NetScaler® Operator release notes

The NetScaler ingress, gateway, GSLB, and node controllers can now adopt rotated NetScaler credentials (for example, Vault-issued credentials). This feature is opt-in. You can enable it with the netscaler.vaultCredentials.enabled field of the NetscalerIngressController, NetscalerK8sGatewayController, or NetscalerGslbController instance, or the vaultCredentials.enabled field of the NetscalerNodeController instance (the NetscalerNodeController needs NetScaler Node Controller 3.2.13 or later), and add your Vault Agent sidecar with extraContainers. The controller then reads the credentials from files rendered by the Vault Agent sidecar and re-checks them on a periodic poll (default 30 seconds), so a rotated credential is adopted without a pod restart. A watcher confirms each new password with a test login before using it, and keeps using the current password if the new one is rejected. If you do not enable it, hot-reload stays off, and deployments that supply the password through a Kubernetes secret continue to work unchanged. For more information, see Use NetScaler credentials stored in a Vault server with NetScaler Ingress Controller, NetScaler Kubernetes Gateway Controller, NetScaler GSLB controller, or NetScaler Node Controller.

The Listener CRD can now bind an SSL certkeybundle that was preconfigured directly on NetScaler, matching the behavior already available for Secret-based bundles and for the Gateway CRD. Set preconfiguredBundle: true on a preconfigured certificate entry and NetScaler Ingress Controller binds it as a certkeybundle instead of a plain certkey. Without the field, the name is still bound as a plain certkey. For more information, see Listener.

The GSLB HTTPS health monitor used a fixed TLS setup, so you could not choose the TLS version, ciphers, or other SSL settings it used. You can now add two optional fields to an HTTPS monitor in the GlobalTrafficPolicy to control exactly how the health check negotiates TLS:

For more information, see GSLB overview and deployment topologies.

The GSLB health monitor in a GlobalTrafficPolicy previously exposed only a limited set of NetScaler monitor parameters, so you could not fully tune probe behavior. The GSLB health monitor now supports curated monitor fields (such as interval, respTimeout, retries, failureRetries, successRetries, downTime, deviation, reverse, secure, lrtm, netProfile, and monState) plus an advancedOptions map that forwards any other NetScaler monitor parameter, with any omitted field reset to the NetScaler default. For more information, see GSLB overview and deployment topologies.

The GSLB Controller can now create global server load balancing entries for applications exposed through a Kubernetes Gateway API HTTPRoute. Reference the route from a GlobalTrafficPolicy host with routeRef (and optionally routeHostName and hostNameValidation). When it processes the policy, the controller reads the HTTPRoute and its parent Gateway and creates a GlobalServiceEntry for the Gateway address and listener port. Read access to Gateway API resources is controlled by the gatewayAPI.enabled field of the NetscalerGslbController CR (enabled by default). For more information, see GSLB for Kubernetes Gateway API routes.

NetScaler can now be deployed as an MCP (Model Context Protocol) Gateway to route, secure, and scale Gen AI workloads in Kubernetes. You define traffic with the new mcproute CRD (with extensionRef and HTTP filter support, like HTTPRoute) and protect it with OAuth authentication plus token-claim-driven authorization configured through the authpolicy CRD, with MCP server access control configured through the rewritepolicy CRD, and with tool-based rate limiting configured through the ratelimit CRD. For more information, see MCP Gateway overview.

The NetScaler Kubernetes Gateway Controller now supports the Kubernetes Gateway API TLSRoute resource. In Passthrough mode, NetScaler routes TLS traffic by the SNI host name without decrypting it. In Terminate mode (the default), NetScaler terminates TLS with the Gateway certificate and routes HTTP requests by the Host header. For more information, see Kubernetes Gateway API: TLSRoute support.

You can use smart annotations to set NetScaler content switching, load balancing, service group, and monitor settings per Gateway route. For more information, see Smart annotations for Gateway routes.

Previously, when the IPAM controller's IP pool was exhausted, a new VIP allocation request would hang with no error, retry, or progress shown. The controller now holds the request and assigns an address as soon as one is released, and reports progress through Kubernetes events and a new durable status on the vips.citrix.com resource (status.state Pending or Allocated). For more information, see IP address management using the NetScaler IPAM controller.

NetScaler Operator is now at parity with the Helm charts that are released with NetScaler Ingress Controller 4.3.22. These include the Helm charts for NetScaler Ingress Controller, NetScaler GSLB Controller, NetScaler Kubernetes Gateway Controller, NetScaler IPAM Controller, and NetScaler Node Controller. The operator custom resources now expose the new chart capabilities, including Vault credential hot-reload, Splunk analytics and distributed tracing, Gateway API support in the GSLB controller, control over service-status publishing, IPAM TLS verification, and NetScaler Node Controller health probes. The operator also sets default CPU and memory for the NetScaler Kubernetes Gateway Controller container (requests 32m CPU and 256Mi memory, limits 100m CPU and 512Mi memory) and for NetScaler CPX in the CPX with Gateway Controller resource (requests 128m CPU and 512Mi memory, limits 500m CPU and 1Gi memory).

The operator now lets you set how the metrics exporter validates the NetScaler certificate by using the new exporter.validateCert field, which applies only to the NetscalerIngressController instance. The field defaults to no, so existing instances keep their current behavior after you upgrade. Set it to auto (or yes, true, y, on, or 1) to make the metrics exporter validate the NetScaler certificate against the trust store in the exporter image; this requires NetScaler Metrics Exporter 1.7.0 or later. When nsValidateCert (with hostAliases) is configured, the exporter validates the certificate against that CA instead. The operator also accepts false, n, off, and 0 as no, and rejects any other value: when the exporter is enabled, the instance reports Available=False with the reason ExporterValidateCertRequired. Leaving the field unset does not cause an error. For more information, see Deploy NetScaler Ingress Controller in OpenShift using NetScaler Operator.

The operator-deployed IPAM controller now writes each virtual IP's allocation state and status message back onto the vip resource, shown as new Status and Message columns. Its deployment now uses the Recreate upgrade strategy, so an upgrade no longer briefly runs two IPAM pods that could hand out the same address twice. For more information, see Deploy NetScaler IPAM controller using NetScaler Operator.

NetScaler Operator can now deploy the NetScaler Node Controller through the new NetscalerNodeController custom resource. The operator adds liveness and readiness health probes to the node controller pod by default, matching the Helm chart; you can adjust the probe timings or turn them off with the healthProbes field. When you delete a NetscalerNodeController instance, the operator removes the node controller in an order that lets it clean up after itself: the node controller removes its overlay configuration from NetScaler, the router pods remove their VXLAN interfaces and iptables rules from the nodes, and the operator then deletes the router ConfigMaps and the RBAC. The net profile cnc-<clusterName>_netprof stays on NetScaler, so delete it yourself once nothing uses it. For more information, see Deploy NetScaler Node Controller using NetScaler Operator.