Product documentation
Citrix SecurSpaces™
View PDF

NetScaler CPX

August 20, 2026
Contributed by: 
T

NetScaler CPX is the recommended ingress controller for Citrix SecurSpaces™, and the only one the SecurSpaces Helm chart deploys for you.

It works out of the box. The chart installs NetScaler CPX, wires it to the platform, and applies the settings SecurSpaces needs. You do not have to configure the controller separately.

Important:

NetScaler CPX does not currently work on Google GKE. This is a known issue with a fix in progress and no date yet. On GKE, use NGINX or the Kubernetes Gateway API, and contact Citrix for the current status. Other platforms are unaffected.

What the chart sets up

Understanding what is already handled saves you repeating it by hand.

Area What you get
The controller NetScaler CPX is installed as part of the SecurSpaces release, with its licence accepted and exposed through a LoadBalancer service
Ports 80 and 443 for the platform, plus a port for SSH to workspaces and one for the VDI agent
Connection handling HTTP and TCP profiles with WebSocket and HTTP/2 enabled, which is what the Cloud IDE needs to hold a session open
Backend security Client authentication on the front end, and TLS to the frontend and central services
SSH to workspaces A dedicated SSH ingress, created automatically, routed to the workspace service over TCP

The SSH ingress is the difference worth knowing about. With other controllers you build that path yourself.

Selecting it

NetScaler CPX is chosen in the configuration file the installer generates:

platform:
  useNetscalerController: true
  ingressClass: netscaler-cpx-ingress
  sslCertificateSecret: <your-tls-secret>
<!--NeedCopy-->

ingressClass must match the class the controller watches. netscaler-cpx-ingress is the value the chart uses; if you change one, change both.

sslCertificateSecret names a TLS secret in the release namespace, covering your platform domain, your proxy domain, and the wildcard proxy subdomain. See Install with the Strong Installer CLI.

Verify

After the release is deployed:

kubectl get pods -n strong-network
kubectl get ingress -n strong-network
kubectl get svc -n strong-network
<!--NeedCopy-->

You should see the CPX pod running, an external address on the LoadBalancer service, and an ingress for the platform alongside one for SSH.

If the LoadBalancer address stays pending, your cluster has no load balancer provider or no free address in its range. That is a cluster-level problem rather than a SecurSpaces one.

Using an existing NetScaler

If you already run NetScaler in front of your cluster, point SecurSpaces at it rather than letting the chart deploy CPX: leave useNetscalerController off, and set ingressClass to the class your existing controller watches. The chart still applies the NetScaler-specific annotations when the class name begins with netscaler.

NetScaler CPX
August 20, 2026
Contributed by: 
T
August 20, 2026
Contributed by: 
T

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.