Release 2.3.0

Last published : Nov 02, 2026
This release notes document describes the enhancements and changes, fixed and known issues that exist for release 2.3.0.
Related information
Release notes

NetScaler® Kubernetes Gateway Controller release 2.3.0

What's new

Support for MCP (Model Context Protocol) Gateway

The NetScaler Kubernetes Gateway Controller can now be deployed as an MCP Gateway to route, secure, and scale Model Context Protocol (Gen AI) workloads in Kubernetes. For more information, see MCP Gateway overview.

Support for Gateway API TLSRoute

The NetScaler Kubernetes Gateway Controller now supports the Kubernetes Gateway API TLSRoute resource. In Passthrough mode, NetScaler routes TLS traffic by the SNI host name without decrypting it. In Terminate mode (the default), NetScaler terminates TLS with the Gateway certificate and routes HTTP requests by the Host header. For more information, see Kubernetes Gateway API: TLSRoute support.

GSLB for Gateway API routes

The NetScaler GSLB Controller can now create global server load balancing entries for applications exposed through a Kubernetes Gateway API HTTPRoute. Reference the route from a GlobalTrafficPolicy host with routeRef (and optionally routeHostName and hostNameValidation). When it processes the policy, the controller reads the HTTPRoute and its parent Gateway and creates a GlobalServiceEntry for the Gateway address and listener port. Read access to Gateway API resources is controlled by the gatewayAPI.enabled value of the netscaler-gslb-controller Helm chart (enabled by default). For more information, see GSLB for Kubernetes Gateway API routes.

Automatic reload of rotated NetScaler credentials

The NetScaler Kubernetes Gateway Controller can adopt rotated NetScaler credentials (for example, Vault-issued credentials) without a pod restart. This is opt-in. You can enable it with the vaultCredentials.enabled Helm value. For more information, see Use NetScaler credentials stored in a Vault server with NetScaler Kubernetes Gateway Controller.

Smart annotations for Gateway routes

You can now use smart annotations to set NetScaler content switching, load balancing, service group, and monitor settings per Gateway route. For more information, see Smart annotations for Gateway routes.

Known issues

  • A metrics exporter that you run separately with the Vault-stored credentials of NetScaler Kubernetes Gateway Controller might not log in to NetScaler (citrixadc_probe_success is 0). It reads the credential files only once, at startup, and does not wait for them. After a rotation, the Gateway Controller switches to the new password, but the exporter keeps the old one. As a workaround, write the files with a Vault Agent init container in the exporter pod, and restart the exporter pod after each rotation. For more information, see Metrics exporter.

Helm chart release

For information on Helm chart release, see Helm Chart Release Notes.