NGINX
These values apply to the ingress-nginx controller. If you use NetScaler CPX, the SecurSpaces chart applies the equivalent profiles itself and there is nothing to tune. See NetScaler CPX.
Citrix SecurSpaces™ carries long-lived connections — the Cloud IDE, SSH sessions, and workspace apps all hold a socket open for the length of a working session. The default ingress-nginx settings are tuned for short request/response traffic, so the following values are recommended for a SecurSpaces deployment.
Install the controller
SecurSpaces does not install NGINX for you. The cluster needs an ingress-nginx controller before you deploy the Helm chart.
Many managed Kubernetes services have a recommended way to do this — check the ingress-nginx deployment guide for your cloud provider first. If your provider is not listed, install it with Helm:
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install --namespace nginx --create-namespace ingress-nginx ingress-nginx/ingress-nginx \
--set controller.service.type=LoadBalancer
On AWS, add the annotation that provisions a Network Load Balancer:
--set controller.service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-type"="nlb"
Confirm the ingress class the controller watches, and use that value for
platform.ingressClass in your SecurSpaces configuration:
kubectl get ingressclass
Tune the controller
Apply the following values before you put the platform into use. They are not optional in practice: the defaults produce dropped Cloud IDE sessions under normal working conditions.
A default ConfigMap exists in the
ingress-nginx namespace, usually named ingress-nginx-controller. The name varies with how the ingress controller was installed.
kubectl edit configmap ingress-nginx-controller
Recommended values
apiVersion: v1
data:
allow-snippet-annotations: "true"
enable-brotli: "true"
keep-alive: 120s
keep-alive-requests: "10000"
use-gzip: "true"
use-http2: "true"
kind: ConfigMap
| Value | Effect |
|---|---|
allow-snippet-annotations |
Controls whether the controller honors snippet annotations. See the note below — this one has consequences beyond performance. |
enable-brotli |
Compresses responses with Brotli where the client supports it. |
keep-alive |
Holds an idle upstream connection open for 120 seconds rather than the default 75. |
keep-alive-requests |
Allows 10,000 requests per keep-alive connection rather than the default 1,000, which matters for the long sessions the Cloud IDE creates. |
use-gzip |
Compresses responses for clients that do not support Brotli. |
use-http2 |
Serves HTTP/2 to clients that support it. |
About allow-snippet-annotations
The SecurSpaces Helm chart reads this value from the ConfigMap when it renders, and behaves differently depending on what it finds:
-
"true"— the chart adds its ownserver-snippetannotation to the ingress, which installs SecurSpaces error pages for HTTP 400, 401, 403, 404, 405, 408, and 413. -
"false"— the chart omits that annotation. The platform still works, but those responses fall back to the ingress controller's default error pages.
If you set
platform.nginxConfig or platform.nginxConfigSubdomain in your Helm values, the chart emits a configuration-snippet annotation, which the controller only honors when allow-snippet-annotations is "true".
Note:
Snippet annotations let any user who can create an Ingress object inject NGINX configuration. Recent ingress-nginx releases default this to
"false" for that reason. Setting it to "true" is a trade-off between the SecurSpaces error pages and that exposure. If your cluster policy forbids snippet annotations, leave it "false" — the platform is fully functional either way.