Size XS - Sonatype IQ - GCP Cloud-Native Reference Architecture

This Sonatype IQ Server extra-small reference architecture describes the minimum supported infrastructure specifications for deploying a single IQ Server instance in Google Cloud Platform (GCP) using cloud-native services. It supports environments with fewer than 500 applications and an expected throughput of approximately 80–120 evaluations per hour, or approximately 1,920–2,880 evaluations per day.

This reference architecture represents the smallest supported infrastructure footprint for running IQ Server in GCP. It is appropriate for evaluation environments, proof-of-concept deployments, and small teams with light evaluation volume. This sizing profile is projected based on extrapolation from validated M, L, and XL testing tiers and has not been independently validated.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – IQ Server application runtime
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

• 2 vCPU
• 16 GB RAM

JVM configuration:

• -Xms12g
• -Xmx12g

Example GCP machine type:

• n4a-highmem-2 (ARM Ampere Altra)

Database Layer (Cloud SQL PostgreSQL)

This layer meets the following specifications:

• Service: Cloud SQL PostgreSQL 15+
• Instance tier: db-custom-2-7680
• Database resources: 2 vCPU, 7.5 GB RAM
• Edition: Enterprise
• Storage: 20 GB PD-SSD, auto-resize to 100 GB
• Availability: Zonal deployment

Storage Layer (Cloud Filestore)

Cloud Filestore provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Cloud Filestore
• Tier: BASIC_HDD
• Capacity: 1 TiB minimum
• Protocol: NFS v3
• IOPS: 600 read / 1,000 write

Cloud Filestore BASIC_HDD has a minimum capacity requirement of 1 TiB. For single-instance deployments where actual storage requirements are significantly lower, consider using a Persistent Disk (PD-SSD) attached directly to the GCE instance instead of Filestore to reduce infrastructure costs.

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node
• Optional Google Cloud Load Balancer in front of the IQ Server node
• Private connectivity between IQ Server, Cloud SQL, and Cloud Filestore

Apply standard network security practices, including the following:

• VPC firewall rules following least-privilege principle
• Cloud NAT for outbound internet access
• Secret Manager for credential and secret management
• Cloud Logging and Cloud Monitoring for centralized logging and monitoring

Limitations

This architecture has the following limitations:

• This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• The sizing guidance for this profile is projected and has not been independently validated.
• Zonal Cloud SQL deployments do not provide automatic failover across regions or zones.
• Cloud Filestore minimum storage allocation may exceed actual storage requirements for smaller environments.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for GCP deployments. This automates the creation and configuration of all required GCP resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.