a large-scale, high-availability IQ Server environment in Microsoft Azure using cloud-native services. It supports environments with 20,000–80,000 applications and an expected throughput of approximately 405 evaluations per hour per node, or approximately 29,160–38,880 evaluations per day total.

This reference architecture is designed for enterprise-scale production environments that require maximum evaluation throughput, large onboarding capacity, resilient infrastructure services, and operational scalability. The XL profile represents the largest Azure cloud-native deployment profile for IQ Server and recommends AKS for Kubernetes-based orchestration at this scale.

Infrastructure Specifications

This reference architecture defines a high-availability IQ Server deployment supported by Azure-managed infrastructure services.

This architecture includes the following layers:

• Compute Layer – High-availability IQ Server application cluster
• Database Layer– PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Load balancing, connectivity, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Four IQ Server nodes:

• 16 vCPU per node
• 128 GB RAM per node

JVM configuration per node:

• -Xms96g
• -Xmx96g

Example Azure instance types:

• Standard_E16ps_v6 for ARM-based deployments
• Standard_E16_v5 for x86-based deployments

This architecture requires a high-availability IQ Server deployment. At this scale, AKS is recommended to support Kubernetes-based orchestration, multi-node deployment, workload management, and operational consistency.

Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

• Service: Azure Database for PostgreSQL - Flexible Server
• SKU: MO_Standard_E16s_v3
• Database resources:
  • 16 vCores
  • 128 GB RAM
• Storage:
  • 500 GB – 2 TB
  • Auto-scaling enabled
• Zone redundancy with automatic failover required

Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

• Service:
  • Azure Files - Standard HDD for SMB-based deployments
  • Premium SSD for NFS-based AKS deployments
• Protocol:
  • SMB 3.0 for Standard Azure Files
  • NFS for Premium AKS deployments
• Zone-redundant storage (ZRS)
• Estimated capacity: 1.5 TB – 4 TB

Network and Security

This architecture uses load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

• Azure Application Gateway or Load Balancer in front of IQ Server nodes
• Private connectivity between IQ Server, PostgreSQL, and Azure Files
• IQ Server nodes distributed across multiple availability zones
• Private subnets for database and storage infrastructure
• AKS networking integrated with controlled virtual network access

Apply standard network security practices, including the following:

• Network Security Groups following least-privilege principle
• Azure NAT Gateway for outbound internet access
• Azure Key Vault for credential and secret management
• Azure Monitor and Log Analytics for centralized logging and monitoring
• Private networking for database and storage services where possible
• TLS encryption for inbound and internal service communication

Limitations

This architecture has the following limitations:

• This architecture requires high availability and introduces significant operational complexity compared to smaller profiles.
• This architecture does not provide cross-region disaster recovery.
• Extremely large evaluation spikes or rapid onboarding growth beyond the validated profile may require additional infrastructure tuning or architectural review.
• Shared storage throughput and database performance remain critical scaling dependencies and should be continuously monitored.
• Storage protocol and service selection are more important at this scale because AKS deployments may require Premium SSD with NFS rather than Standard Azure Files with SMB.

Organizations requiring geographic redundancy or disaster recovery across Azure regions should supplement this architecture with additional disaster recovery planning and regional replication strategies.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for Azure deployments. This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.