Install with the Strong Installer CLI
The Strong Installer CLI (sds-cli) helps you install, upgrade, and manage Citrix SecurSpaces™ deployments. You run the CLI from the Strong Installer container.
Overview
Use this article to:
- Install SecurSpaces for the first time.
- Upgrade an existing deployment.
- Push container images to your registry.
Prerequisites
Before you begin, make sure you have:
- Docker installed and running on your local machine.
- Credentials for your container registry.
- Network access to Docker Hub and your destination registry.
- Enough disk space to download and push container images.
Run Strong Installer
Strong Installer is available as a Docker container on Docker Hub. Run this command to start it:
docker run -it --rm -v ${PWD}:/strong-network/shared \
strongnetwork/strong_installer:2026.4.5
<!--NeedCopy-->
Note:
${PWD}mounts your current directory to/strong-network/sharedinside the container. Strong Installer saves configuration files and Helm charts to this location.
Install SecurSpaces
Before you begin
Make sure you have:
- The destination container registry URL.
- Authentication credentials for your registry.
- The service and workspace versions you want to install.
Installation steps
-
Start the Strong Installer container:
docker run -it --rm -v ${PWD}:/strong-network/shared \ strongnetwork/strong_installer:2026.4.5 <!--NeedCopy--> -
Run the installation command:
sds-cli install <!--NeedCopy-->Optional: Specify the service and workspace versions with flags:
sds-cli install -v 2026.4.5 -w 2.3.6 <!--NeedCopy--> -
Enter the initial configuration values when prompted.
-
Follow the prompts to authenticate to your cloud provider or registry.
-
Enter the full destination registry URL.
-
Wait while the CLI creates the configuration file and pushes images to your registry.
Registry authentication
Strong Installer detects the registry type from the URL and prompts for the appropriate credentials. For the credential type each registry expects, and for the flags that supply them non-interactively, see SDS CLI reference.
Important:
After you authenticate, the Helm chart file is downloaded to your shared directory. Secure this file immediately, as it contains your deployment configuration.
Deploy to the cluster
Installing pushes the images and writes the configuration file. Deploying applies that configuration to your Kubernetes cluster. Prepare the cluster first — see Kubernetes for your platform.
Before you begin
Make sure you have:
- A prepared Kubernetes cluster, with
kubectlpointing at it. - An ingress controller. The chart’s default
ingressClassisnginx, but NetScaler CPX is recommended because the chart deploys and configures it for you. See Ingress. - A TLS certificate and key for your host domain.
- The Helm chart and configuration file produced by the install step.
Install an ingress controller
SecurSpaces will not start serving traffic without one. Unless you are using NetScaler CPX, which the chart deploys for you, install and configure the controller before you apply the chart.
- NGINX — install with Helm, then apply the recommended ConfigMap values
- NetScaler CPX — deployed by the chart, no separate installation
- Ingress — if you have not chosen a controller yet
Whichever you use, platform.ingressClass in your configuration file must match the class the controller
actually watches. Confirm it with kubectl get ingressclass.
Upload the TLS secret
The SecurSpaces ingress configuration references a TLS secret. Create it before deploying:
kubectl create secret tls my-ssl-secret --cert=path/to/tls.crt --key=path/to/tls.key
<!--NeedCopy-->
Deploy the chart
helm upgrade --install my_release ninjahchart-${SN_VERSION}.tgz -f config.yml
<!--NeedCopy-->
Verify the deployment
List the running pods:
kubectl get pods
<!--NeedCopy-->
The output resembles the following:
pod/release-central-service-7794bf97db 1/1 Running 0 3h24m
pod/release-central-service-55f74bb5d 1/1 Running 0 3h24m
pod/release-mongodb-869ddfb7c-7q58h 1/1 Running 0 3h24m
pod/release-coordinator-7f9c4c95bd5fd 1/1 Running 0 3h24m
pod/release-proxy-569859ddb9-748jj 1/1 Running 0 3h24m
pod/release-frontend-7b4b8b97d4-67d2k 1/1 Running 0 3h24m
pod/release-workspace-api-74cb48675c-9x4v8 1/1 Running 0 3h24m
<!--NeedCopy-->
Then browse to your deployment URL and sign in with the administrator credentials set in your Helm values.
What to configure next
| Task | Page |
|---|---|
| Connect an identity provider | Identity and access |
| Connect code repositories | Code repositories |
| Allow SSH access to workspaces | SSH TCP forwarding |
| Add a region | Multiple regions |
| Create your first project and team | Set up a project for your team |
Upgrade an existing deployment
Before you begin
Make sure you have:
- The configuration file from your previous deployment, for example,
config_2024.5.0.yaml. - Access to the same container registry used in the original deployment.
Procedure
-
Start the Strong Installer container with the new version:
docker run -it --rm -v ${PWD}:/strong-network/shared \ strongnetwork/strong_installer:2026.4.5 <!--NeedCopy--> -
Run the upgrade command with your existing configuration file:
sds-cli upgrade -c config_2026.4.4.yaml <!--NeedCopy--> -
Follow the prompts to complete the upgrade.
Upgrade without a configuration file
If you do not have the original configuration file, run the upgrade with the --ignore-config flag:
sds-cli upgrade --ignore-config
<!--NeedCopy-->
The CLI then prompts for each value it would otherwise read from the configuration file, including the host domain and the destination registry URL, and does not write a new configuration file. See Upgrading without a configuration file.
Warning:
If you upgrade without a configuration file, you must enter all deployment parameters manually. Use this option only if the configuration file is unavailable.
Automated upgrade
For CI/CD pipelines or other automated deployments, you can run the full upgrade with one command.
Example: Google Artifact Registry
docker run -it --rm -v ${PWD}:/strong-network/shared \
strongnetwork/strong_installer:2026.4.5 \
upgrade \
-c config_2026.4.4.yaml \
--source-registry-region eu \
--service-account-file-path shared/your-service-account.json
<!--NeedCopy-->
The destination registry URL is read from the configuration file passed with -c. There is no flag to set
it.
Flags
For the full flag list, including the registry-specific authentication flags for Google Artifact Registry, Amazon ECR, Azure Container Registry and generic Docker login, see SDS CLI reference.
Tip:
Use
--use-docker-loginwith--registry-usernameand--registry-passwordto skip cloud provider authentication prompts. This is useful for CI/CD pipelines that do not support interactive prompts.
Push images only
To push container images without running a full installation or upgrade, use the push-images command.
Procedure
-
Start the Strong Installer container:
docker run -it --rm -v ${PWD}:/strong-network/shared \ strongnetwork/strong_installer:2026.4.5 <!--NeedCopy--> -
Run the
push-imagescommand:sds-cli push-images \ --source-registry-region eu \ -c config.yaml \ --verbose <!--NeedCopy-->
Push images with Docker login (non-interactive)
For CI/CD pipelines, use the --use-docker-login flag to skip cloud authentication prompts:
sds-cli push-images \
--source-registry-region eu \
--use-docker-login \
--registry-username "your-username" \
--registry-password "your-password" \
-c config.yaml
<!--NeedCopy-->
Flags
For the full push-images flag list, including the skip options, see
SDS CLI reference.
Troubleshooting
Authentication prompts in CI/CD
| Issue | Resolution |
|---|---|
| The CLI prompts you to choose an authentication method even when credentials are provided. | Use --use-docker-login with --registry-username and --registry-password to skip cloud provider authentication. |
sds-cli push-images \
--use-docker-login \
--registry-username "$USERNAME" \
--registry-password "$PASSWORD" \
...
<!--NeedCopy-->
Docker permission denied
| Issue | Resolution |
|---|---|
| Permission denied errors when you run Docker commands | Make sure your user is added to the docker group, or prefix the command with sudo. |
Image push failures
| Issue | Resolution |
|---|---|
| Images fail to push to the destination registry. | Verify that your registry credentials are correct. |
| Make sure the destination registry exists and is accessible. | |
| Check network connectivity to both the source and destination registries. | |
Use --verbose for detailed error messages. |