NetScaler Ingress Controller
NetScaler Ingress Controller configures NetScaler appliances from Kubernetes Ingress rules and routes traffic into Kubernetes clusters.
What NetScaler Ingress Controller is
NetScaler Ingress Controller configures NetScaler appliances from Kubernetes Ingress rules and routes traffic into Kubernetes clusters. It exposes Kubernetes services to external users across on-premises and public-cloud environments. Supported traffic includes HTTP, HTTPS, TCP, TCP-SSL, and UDP, with layer 7 rewrite and responder policies available through NetScaler custom resources. With NetScaler CPX, it provides layer 7 load balancing for east-west microservice traffic. The controller manages CPX, BLX, VPX, or MPX appliances and supports single-tier or dual-tier topologies, including standalone pods and CPX sidecars. It can load-balance services in bare-metal Kubernetes clusters. Deployment uses YAML manifests or Helm charts. Documented platforms include Kubernetes 1.21 and later, GKE, EKS, AKS, OpenShift 3.11 and later, PKS, Diamanti, Mirantis Kubernetes Engine, VMware Tanzu, and Rancher. Integrations include Prometheus, Grafana, cert-manager, HashiCorp Vault, ExternalDNS, and OpenShift. Security features cover TLS certificates, client and server authentication, OWASP Top 10 policies, and web application firewall policies. Automatic certificate provisioning and renewal can use cert-manager, including Let’s Encrypt and Vault. Pricing is on request.
Good
- Supports HTTP, HTTPS, TCP, TCP-SSL, and UDP
- Works with multiple Kubernetes distributions
- Offers YAML and Helm deployment methods
- Integrates monitoring and certificate-management tools
- Includes web application firewall policies
Watch out
- Paid product with pricing available on request
- Requires self-hosted Kubernetes and NetScaler infrastructure
- CPX licensing uses an ADM license server
Who it suits
It suits teams exposing Kubernetes services and managing application traffic across on-premises or public-cloud clusters with NetScaler appliances.
Verdict
NetScaler Ingress Controller provides broad protocol, topology, platform, and security support for NetScaler-based Kubernetes traffic management. It fits environments already using NetScaler appliances and related tooling.
The facts
Each one read from NetScaler Ingress Controller's own pages, with the date it was checked.
What it does
- Bare metal
- It can provide load balancing for services in bare metal Kubernetes clusters, where Kubernetes does not natively provide a load balancer implementation.checked 4 Oct 2026
- Certificate management
- It supports automatic TLS certificate provisioning and renewal through cert-manager, including certificate sources such as Let’s Encrypt and HashiCorp Vault.checked 5 Oct 2026
- Cloud integrations
- The documentation describes deployments with Azure Kubernetes Service, Google Kubernetes Engine, Anthos, and Amazon EKS.checked 5 Oct 2026
- CPX licensing
- The documented CPX licensing configuration uses a NetScaler ADM license server and specifies the CP1000 platform license.checked 5 Oct 2026
- Deployment methods
- The controller can be deployed using YAML manifests or Helm charts.checked 5 Oct 2026
- Deployment topologies
- The controller supports single-tier and dual-tier topologies, and can run as a standalone pod or as a sidecar alongside NetScaler CPX.checked 4 Oct 2026
- East-west traffic
- With NetScaler CPX, it provides layer 7 load balancing for east-west traffic between microservices in a Kubernetes cluster.checked 4 Oct 2026
- Install method
- NetScaler says the Ingress Controller can be deployed using Helm charts.checked 4 Oct 2026
- Integrations
- The documentation includes integration guidance for Prometheus and Grafana, cert-manager, HashiCorp Vault, ExternalDNS, and OpenShift.checked 4 Oct 2026
- Intended use
- The product is described for exposing Kubernetes services to external users and managing application traffic across on-premises and public cloud environments.checked 4 Oct 2026
- Kubernetes support
- Supported platforms include Kubernetes v1.21 and later, GKE, EKS, AKS, OpenShift 3.11 and later, PKS, Diamanti, Mirantis Kubernetes Engine, VMware Tanzu, and Rancher.checked 4 Oct 2026
- Monitoring
- NetScaler Metrics Exporter can export NetScaler statistics to Prometheus for visualization in Grafana.checked 5 Oct 2026
- OpenShift integration
- It can run as an OpenShift router plug-in and supports unsecured routes, edge TLS termination, and passthrough termination.checked 5 Oct 2026
- Pricing
- NetScaler’s pricing page lists subscription license options but directs buyers to contact a representative or service provider for pricing details.checked 5 Oct 2026
- Purpose
- The controller translates Kubernetes Ingress rules into configuration for NetScaler load balancers and routes traffic into Kubernetes clusters.checked 5 Oct 2026
- Security capabilities
- The documentation lists support for TLS certificate handling, client and server authentication, OWASP Top 10 protection policies, and web application firewall policies.checked 4 Oct 2026
- Security policies
- A WAF custom resource definition lets the controller apply web application firewall configuration to the Ingress NetScaler device.checked 5 Oct 2026
- Source availability
- The public GitHub repository identifies the project as licensed under Apache License 2.0.checked 5 Oct 2026
- Support
- NetScaler support experts follow up on support tickets submitted through the Citrix support portal, and users can also ask the NetScaler community.checked 4 Oct 2026
- Supported NetScaler types
- It can configure NetScaler CPX, BLX, VPX, or MPX according to Ingress rules.checked 5 Oct 2026
The company
- Headquarters
- Fort Lauderdale, Florida, USAchecked 28 Sep 2026
- Maker
- Cloud Software Group says Citrix and TIBCO merged in 2022; its contact page lists Fort Lauderdale, Florida, as headquarters.checked 5 Oct 2026
Where it runs
- Kubernetes platforms
- The documented platforms include Kubernetes v1.21 and later, GKE, EKS, AKS, OpenShift 3.11 and later, PKS, Diamanti, Mirantis Kubernetes Engine, VMware Tanzu, and Rancher.checked 5 Oct 2026
- NetScaler appliances
- The controller manages NetScaler CPX, VPX, or MPX appliances; the licensing documentation specifies CPX platform license CP1000 and an ADM license server configuration.checked 4 Oct 2026
Alternatives to NetScaler Ingress Controller
- 1

ngrok
Free planWebAPILinuxmacOS7.8From $10 a month - 2

Higress
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3

Traefik Proxy
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4

agentgateway
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 5
Kusk Gateway
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 6

BFE Ingress Controller
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan
