Deploy NetScaler Kubernetes Gateway Controller for MCP

Last published : Nov 02, 2026
NetScaler Kubernetes Gateway Controller supports deploying an MCP (Model Context Protocol) Gateway that fronts your MCP servers. The controller programs the NetScaler instance from Kubernetes-native resources, so you configure MCP routing, profiles, access control, rate limiting, credential injection, and observability without manual CLI or GUI configuration on the NetScaler instance.
You can enable NetScaler® MCP Gateway capabilities using either of the following deployment options, depending on where your traffic originates:
  • NetScaler Kubernetes Gateway Controller with NetScaler VPX/MPX/BLX — NetScaler Kubernetes Gateway Controller runs in the cluster and configures an external NetScaler VPX/MPX/BLX. The front end can terminate TLS (HTTPS) at the edge, and the VIP is a static or IPAM-allocated address.
  • NetScaler CPX with Gateway Controller — NetScaler CPX and NetScaler Kubernetes Gateway Controller run together inside the cluster. The front end can be HTTP or HTTPS (TLS termination), and the VIP is the CPX pod IP.
Note:
OAuth 2.1 client authentication (the AAA-governed authentication path) is available for MCP only with NetScaler VPX/MPX/BLX. It is not available for MCP on NetScaler CPX. All other MCP Gateway capabilities — header-based routing, mcpprofile host and URL replacement, ExternalName backends, server access control, tool-based rate limiting, gateway credential injection, and Splunk observability — are supported on both form factors.
Related information
MCP Gateway

Prerequisites

  • A Kubernetes cluster with kubectl configured.
  • Helm 3.x or later.
  • Gateway API CRDs installed from the official standard channel.
  • NetScaler 14.1 or later on the managed NetScaler VPX/MPX/BLX, or a NetScaler CPX image based on NetScaler 14.1 or later.
Note:
Helm adds the CRDs of a chart only when you run helm install, and only the CRDs that are not in the cluster yet. helm upgrade does not add new CRDs or update existing ones.
If you upgrade an existing NetScaler Kubernetes Gateway Controller to release 2.3.0, or if the cluster already has NetScaler CRDs from an earlier release or from another NetScaler Helm chart (for example, NetScaler Ingress Controller), apply the CRD file of the chart before you create MCP resources. The file adds or updates the CRDs that MCP Gateway uses, such as mcpprofile, mcproute, authpolicy, and ratelimit:
kubectl apply -f https://raw.githubusercontent.com/netscaler/netscaler-helm-charts/master/netscaler-kubernetes-gateway-controller/crds/crds.yaml
For NetScaler CPX with Gateway Controller, apply the CRD file of the netscaler-cpx-with-gateway-controller chart instead:
kubectl apply -f https://raw.githubusercontent.com/netscaler/netscaler-helm-charts/master/netscaler-cpx-with-gateway-controller/crds/crds.yaml

Deploy NetScaler Kubernetes Gateway Controller with NetScaler VPX/MPX/BLX

Use this option when NetScaler Kubernetes Gateway Controller manages an external NetScaler VPX/MPX/BLX.

Install NetScaler Kubernetes Gateway Controller

To install the chart with the release name, my-release, use the following command:
helm install my-release netscaler/netscaler-kubernetes-gateway-controller --set license.accept=yes,gatewayController.gatewayControllerName=<controllerName>,gatewayController.entityPrefix=<prefix>,netscaler.nsIP=<NSIP>,netscaler.adcCredentialSecret=<Secret-for-NetScaler-credentials>
Note:
By default, the chart installs the recommended RBAC roles and role bindings.
The command deploys NetScaler Kubernetes Gateway Controller on Kubernetes cluster with the default configuration. The configuration section lists the mandatory and optional parameters that you can configure during installation.

Create the GatewayClass

After the NetScaler Kubernetes Gateway Controller is installed, create a GatewayClass that binds to the controller. The controllerName must match the gatewayController.gatewayControllerName value used during installation.
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: mcpgwclass
spec:
  controllerName: citrix.com/nsgw-controller
EOF

Deploy NetScaler CPX with Gateway Controller

Use this option to run NetScaler CPX and the Gateway Controller together inside the cluster.

Install NetScaler CPX with Gateway Controller

To install the chart with the release name my-release:
helm install my-release netscaler/netscaler-cpx-with-gateway-controller --set license.accept=yes,gatewayController.gatewayControllerName=<controllerName>
Note:
By default the chart installs the recommended RBAC roles and role bindings.
The command deploys NetScaler CPX with NetScaler Kubernetes Gateway Controller as a sidecar on the Kubernetes cluster with the default configuration. The configuration section lists the mandatory and optional parameters that you can configure during installation.

Create the GatewayClass

After NetScaler CPX with Gateway Controller is installed, create a GatewayClass that binds to the controller. The controllerName must match the gatewayController.gatewayControllerName value used during installation.
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: mcpgwclass
spec:
  controllerName: citrix.com/nscpxgw-controller
EOF
Note:
Every MCP Gateway resource — the Gateway, mcpprofile, and mcproute — must belong to the GatewayClass created here (mcpgwclass). Set the Gateway spec.gatewayClassName to mcpgwclass. The mcpprofile attaches to that Gateway through infrastructure.parametersRef (or to a route through an ExtensionRef filter), and the mcproute attaches through parentRefs — so both are governed by the same GatewayClass.

Verify the deployment

Confirm that the controller is running and the GatewayClass is accepted before you apply MCP Gateway resources.
kubectl get pods
kubectl get gatewayclass mcpgwclass
The controller pod must show STATUS Running (for CPX, the pod shows READY 2/2), and the GatewayClass must show ACCEPTED True.

Reference