NetScaler® ingress controller

OVN-CNI support for OpenShift using NetScaler node controller

August 25, 2026

Contributed by:

The node controller and router pod now support OVN-Kubernetes, the default CNI in OpenShift 4.x clusters. VXLAN overlay network is established between the OpenShift nodes and the NetScaler® using the ovn-k8s-mp0 interface.

NetScaler Node Controller runs one kube-cnc-router pod on each node to build the VXLAN overlay to NetScaler. This enhancement makes that set of pods self-healing. If a router pod is deleted or fails on a single node, for example after a transient problem in the node network, Node Controller recreates only that node’s pod automatically. It does this without restarting the entire Node Controller and without disrupting the healthy nodes. Each node also keeps a stable VTEP IP across pod recreations and controller restarts. In addition, this enhancement adds liveness and readiness probes that are native to Kubernetes to both the Node Controller and the router pods. For more information, see Self-healing router pods and native health checks.

Deploy OpenShift with OVN-Kubernetes

Prerequisites

OpenShift 4.x cluster with OVN-Kubernetes CNI
NetScaler (NetScaler) reachable from all cluster nodes
A dedicated subnet for VTEP overlay (must not overlap with pod or node CIDRs)
kubectl/oc CLI with cluster-admin access

Step 1: Create the namespace and secret

oc new-project netscaler

kubectl create secret generic nslogin \
  --from-literal=username='<your-adc-username>' \
  --from-literal=password='<your-adc-password>' \
  -n netscaler
<!--NeedCopy-->

Refer Create System User Account for NSNC in NetScaler

Step 2: Create the Security Context Constraint (OpenShift Only)

Router pods require privileged access on OpenShift. Create a Security Context Constraint (SCC) binding for the service account:

oc adm policy add-scc-to-user privileged system:serviceaccount:<namespace>:<service account of node controller>
<!--NeedCopy-->

Update <namespace> and <service account of node controller>.

Step 3: Deploy the node Controller

helm repo add netscaler https://netscaler.github.io/netscaler-helm-charts/

helm install nsnc netscaler/netscaler-node-controller --set license.accept=yes,nsIP=<NSIP>,vtepIP=<NetScaler SNIP>,vxlan.id=<VXLAN ID>,vxlan.port=<VXLAN PORT>,network=<IP-address-range-for-VTEP-overlay>,adcCredentialSecret=<Secret-for-NetScaler-credentials>,cniType=<CNI-overlay-name>,nsncRouterImage=<Image of nsncRouter>

<!--NeedCopy-->

Variable	Description	Example
`nsIP`	NetScaler management IP (NSIP/SNIP/CLIP)	-
`adcCredentialSecret`	NetScaler credentials (through secret `nslogin`)	—
`network`	VTEP overlay subnet — must not overlap with pod/node CIDRs	`172.16.3.0/24`
`vtepIP`	NetScaler SNIP used as VTEP endpoint	`10.10.10.2`
`vxlan.id`	VXLAN VNI — must not conflict with existing VXLANs on NetScaler	`175`
`vxlan.port`	VXLAN UDP port — must not conflict with existing VXLANs on NetScaler	`8472`
`cniType`	Set to `ovn` for OpenShift OVN-Kubernetes	`ovn`
`nsncRouterImage`	Node Controller Router Image	`quay.io/netscaler/nsnc-router:2.0.0`
`image`	Node Controller Image	`quay.io/netscaler/netscaler-k8s-node-controller/3.0.0`

Step 4: Verify the deployment

Check node controller pod is running:

kubectl get pods -n netscaler
<!--NeedCopy-->

Check router pods are created per node:

kubectl get pods -n netscaler | grep cnc-router
<!--NeedCopy-->

Check the CNC router ConfigMap is populated:

kubectl get configmap -n netscaler -o yaml
<!--NeedCopy-->

Each node must have entries: Host-<node>, Node-<ip>, Mac-<ip>, Interface-<ip>, CNI-<ip>.

Verify on NetScaler:

show vxlan
show bridgetable
show route
show ip
<!--NeedCopy-->

Expected: VXLAN tunnel, bridge table entries per node, SNIP, and pod network routes are all present.

Cleanup / Uninstall

helm delete nsnc -n netscaler

<!--NeedCopy-->

Limitations

Bridge table entries are not cleaned up from the NetScaler during node controller deletion. (only routes, VXLAN, and SNIP are removed).

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

NetScaler Secure Deployment Guide

OVN-CNI support for OpenShift using NetScaler node controller

August 25, 2026

Contributed by:

August 25, 2026

Contributed by:

OVN-CNI support for OpenShift using NetScaler node controller

Deploy OpenShift with OVN-Kubernetes

Prerequisites

Step 1: Create the namespace and secret

Step 2: Create the Security Context Constraint (OpenShift Only)

Step 3: Deploy the node Controller

Step 4: Verify the deployment

Cleanup / Uninstall

Limitations

In this article