This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Google GKE
This page prepares the Google Cloud infrastructure Citrix SecurSpaces™ needs: a Kubernetes cluster to run on, a container registry to pull images from, and a MongoDB database to store platform state.
When you have finished, continue with Install with the Strong Installer CLI, which is the same for every platform.
Important:
Use GKE Standard, not GKE Autopilot. SecurSpaces does not install on Autopilot clusters — the installation fails. Autopilot is the default mode when you create a cluster in the Google Cloud console, so select Standard explicitly.
NetScaler CPX does not currently work on GKE. This is a known issue, a fix is in progress, and there is no date yet. Contact Citrix for the current status before planning a deployment that depends on it, and use one of these instead:
- NGINX — the closest substitute, and the option this documentation covers in full
- Kubernetes Gateway API — supported by the chart, with the GKE-specific setting described below
Prerequisites
- A Google Cloud project with permissions to create GKE, Artifact Registry, and networking resources.
- A MongoDB Atlas subscription.
- Two domain names: a regular one such as
example.com, and a wildcard subdomain for proxy support such as*.proxy.example.com. - TLS certificates for those domains.
- An identity provider, such as Okta, if you intend to use SAML.
- An ingress controller, or a decision about which one to use. SecurSpaces cannot serve traffic without one, and only NetScaler CPX is deployed by the chart. See Ingress.
For sizing and supported versions, see System requirements and Sizing.
Install the following tools:
Create a GKE cluster
-
Sign in and select your project:
gcloud auth login gcloud config set project $PROJECT_ID <!--NeedCopy-->
The reference sizing for around 500 developers is two n2-standard-8 service nodes (8 vCPU, 32 GiB) and an
autoscaling workspace pool of n2-standard-16 (16 vCPU, 64 GiB). See
Sizing.
-
Create a Standard cluster with a node pool for the platform services:
gcloud container clusters create $CLUSTER_NAME \ --project $PROJECT_ID \ --region $REGION \ --num-nodes 2 \ --machine-type n2-standard-8 \ --enable-ip-alias <!--NeedCopy-->gcloud container clusters createproduces a Standard cluster. Autopilot requires the separatecreate-autocommand, which must not be used. -
Add a node pool for workspaces, with autoscaling. Workspaces are the elastic part of the deployment, so give this pool room to grow:
gcloud container node-pools create workspace-nodes \ --cluster $CLUSTER_NAME \ --project $PROJECT_ID \ --region $REGION \ --machine-type n2-standard-16 \ --num-nodes 2 \ --enable-autoscaling \ --min-nodes 2 \ --max-nodes 10 <!--NeedCopy--> -
Fetch cluster credentials and verify the connection:
gcloud container clusters get-credentials $CLUSTER_NAME --project $PROJECT_ID --region $REGION kubectl get nodes <!--NeedCopy-->The installer runs this command for you during an upgrade, using the cluster name, project, and region in your configuration file.
Create an Artifact Registry repository
SecurSpaces pulls its service images and your workspace images from a registry you control. The installer pushes them there in the next stage.
-
Enable the API and create a repository for the platform images:
gcloud services enable artifactregistry.googleapis.com --project $PROJECT_ID gcloud artifacts repositories create strong-network \ --repository-format=docker \ --location=$REGION \ --project=$PROJECT_ID <!--NeedCopy--> -
Create a repository for workspace images:
gcloud artifacts repositories create ws-images \ --repository-format=docker \ --location=$REGION \ --project=$PROJECT_ID <!--NeedCopy--> -
Authenticate Docker to the registry:
gcloud auth configure-docker $REGION-docker.pkg.dev <!--NeedCopy-->
The installer recognizes an Artifact Registry or Container Registry URL — anything containing
docker.pkg.dev or gcr.io — and authenticates to it with the Google Cloud CLI. You can sign in as a user
account, or supply a service account key with --service-account-file-path, which is the usual choice for a
pipeline. See
SDS CLI reference.
Create a MongoDB database
SecurSpaces stores its platform state in MongoDB. For what it holds and how large to expect it to grow, see The SecurSpaces database.
- In MongoDB Atlas, open the database page and select Create.
-
Configure the deployment and select Create Deployment:
- Select Google Cloud as the cloud provider.
- Choose the same region as the GKE cluster.
- Select the M10 tier with autoscaling.
- Create a database user, and note the user name and password. The installer asks for them.
- Allow access from your cluster’s egress addresses in Network Access.
- Copy the connection string from Connect > Drivers.
You can also run MongoDB inside the cluster instead of using Atlas. See Configure an external database.
If you use the Kubernetes Gateway API
GKE needs one extra setting when SecurSpaces uses Gateway API resources rather than Ingress resources. Set both of these in your configuration file:
platform:
useGatewayAPI: true
gatewayAPI:
gatewayClassName: <your-gateway-class>
enableHealthCheckPolicy: true
<!--NeedCopy-->
enableHealthCheckPolicy creates the networking.gke.io/v1 HealthCheckPolicy resources that GKE requires to
health-check the backends. It applies to GKE only.
Most deployments use an ingress controller instead. See Ingress.
Next step
Your Google Cloud infrastructure is ready. Continue with Install with the Strong Installer CLI.
During that installation you also set up the ingress controller. If you have not chosen one, do that first — see Ingress.
Related information
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.