Installation · Lesson

GCP

Quick answer

On GCP, run IdentityIQ on Compute Engine or GKE with Cloud SQL behind a Cloud Load Balancer, using Secret Manager for secrets.

Key takeaways

Prerequisites for GCP
Step-by-step install path
Common pitfalls and fixes
Verification after install

On Google Cloud, IdentityIQ runs on Compute Engine instances or a GKE cluster, backed by Cloud SQL, fronted by a Cloud Load Balancer, with credentials in Secret Manager and access controlled by firewall rules and IAM. As with AWS and Azure, GCP supplies managed components you assemble under least privilege.

Reference architecture

Compute: Compute Engine VMs or GKE pods running Tomcat + the IdentityIQ WAR.
Database: Cloud SQL for managed backups, patching and HA.
Load balancing: a Cloud Load Balancer across the nodes.
Secrets: Secret Manager for database and integration credentials.

Step by step

1. Provision compute, Compute Engine or GKE.
2. Create a Cloud SQL instance and run the IdentityIQ DDL.
3. Configure the datasource to the Cloud SQL endpoint, pulling credentials from Secret Manager.
4. Front with a Cloud Load Balancer and health checks.
5. Restrict networking with firewall rules and least-privilege IAM/service accounts.
6. Deploy and verify, then run a test aggregation.

GCP best practice

Enable Cloud SQL high availability and automated backups.
Keep secrets in Secret Manager.
Use firewall rules and IAM to limit access to the database.
Spread nodes across zones behind the load balancer.

Common pitfalls

Secrets in config or images rather than Secret Manager.
Broad firewall rules exposing the database.
Single-zone database without HA.

Want to learn this properly?

Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

What are the prerequisites for GCP?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. Confirm the app server starts, the schema is present, and login works.
- C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
Show answer
C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
How do you verify the install?
- A. Confirm the app server starts, the schema is present, and login works.
- B. The application and app-server logs, which usually point to database, Java or permission issues.
- C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
Show answer
A. Confirm the app server starts, the schema is present, and login works.
Confirm the app server starts, the schema is present, and login works.
Where do you look first on failure?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. Confirm the app server starts, the schema is present, and login works.
- C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
Show answer
A. The application and app-server logs, which usually point to database, Java or permission issues.
The application and app-server logs, which usually point to database, Java or permission issues.

Frequently asked questions

What is another point to note about GCP?

Compute: Compute Engine VMs or GKE pods running Tomcat + the IdentityIQ WAR. Database: Cloud SQL for managed backups, patching and HA. Load balancing: a Cloud Load Balancer across the nodes.

What else is worth knowing about GCP?

1. Provision compute, Compute Engine or GKE. 2. Create a Cloud SQL instance and run the IdentityIQ DDL. 3. Configure the datasource to the Cloud SQL endpoint, pulling credentials from Secret Manager.

What tends to go wrong with GCP?

Secrets in config or images rather than Secret Manager. Broad firewall rules exposing the database. Single-zone database without HA.