OVN-CNI support for OpenShift using NetScaler node controller

Last published : Sep 30, 2026
The node controller and router pod now support OVN-Kubernetes, the default CNI in OpenShift 4.x clusters. VXLAN overlay network is established between the OpenShift nodes and the NetScaler® using the ovn-k8s-mp0 interface.
NetScaler Node Controller runs one kube-cnc-router pod on each node to build the VXLAN overlay to NetScaler. This enhancement makes that set of pods self-healing. If a router pod is deleted or fails on a single node, for example after a transient problem in the node network, Node Controller recreates only that node's pod automatically. It does this without restarting the entire Node Controller and without disrupting the healthy nodes. Each node also keeps a stable VTEP IP across pod recreations and controller restarts. In addition, this enhancement adds liveness and readiness probes that are native to Kubernetes to both the Node Controller and the router pods. For more information, see Self-healing router pods and native health checks.
Related information
Network

Deploy OpenShift with OVN-Kubernetes

Prerequisites

  • OpenShift 4.x cluster with OVN-Kubernetes CNI
  • NetScaler (NetScaler) reachable from all cluster nodes
  • A dedicated subnet for VTEP overlay (must not overlap with pod or node CIDRs)
  • kubectl/oc CLI with cluster-admin access

Step 1: Create the namespace and secret

oc new-project netscaler

kubectl create secret generic nslogin \
  --from-literal=username='<your-adc-username>' \
  --from-literal=password='<your-adc-password>' \
  -n netscaler
Refer Create System User Account for NSNC in NetScaler

Step 2: Create the Security Context Constraint (OpenShift Only)

Router pods require privileged access on OpenShift. Create a Security Context Constraint (SCC) binding for the service account:
oc adm policy add-scc-to-user privileged system:serviceaccount:<namespace>:<service account of node controller>
Update <namespace> and <service account of node controller>.

Step 3: Deploy the node Controller

helm repo add netscaler https://netscaler.github.io/netscaler-helm-charts/

helm install nsnc netscaler/netscaler-node-controller --set license.accept=yes,nsIP=<NSIP>,vtepIP=<NetScaler SNIP>,vxlan.id=<VXLAN ID>,vxlan.port=<VXLAN PORT>,network=<IP-address-range-for-VTEP-overlay>,adcCredentialSecret=<Secret-for-NetScaler-credentials>,cniType=<CNI-overlay-name>,nsncRouterImage=<Image of nsncRouter>
Variable Description Example
nsIP NetScaler management IP (NSIP/SNIP/CLIP) -
adcCredentialSecret NetScaler credentials (through secret nslogin) —
network VTEP overlay subnet — must not overlap with pod/node CIDRs 172.16.3.0/24
vtepIP NetScaler SNIP used as VTEP endpoint 10.10.10.2
vxlan.id VXLAN VNI — must not conflict with existing VXLANs on NetScaler 175
vxlan.port VXLAN UDP port — must not conflict with existing VXLANs on NetScaler 8472
cniType Set to ovn for OpenShift OVN-Kubernetes ovn
nsncRouterImage Node Controller Router Image quay.io/netscaler/nsnc-router:2.0.0
image Node Controller Image quay.io/netscaler/netscaler-k8s-node-controller/3.0.0

Step 4: Verify the deployment

Check node controller pod is running:
kubectl get pods -n netscaler
Check router pods are created per node:
kubectl get pods -n netscaler | grep cnc-router
Check the CNC router ConfigMap is populated:
kubectl get configmap -n netscaler -o yaml
Each node must have entries: Host-<node>, Node-<ip>, Mac-<ip>, Interface-<ip>, CNI-<ip>.
Verify on NetScaler:
show vxlan
show bridgetable
show route
show ip
Expected: VXLAN tunnel, bridge table entries per node, SNIP, and pod network routes are all present.

Cleanup / Uninstall

helm delete nsnc -n netscaler

Limitations

  • Bridge table entries are not cleaned up from the NetScaler during node controller deletion. (only routes, VXLAN, and SNIP are removed).