Installation · LessonBy Neelima, SailPoint Architect · Published · IdentityIQ 8.4 · all levels
GCP
Deploying IdentityIQ on Google Cloud: Compute Engine/GKE, Cloud SQL and load balancing.
Quick answer
On GCP, run IdentityIQ on Compute Engine or GKE with Cloud SQL behind a Cloud Load Balancer, using Secret Manager for secrets.
Key takeaways
- Prerequisites for GCP
- Step-by-step install path
- Common pitfalls and fixes
- Verification after install
On Google Cloud, IdentityIQ runs on Compute Engine instances or a GKE cluster, backed by Cloud SQL, fronted by a Cloud Load Balancer, with credentials in Secret Manager and access controlled by firewall rules and IAM. As with AWS and Azure, GCP supplies managed components you assemble under least privilege.
Reference architecture
- Compute: Compute Engine VMs or GKE pods running Tomcat + the IdentityIQ WAR.
- Database: Cloud SQL for managed backups, patching and HA.
- Load balancing: a Cloud Load Balancer across the nodes.
- Secrets: Secret Manager for database and integration credentials.
Step by step
- 1. Provision compute, Compute Engine or GKE.
- 2. Create a Cloud SQL instance and run the IdentityIQ DDL.
- 3. Configure the datasource to the Cloud SQL endpoint, pulling credentials from Secret Manager.
- 4. Front with a Cloud Load Balancer and health checks.
- 5. Restrict networking with firewall rules and least-privilege IAM/service accounts.
- 6. Deploy and verify, then run a test aggregation.
GCP best practice
- Enable Cloud SQL high availability and automated backups.
- Keep secrets in Secret Manager.
- Use firewall rules and IAM to limit access to the database.
- Spread nodes across zones behind the load balancer.
Common pitfalls
- Secrets in config or images rather than Secret Manager.
- Broad firewall rules exposing the database.
- Single-zone database without HA.
Practice challenge
+0 XPStreak ×0
Question 1 of 3
What are the prerequisites for GCP?
Frequently asked questions
What is another point to note about GCP?
Compute: Compute Engine VMs or GKE pods running Tomcat + the IdentityIQ WAR. Database: Cloud SQL for managed backups, patching and HA. Load balancing: a Cloud Load Balancer across the nodes.
What else is worth knowing about GCP?
1. Provision compute, Compute Engine or GKE. 2. Create a Cloud SQL instance and run the IdentityIQ DDL. 3. Configure the datasource to the Cloud SQL endpoint, pulling credentials from Secret Manager.
What tends to go wrong with GCP?
Secrets in config or images rather than Secret Manager. Broad firewall rules exposing the database. Single-zone database without HA.
Want this with a live instructor and a lab tenant?