Hi, anyone used built-in NetScaler Agent? Any caveats?

ADM?

Yep

it "works", but it's not perfectly stable. I've had to redeploy them multiple times for what appears to be no reason

Only the agent piece is not stable or the entire netscaler? Does it require 8vcpu and 32gb ram as well? Or more?

only the agent piece

Full agent requires that much. Lightweight agent needs 4vcpu and 8gb, but it can be used only for licensing

i certainly have it on lighter systems. I guess it depends on what you're using it for.

I have always recommended the separate agent, not the built-in. It works, but not really. For the future licensing (Flex), a separate agent is required, I believe.

I would also lean you to separate agent.

the built-in agent doesn't support any of the previous 'pooled' licensing or the new 'flex' licensing models with UHMC which is a big thing there unfortunately ruling it out. At least nothing I have seen with any changes for it supporting that licensing.

That's important note. I will have to use ADM because of the flexed licensing so the built-in agent doesn't fit for me. In the documentation there's only pooled licensing mentioned as not supported so I hoped flexed is supported.

You an use an on-premises NetScaler Console (ADM is not the name anymore) or an on-premises agent connected to the NetScaler Console Service. ANything else will nto support the licenisng.

The idea was to use NetScaler Console Service and built-in agents and don't deploy any additional crap

Unfortunately, that will not be possible.

8vcpu! Ryan is not the first person, who mentioned that lightweight agent is unstable

I use the agents always and I think the majority are configured with 2vCPUs and 8GB ram, no issues (after they fixed the memory leak quite some time ago). I use the agent primarily to patch the NetScalers. One thing worth mentioning might be that the benefit of using the agent is that only it needs to connect to the internet, not the NetScaler itself (ofc, if you use IP reputation, Bot Management, OIDC or sth, you might need to allow NetScaler to connect to internet). There's definitely a "security angle" to it also, if the NetScaler gets forked the malicious actor might be able to establish a remote management to the NetScaler and steal all your precious data. (+ with the Service the Agent is "evergreen" and constantly updated automatically, assuming this might be a security benefit also!)