NetScaler® ingress controller

BIND DNS integration with IPAM controller and ingress controller

May 26, 2026

Contributed by:

BIND 9 is a complete implementation of the DNS protocol. BIND 9 can be configured as an authoritative name server, a resolver, and, on supported hosts, a stub resolver. For more information, see Bind 9.

NetScaler Ingress Controller supports assigning IP addresses to Ingresses and services of type LoadBalancer by using the ipam-range annotation. The IPAM controller uses the VIP CustomResourceDefinition (CRD) for internal communication with NetScaler Ingress Controller. The VIP CRD is automatically installed as part of the Helm installation of the IPAM controller and now supports the hostname field associated with the VIP.

Prerequisites

Deploy ingress controller using the helm values with IPAM enabled as true and set your service class and ingress class. The following example uses a helm chart to deploy NetScaler Ingress Controller with the desired configurations:

helm install nsic netscaler/netscaler-ingress-controller --set nsIP=<NSIP>,license.accept=yes,adcCredentialSecret=nslogin,ingressClass[0]=cic-vpx,serviceClass[0]=cic-vpx,ipam=true,entityPrefix=demo
<!--NeedCopy-->

Set up TSIG (Transaction SIGnatures) and provide access controls in binddns following the documentation TSIG. Note the TSIG KEY and TSIG Secret for later use.

Deploy IPAM controller with BIND DNS

Deploy the IPAM controller with the following configurations for enabling BIND DNS:

Create a BIND DNS TSIG KEY and TSIG SECRET as a Kubernetes secret:

kubectl create secret generic binddns-tsig-secret --from-literal=tsigKey=<TSIG Key Name> --from-literal=tsigSecret=<TSIG Secret> -n <namespace>
<!--NeedCopy-->

Install the IPAM controller with the following command:

helm install my-release netscaler/netscaler-ipam-controller \
  --set vipRange=<IP_RANGE> \
  --set dns.enabled=true \
  --set dns.type=binddns \
  --set dns.binddns.server=<BIND_SERVER_IP:PORT> \
  --set dns.binddns.zone=example.com \
  --set dns.binddns.tsigKeySecret=binddns-tsig-secret
<!--NeedCopy-->

Use cases

There are currently two ways host names are supported:

ingress
service type LoadBalancer

Ingress

For ingress, you must provide the IPAM range with the following annotation with the desired ingress class:

ingress.citrix.com/ipam-range: prod
<!--NeedCopy-->

The following example provides the details:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    ingress.citrix.com/ipam-range: prod
  name: web-ingress
spec:
  ingressClassName: cic-vpx
  defaultBackend:
    service:
      name: frontend
      port:
        number: 80
  rules:
    - host: web-frontend.example.com
      http:
        paths:
          - backend:
              service:
                name: frontend
                port:
                  number: 80
            path: /
            pathType: ImplementationSpecific
    - host: web-backend.example.com
      http:
        paths:
          - backend:
              service:
                name: backend
                port:
                  number: 80
            path: /
            pathType: ImplementationSpecific
<!--NeedCopy-->

After the ingress is created, the respective VIP object is created with host names provided in the spec.rules[].host field for each rule.

apiVersion: citrix.com/v1
kind: vip
metadata:
  name: ingress-web-ingress
  namespace: default
spec:
  description: VIP for the web-ingress Service
  hostname:
  - web-frontend.example.com
  - web-backend.example.com
  ipaddress: 
  kind: ingress
  name: web-ingress
  range-name: prod
<!--NeedCopy-->

The IPAM controller reads this VIP and assigns an IP from the IP ranges, if available. Once IP allocation is completed, IPAM calls BIND DNS with the list of host names and the IP address which is assigned for the hostnames in BIND DNS as an A record.

Service

For service of type LoadBalancer, you must provide the IPAM range with the following annotation:

service.citrix.com/ipam-range: 'prod'
<!--NeedCopy-->

Host name in the following annotation:

service.citrix.com/external-hostname: 'svc.lb.example.com'
<!--NeedCopy-->

Service class in the service YAML.

apiVersion: v1
kind: Service
metadata:
  name: apache
  annotations:
    service.citrix.com/ipam-range: 'prod'
    service.citrix.com/external-hostname: 'svc.lb.example.com'
    service.citrix.com/class: 'cic-vpx'
  labels:
    name: apache
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  selector:
    name: apache
  ports:
  - name: http
    port: 80
    targetPort: http
<!--NeedCopy-->

This creates a VIP object with host name as given in the external-hostname annotation.

apiVersion: citrix.com/v1
kind: vip
metadata:
  name: service-apache
  namespace: default
spec:
  description: VIP for the apache Service
  hostname:
  - svc.lb.example.com
  ipaddress: 
  kind: service
  name: apache
  range-name: prod
<!--NeedCopy-->

The IPAM controller reads this VIP and assigns an available IP address from the configured IP range. After the IP address is assigned, the IPAM controller creates an A record in BIND DNS that maps each host name to the assigned IP address.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

NetScaler Secure Deployment Guide

BIND DNS integration with IPAM controller and ingress controller

May 26, 2026

Contributed by:

May 26, 2026

Contributed by:

BIND DNS integration with IPAM controller and ingress controller

Prerequisites

Deploy IPAM controller with BIND DNS

Use cases

Ingress

Service

In this article