Disable API server certificate verification

Last published : Nov 14, 2026
While communicating with the API server from NetScaler Ingress Controller or GSLB ingress, you have the option to disable the API server certificate verification on NetScaler Ingress Controller.
Related information
Certificate management

Disable API server certificate verification on NetScaler Ingress Controller or GSLB ingress

When you deploy NetScaler Ingress Controller using YAML, you can disable the API server certificate verification by providing the following argument in the NetScaler Ingress Controller deployment YAML file.
args:
   - --disable-apiserver-cert-verify
     true
When you deploy NetScaler Ingress Controller using Helm charts, the parameter disableAPIServerCertVerify can be mentioned as True in the Helm values file as follows:
disableAPIServerCertVerify: True

Provide the CA certificate of the API server

NetScaler Ingress Controller verifies the certificate of the Kubernetes API server against the CA certificate that Kubernetes mounts at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt. The Helm charts mount this certificate and therefore a standard deployment needs no configuration.
If the pod has no such CA certificate (for example because it sets automountServiceAccountToken: false or mounts a service account volume that holds only the token), provide one. Starting with NetScaler Ingress Controller 4.3.22, set the KUBE_CACERT_PATH environment variable to the path of a CA certificate file inside the container. You can use the --kube-certificate-authority argument instead. If both are set, the argument is used. The following example mounts the kube-root-ca.crt ConfigMap that Kubernetes creates in every namespace.
spec:
  containers:
    - name: cic
      env:
        - name: "KUBE_CACERT_PATH"
          value: "/etc/cic/kube-ca/ca.crt"
      volumeMounts:
        - name: kube-ca
          mountPath: /etc/cic/kube-ca
          readOnly: true
  volumes:
    - name: kube-ca
      configMap:
        name: kube-root-ca.crt
        items:
          - key: ca.crt
            path: ca.crt
Notes:
  • If no CA certificate is available and verification is not disabled, NetScaler Ingress Controller cannot connect to the Kubernetes API server.
  • On OpenShift, do not set KUBE_CACERT_PATH to service-ca.crt as the file does not hold the CA of the API server. Use ca.crt or the kube-root-ca.crt ConfigMap.