Product documentation
Citrix SecurSpaces™
View PDF

NGINX

August 24, 2026
Contributed by: 
T

These values apply to the ingress-nginx controller. If you use NetScaler CPX, the SecurSpaces chart applies the equivalent profiles itself and there is nothing to tune. See NetScaler CPX.

Citrix SecurSpaces™ carries long-lived connections — the Cloud IDE, SSH sessions, and workspace apps all hold a socket open for the length of a working session. The default ingress-nginx settings are tuned for short request/response traffic, so the following values are recommended for a SecurSpaces deployment.

Install the controller

SecurSpaces does not install NGINX for you. The cluster needs an ingress-nginx controller before you deploy the Helm chart.

Many managed Kubernetes services have a recommended way to do this — check the ingress-nginx deployment guide for your cloud provider first. If your provider is not listed, install it with Helm:

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install --namespace nginx --create-namespace ingress-nginx ingress-nginx/ingress-nginx \
  --set controller.service.type=LoadBalancer
<!--NeedCopy-->

On AWS, add the annotation that provisions a Network Load Balancer:

  --set controller.service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-type"="nlb"
<!--NeedCopy-->

Confirm the ingress class the controller watches, and use that value for platform.ingressClass in your SecurSpaces configuration:

kubectl get ingressclass
<!--NeedCopy-->

Tune the controller

Apply the following values before you put the platform into use. They are not optional in practice: the defaults produce dropped Cloud IDE sessions under normal working conditions.

A default ConfigMap exists in the ingress-nginx namespace, usually named ingress-nginx-controller. The name varies with how the ingress controller was installed.

kubectl edit configmap ingress-nginx-controller
<!--NeedCopy-->

apiVersion: v1
data:
  allow-snippet-annotations: "true"
  enable-brotli: "true"
  keep-alive: 120s
  keep-alive-requests: "10000"
  use-gzip: "true"
  use-http2: "true"
kind: ConfigMap
<!--NeedCopy-->
Value Effect
allow-snippet-annotations Controls whether the controller honors snippet annotations. See the note below — this one has consequences beyond performance.
enable-brotli Compresses responses with Brotli where the client supports it.
keep-alive Holds an idle upstream connection open for 120 seconds rather than the default 75.
keep-alive-requests Allows 10,000 requests per keep-alive connection rather than the default 1,000, which matters for the long sessions the Cloud IDE creates.
use-gzip Compresses responses for clients that do not support Brotli.
use-http2 Serves HTTP/2 to clients that support it.

About allow-snippet-annotations

The SecurSpaces Helm chart reads this value from the ConfigMap when it renders, and behaves differently depending on what it finds:

  • "true" — the chart adds its own server-snippet annotation to the ingress, which installs SecurSpaces error pages for HTTP 400, 401, 403, 404, 405, 408, and 413.
  • "false" — the chart omits that annotation. The platform still works, but those responses fall back to the ingress controller’s default error pages.

If you set platform.nginxConfig or platform.nginxConfigSubdomain in your Helm values, the chart emits a configuration-snippet annotation, which the controller only honors when allow-snippet-annotations is "true".

Note:

Snippet annotations let any user who can create an Ingress object inject NGINX configuration. Recent ingress-nginx releases default this to "false" for that reason. Setting it to "true" is a trade-off between the SecurSpaces error pages and that exposure. If your cluster policy forbids snippet annotations, leave it "false" — the platform is fully functional either way.

NGINX
August 24, 2026
Contributed by: 
T
August 24, 2026
Contributed by: 
T

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.