Nutanix Kubernetes Platform

Last published : Oct 20, 2026
Citrix SecurSpaces™ runs on the Nutanix Kubernetes Platform (NKP). This page covers what is specific to NKP: the cluster prerequisites, the node labels, the certificate, and the ingress settings the chart needs.
Everything after that is the standard installation. When you have finished here, continue with Install with the Strong Installer CLI.
Nutanix publishes a full end-to-end walkthrough as a solutions tech note, which is useful for the NKP side of the deployment: Citrix Secure Developer Spaces on Nutanix Kubernetes Platform.
Important:
The Nutanix tech note was written against SecurSpaces 2025.10.13 and has not been revised since. Its installer image tag, chart file name, and CLI command are all out of date — it uses strong-cli, which is now sds-cli. Use it for the NKP-specific steps, and follow the SecurSpaces documentation for the installation itself.
Related information
Deploy to a cluster

Prerequisites

  • NKP 2.17 or later, deployed as either a self-managed or a workload cluster.
  • A free IP address in the Kubernetes service load balancer range, for the SecurSpaces load balancer.
  • A kubeconfig with privileged access to the cluster.
  • Three domain names:
    Purpose Example
    Primary sds.example.com
    Proxy proxy.sds.example.com
    Wildcard subdomain *.proxy.sds.example.com
  • A TLS certificate whose Subject Alternative Names cover all three domains.
  • A SecurSpaces platform license.
For supported Kubernetes versions and capacity planning, see System requirements and Sizing.

Create the namespace

kubectl create namespace strong-network

Label the nodes

SecurSpaces separates service nodes from workspace nodes. Label them so the chart can schedule each pod type on the right pool:
kubectl label nodes <service-node-name> strong.network/type=service
kubectl label nodes <workspace-node-name> strong.network/type=workspace
For how many nodes of each type to provision, see Sizing.

Install the certificate

Store the certificate and its private key as a TLS secret in the namespace:
kubectl create secret tls sds-example-com-cert \
  --key=/path/to/private_key.pem \
  --cert=/path/to/cert.pem \
  -n strong-network
If you use cert-manager, request the certificate instead. This example issues a self-signed certificate, which is suitable for testing but not for production:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: sds-example-com-cert
  namespace: strong-network
spec:
  secretName: sds-example-com-cert
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
  dnsNames:
    - sds.example.com
    - proxy.sds.example.com
    - "*.proxy.sds.example.com"

Configure the chart for NKP

Run the installer as described in Install with the Strong Installer CLI. Select Percona MongoDB when the installer asks for the database type, unless you are using an external database.
Then add the NKP-specific values to the generated configuration file. NKP ships NetScaler CPX as its ingress controller, so the chart needs telling to emit NetScaler ingress annotations:
platform:
  useNetscalerController: true
  ingressClass: netscaler-cpx-ingress
  sslCertificateSecret: sds-example-com-cert
ingressClass must match the class your NetScaler CPX controller actually watches. The chart default is netscaler-cpx-ingress; confirm yours with kubectl get ingressclass and set both sides to the same value.
Note:
If your chart version requires node affinity to be switched on explicitly, also set platform.enableNodeAffinity: true. The node labels above have no effect unless affinity is enabled. The Nutanix tech note marks this as required for 2025.10.13.

Deploy

helm upgrade --install \
    --namespace strong-network \
    --create-namespace \
    -f ./config_<version>.yaml \
    release ./ninjachart-<version>.tgz
Check that the platform came up:
kubectl get pods -n strong-network
kubectl get ingress -n strong-network
Then open https://sds.example.com/login and sign in with the administrator account you set during installation.