Configure Traefik

Last published : Nov 12, 2026
This guide shows you how to connect an existing Traefik controller to Citrix SecurSpaces™ using Traefik custom resource definitions (CRDs).
Related information
Ingress

Before you start

  • Prepare the SecurSpaces chart and configuration with the Strong Installer CLI.
  • Install and operate Traefik separately. The SecurSpaces chart doesn't install or upgrade the controller.
  • Use a Traefik 3 controller with v3 rule syntax and matching CRDs. The ServersTransport schema must support rootCAs Secret references; the schema compatibility minimum is 3.4.1.
  • Install IngressRoute, IngressRouteTCP, and ServersTransport CRDs under traefik.io/v1alpha1.
  • Give the controller permission to read routes, transports, Services, endpoints, and Secrets in the SecurSpaces namespace.
  • Prepare DNS, public TLS certificates, and firewall access for the platform and workspace proxy hosts.
  • For an existing deployment, plan the controller migration and certificate renewal before changing routing. In particular, preserve or migrate any certificate issuer that uses the old controller for HTTP-01 challenges.

Prepare the controller

  1. Enable Traefik's Kubernetes CRD provider for the SecurSpaces namespace.
  2. Set its ingress class filter to traefik, or retain an empty filter that accepts that class. SecurSpaces CRD routes use a fixed traefik class annotation.
  3. Configure three distinct entrypoints: websecure for HTTPS, ssh for workspace SSH, and snproxy for proxy traffic.
  4. Expose HTTPS on port 443, SSH on the port advertised by the platform, and proxy traffic on the port configured by platform.vdiProxyPort (2020 by default).
  5. Reserve the SSH and proxy entrypoints for this deployment. Their routes accept all TCP traffic on those entrypoints.
  6. Keep HTTP/2 enabled for HTTPS connections.
  7. Configure controller and load-balancer timeouts for long uploads and long-lived workspace connections.
  8. Point the platform hostname and workspace wildcard DNS records to the controller's public address.
The controller is ready to watch SecurSpaces routing objects. On a shared controller, preserve other applications' watched namespaces, entrypoints, and routing settings.
Note:
The public SSH port and the platform's advertised SSH port must match. The default public port is 22; the backend workspace SSH Service port remains 2222. Changing one doesn't change the other.

Enable Traefik routing

  1. Create public TLS Secrets in the SecurSpaces namespace for the platform hostname and workspace wildcard. Each Secret needs tls.crt and tls.key.
  2. Merge this routing configuration into the file produced by the installer, replacing the example hostnames and Secret names:
    platform:
      useTraefik: true
      useIstio: false
      useGatewayAPI: false
      useOpenShift: false
      useNetscalerController: false
      useNginxController: false
      useF5NginxController: false
      useHAProxyController: false
      hostName: securspaces.example.com
      centralProxyHostname: proxy.securspaces.example.com
      sslCertificateSecret: platform-tls
      sslCertificateSecretProxy: workspace-tls
      traefik:
        entryPoints:
          https: websecure
          ssh: ssh
          proxy: snproxy
        backendScheme: https
        backendTLS:
          insecureSkipVerify: false
  3. Confirm that both public certificates cover their intended hostnames. The workspace wildcard also covers coordinator.proxy.securspaces.example.com in this example.
  4. Apply the chart using the Helm command produced by the installer.
The chart creates IngressRoute, IngressRouteTCP, and per-backend ServersTransport resources instead of standard Kubernetes Ingress resources. It supplies the backend CA trust and certificate server names, so you don't need to copy backend CA certificates manually.
platform.ingressClass is ignored in Traefik mode. The chart rejects missing CRDs, conflicting controller flags, disabled backend certificate verification, and invalid route priorities or backend ports.
Important:
Switching an existing release to Traefik removes its standard Ingress resources. Disabling platform.useNetscalerController can also remove its chart-managed controller. Prepare the replacement controller and a rollback plan before applying the change.

Configure an external region

Follow Multiple regions to prepare and register the region.
  1. Prepare a Traefik controller and the required CRDs in the region's cluster.
  2. Enable platform.useTraefik in the region's configuration, with the other controller flags disabled.
  3. Set region.isExternalRegion to true.
  4. Set region.proxyHostname to the regional proxy domain, such as eu.proxy.example.com.
  5. Keep platform.hostName set to the central platform hostname.
  6. Provide a main TLS Secret covering api.eu.proxy.example.com and a proxy TLS Secret covering *.eu.proxy.example.com.
  7. Apply the region's chart with its configuration.
The exact regional API hostname routes to the workspace API over HTTPS on backend port 9090. Workspace wildcard traffic routes to backend port 8080. The regional API route has higher priority than the wildcard route.
Keep platform.traefik.routes.workspaceGrpc.scheme set to https. The optional h2c workaround makes that backend connection plaintext and isn't appropriate when every hop requires TLS.

Verify the routing

  1. List the generated resources in your namespace:
    kubectl get ingressroute,ingressroutetcp,serverstransport -n <namespace>
  2. Sign in to the console through its public HTTPS hostname.
  3. Open a workspace's browser IDE and terminal.
  4. Connect to a workspace over SSH through the advertised public port.
  5. Open a workspace app through its wildcard hostname.
  6. For an external region, start a workspace there and verify that the regional API connection succeeds.
The console, workspace connections, and regional operations should work through Traefik without backend certificate errors.
Traefik mode doesn't apply platform.nginxMaxBodySize or platform.nginxMaxBodySizeSubdomain. The chart doesn't create buffering middleware or reproduce NGINX's gRPC error-page handling. Validate upload limits and client behavior for rejected requests before moving production traffic.