NetScaler® ingress controller

OVN-CNI support for OpenShift using NetScaler node controller

May 26, 2026

Contributed by:

The node controller and router pod now support OVN-Kubernetes, the default CNI in OpenShift 4.x clusters. VXLAN overlay network is established between the OpenShift nodes and the NetScaler® using the ovn-k8s-mp0 interface.

Deploy OpenShift with OVN-Kubernetes

Prerequisites

OpenShift 4.x cluster with OVN-Kubernetes CNI
NetScaler (NetScaler) reachable from all cluster nodes
A dedicated subnet for VTEP overlay (must not overlap with pod or node CIDRs)
kubectl/oc CLI with cluster-admin access

Step 1: Create the namespace and secret

oc new-project netscaler

kubectl create secret generic nslogin \
  --from-literal=username='<your-adc-username>' \
  --from-literal=password='<your-adc-password>' \
  -n netscaler
<!--NeedCopy-->

Refer Create System User Account for NSNC in NetScaler

Step 2: Create the Security Context Constraint (OpenShift Only)

Router pods require privileged access on OpenShift. Create a Security Context Constraint (SCC) binding for the service account:

oc adm policy add-scc-to-user privileged system:serviceaccount:<namespace>:<service account of node controller>
<!--NeedCopy-->

Update <namespace> and <service account of node controller>.

Step 3: Deploy the node Controller

helm repo add netscaler https://netscaler.github.io/netscaler-helm-charts/

helm install nsnc netscaler/netscaler-node-controller --set license.accept=yes,nsIP=<NSIP>,vtepIP=<NetScaler SNIP>,vxlan.id=<VXLAN ID>,vxlan.port=<VXLAN PORT>,network=<IP-address-range-for-VTEP-overlay>,adcCredentialSecret=<Secret-for-NetScaler-credentials>,cniType=<CNI-overlay-name>,nsncRouterImage=<Image of nsncRouter>

<!--NeedCopy-->

Variable	Description	Example
`nsIP`	NetScaler management IP (NSIP/SNIP/CLIP)	-
`adcCredentialSecret`	NetScaler credentials (through secret `nslogin`)	—
`network`	VTEP overlay subnet — must not overlap with pod/node CIDRs	`172.16.3.0/24`
`vtepIP`	NetScaler SNIP used as VTEP endpoint	`10.10.10.2`
`vxlan.id`	VXLAN VNI — must not conflict with existing VXLANs on NetScaler	`175`
`vxlan.port`	VXLAN UDP port — must not conflict with existing VXLANs on NetScaler	`8472`
`cniType`	Set to `ovn` for OpenShift OVN-Kubernetes	`ovn`
`nsncRouterImage`	Node Controller Router Image	`quay.io/netscaler/nsnc-router:2.0.0`
`image`	Node Controller Image	`quay.io/netscaler/netscaler-k8s-node-controller/3.0.0`

Step 4: Verify the deployment

Check node controller pod is running:

kubectl get pods -n netscaler
<!--NeedCopy-->

Check router pods are created per node:

kubectl get pods -n netscaler | grep cnc-router
<!--NeedCopy-->

Check the CNC router ConfigMap is populated:

kubectl get configmap -n netscaler -o yaml
<!--NeedCopy-->

Each node must have entries: Host-<node>, Node-<ip>, Mac-<ip>, Interface-<ip>, CNI-<ip>.

Verify on NetScaler:

show vxlan
show bridgetable
show route
show ip
<!--NeedCopy-->

Expected: VXLAN tunnel, bridge table entries per node, SNIP, and pod network routes are all present.

Cleanup / Uninstall

helm delete nsnc -n netscaler

<!--NeedCopy-->

Limitations

Bridge table entries are not cleaned up from the NetScaler during node controller deletion. (only routes, VXLAN, and SNIP are removed).

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

NetScaler Secure Deployment Guide

OVN-CNI support for OpenShift using NetScaler node controller

May 26, 2026

Contributed by:

May 26, 2026

Contributed by:

OVN-CNI support for OpenShift using NetScaler node controller

Deploy OpenShift with OVN-Kubernetes

Prerequisites

Step 1: Create the namespace and secret

Step 2: Create the Security Context Constraint (OpenShift Only)

Step 3: Deploy the node Controller

Step 4: Verify the deployment

Cleanup / Uninstall

Limitations

In this article