System requirements
What a Citrix SecurSpaces™ deployment needs from your infrastructure. For how much of it, see Sizing.
For the external addresses the deployment must reach, see Network destinations.
Each requirement below is marked with what happens if you do not have it:
| Level | Meaning |
|---|---|
| Required | The deployment does not complete without it. |
| Recommended | The deployment completes. Plan for this before the environment carries real work. |
| Default | SecurSpaces provides this already. No action needed to start. |
| Conditional | Needed only in the circumstances named. |
Before deployment day
Everything marked Required, in the order you will need it:
- A deployment model chosen, and an account with permissions to provision it
- A dedicated Kubernetes cluster,
amd64, not shared with other workloads - An ingress controller, and a cluster that enforces the Network Policy API
- Two DNS domains, the second a wildcard subdomain of the first
- Persistent storage through the Persistent Volume Claim API
- The Helm CLI, available to whoever runs the deployment
- Outbound access to the license server, Docker Hub, and Google Artifact Registry
If the environment is air-gapped or has restricted egress, confirm that last item first. It is the one that most often stops a deployment on the day, and the fix — firewall changes or an offline license — is the one that takes longest to arrange. See Network destinations.
Note:
Workspaces are Linux containers. Development that requires macOS or Apple hardware, such as iOS or macOS applications, is not supported.
Kubernetes
| Requirement | Value | Level |
|---|---|---|
| Kubernetes version | 1.34 or later | Required |
| Cluster | Dedicated to SecurSpaces. Do not share it with other applications. | Required |
| Node architecture |
amd64. arm64 is not supported. |
Required |
| Node operating system on AWS | Amazon Linux | Required |
| Cluster size | A single node is enough to start. High availability and multiple nodes are not needed for a proof of concept. | Default |
Note:
Run a Kubernetes release that is still supported upstream rather than pinning to this minimum. A release that has left support stops receiving security fixes, and the supported window moves with each Kubernetes release cycle.
Supported platforms
Choose a cloud-native, on-premises, or air-gapped Kubernetes deployment, and make sure your account holds the infrastructure permissions that environment needs.
- Amazon Elastic Kubernetes Service (EKS)
- Azure Kubernetes Service (AKS)
- Google Kubernetes Engine (GKE)
- Red Hat OpenShift
- VMware Tanzu Kubernetes Grid (TKG)
- Nutanix Kubernetes Platform (NKP)
Networking
| Requirement | Detail | Level |
|---|---|---|
| Ingress gateway | NetScaler CPX is recommended, and the SecurSpaces chart can deploy it for you. NGINX, HAProxy, and the Kubernetes Gateway API are also supported. See Ingress. | Required |
| Network Policy API |
networking.k8s.io/v1. If your cluster does not implement it, install Calico or Cilium. |
Required |
| DNS domains | Two DNS domains, the second a wildcard subdomain of the first | Required |
| TLS certificates | Valid certificates for both domains | Recommended |
Important:
The Network Policy API is not optional if you rely on network policies or workspace isolation. Without a network plugin that enforces it, those policies are accepted by the API server and do nothing. See Trust boundaries.
Domains
The second domain must be a wildcard subdomain of the first. For example:
example.com*.proxy.example.com
Certificates are optional for proof-of-concept deployments, but strongly recommended.
Storage
Provide persistent storage through the Kubernetes Persistent Volume Claim API. This is required: confirm the target cluster supports the PVC API before you deploy.
Deployment tooling
| Tool | Purpose | Level |
|---|---|---|
| Helm CLI | Deploys SecurSpaces from the provided Helm chart. Must be installed and accessible to whoever runs the deployment. | Required |
| cert-manager | Needed only if the chart renders cert-manager Certificate resources. If your cluster does not use cert-manager, set platform.useCertManager: false. |
Conditional |
What SecurSpaces provides by default
You do not need to arrange either of these before a proof of concept. SecurSpaces deploys with both already working, and each has a production path you can move to later.
| Area | Default | Production path |
|---|---|---|
| Database | Percona Server for MongoDB, deployed by the chart and running in your cluster | An external MongoDB service, such as MongoDB Atlas. See Database. |
| Identity and access | Email and password authentication | An identity provider using SAML or OIDC, such as Okta. See Identity. |
The internal database is supported in production, including for air-gapped and on-premises deployments. What changes is ownership: backups, high availability, and scaling become yours to run. An external service moves that work to the provider. See Database for the comparison.
1-Click VM
The 1-Click VM runs the whole platform on a single virtual machine for evaluation. It has its own requirements, which replace the Kubernetes requirements on this page. For how much capacity it needs, see Sizing.
Target host
| Requirement | Value | Level |
|---|---|---|
| Operating system | Ubuntu 22.04 Desktop or Ubuntu 24.04 Desktop | Required |
| CPU | x86_64 with the AVX instruction set, exposed to the guest. Intel Celeron processors do not support it. | Required |
| Software | A clean installation, with no Docker, Kubernetes, K3s or related container software | Required |
| Network | Outbound internet access, and an IP address that client devices can reach. A private address is valid. | Required |
| Access | A user account with full sudo permissions |
Required |
| Hypervisor | XenServer, Hyper-V, another hypervisor, or bare metal. Cloud VMs are created by the installer. | Default |
These operating systems are not supported for the target host: Ubuntu Server, Ubuntu minimal and cloud images, Debian and other Debian-based distributions, Red Hat Enterprise Linux, CentOS, Rocky Linux and other RPM-based distributions.
Installer host
| Requirement | Value | Level |
|---|---|---|
| Machine | Separate from the target host | Required |
| Docker | Installed and running, able to pull from Docker Hub. On Windows, Docker Desktop with Linux containers. | Required |
| Network | Outbound HTTPS access to Docker Hub and the SecurSpaces image registries | Required |
| Disk | 20 GB free | Required |
What the 1-Click VM contains
| Component | Detail |
|---|---|
| Cluster | Single-node K3s |
| Ingress | NetScaler CPX (netscaler-cpx-ingress) |
| Platform | SecurSpaces services and database |
| URL | An HTTPS hostname under try.sds.citrix.com
|
| License | An evaluation license, valid for 6 months |
| TLS certificate | Valid for 90 days |
| Sample data | The Fast Cars Organization, with sample users and a sample workspace |
Limits
- Not supported for production workloads, multi-node clustering or scale testing.
- Cannot be upgraded or migrated to a production installation.
- The evaluation license expires after 6 months, and the TLS certificate after 90 days.
- Local deployments: the DNS association must be completed within 1 hour of generating the deployment script.