This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
System requirements
What a Citrix SecurSpaces™ deployment needs from your infrastructure. For how much of it, see Sizing.
For the external addresses the deployment must reach, see Network destinations.
Each requirement below is marked with what happens if you do not have it:
| Level | Meaning |
|---|---|
| Required | The deployment does not complete without it. |
| Recommended | The deployment completes. Plan for this before the environment carries real work. |
| Default | SecurSpaces provides this already. No action needed to start. |
| Conditional | Needed only in the circumstances named. |
Before deployment day
Everything marked Required, in the order you will need it:
- A deployment model chosen, and an account with permissions to provision it
- A dedicated Kubernetes cluster,
amd64, not shared with other workloads - An ingress controller, and a cluster that enforces the Network Policy API
- Two DNS domains, the second a wildcard subdomain of the first
- Persistent storage through the Persistent Volume Claim API
- The Helm CLI, available to whoever runs the deployment
- Outbound access to the license server, Docker Hub, and Google Artifact Registry
If the environment is air-gapped or has restricted egress, confirm that last item first. It is the one that most often stops a deployment on the day, and the fix — firewall changes or an offline license — is the one that takes longest to arrange. See Network destinations.
Note:
Workspaces are Linux containers. Development that requires macOS or Apple hardware, such as iOS or macOS applications, is not supported.
Kubernetes
| Requirement | Value | Level |
|---|---|---|
| Kubernetes version | 1.34 or later | Required |
| Cluster | Dedicated to SecurSpaces. Do not share it with other applications. | Required |
| Node architecture |
amd64. arm64 is not supported. |
Required |
| Node operating system on AWS | Amazon Linux | Required |
| Cluster size | A single node is enough to start. High availability and multiple nodes are not needed for a proof of concept. | Default |
Note:
Run a Kubernetes release that is still supported upstream rather than pinning to this minimum. A release that has left support stops receiving security fixes, and the supported window moves with each Kubernetes release cycle.
Supported platforms
Choose a cloud-native, on-premises, or air-gapped Kubernetes deployment, and make sure your account holds the infrastructure permissions that environment needs.
- Amazon Elastic Kubernetes Service (EKS)
- Azure Kubernetes Service (AKS)
- Google Kubernetes Engine (GKE)
- Red Hat OpenShift
- VMware Tanzu Kubernetes Grid (TKG)
- Nutanix Kubernetes Platform (NKP)
Networking
| Requirement | Detail | Level |
|---|---|---|
| Ingress gateway | NetScaler CPX is recommended, and the SecurSpaces chart can deploy it for you. NGINX, HAProxy, and the Kubernetes Gateway API are also supported. See Ingress. | Required |
| Network Policy API |
networking.k8s.io/v1. If your cluster does not implement it, install Calico or Cilium. |
Required |
| DNS domains | Two DNS domains, the second a wildcard subdomain of the first | Required |
| TLS certificates | Valid certificates for both domains | Recommended |
Important:
The Network Policy API is not optional if you rely on network policies or workspace isolation. Without a network plugin that enforces it, those policies are accepted by the API server and do nothing. See Trust boundaries.
Domains
The second domain must be a wildcard subdomain of the first. For example:
example.com*.proxy.example.com
Certificates are optional for proof-of-concept deployments, but strongly recommended.
Storage
Provide persistent storage through the Kubernetes Persistent Volume Claim API. This is required: confirm the target cluster supports the PVC API before you deploy.
Deployment tooling
| Tool | Purpose | Level |
|---|---|---|
| Helm CLI | Deploys SecurSpaces from the provided Helm chart. Must be installed and accessible to whoever runs the deployment. | Required |
| cert-manager | Needed only if the chart renders cert-manager Certificate resources. If your cluster does not use cert-manager, set platform.useCertManager: false. |
Conditional |
What SecurSpaces provides by default
You do not need to arrange either of these before a proof of concept. SecurSpaces deploys with both already working, and each has a production path you can move to later.
| Area | Default | Production path |
|---|---|---|
| Database | Percona Server for MongoDB, deployed by the chart and running in your cluster | An external MongoDB service, such as MongoDB Atlas. See Database. |
| Identity and access | Email and password authentication | An identity provider using SAML or OIDC, such as Okta. See Identity. |
The internal database is supported in production, including for air-gapped and on-premises deployments. What changes is ownership: backups, high availability, and scaling become yours to run. An external service moves that work to the provider. See Database for the comparison.
Related information
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.