Hands-on Lab·Certified Kubernetes Administrator
kube-proxy: iptables and IPVS Modes
Trace one Service from its ClusterIP through three iptables chains to the DNAT rule that rewrites the packet, then switch a cluster to IPVS and read the same routing out of ipvsadm. Two implementations of the same abstraction, both visible.
Services and Networking Guide 53 of 103 Advanced
- Kubernetes1.36.4
- Clusters4 nodes and 1 node
- CNICalico v3.32.1
- Runtimecontainerd 2.2.6
- TimeAbout 40 min
- Reviewed21 August 2026
Written against the versions above. Chain names contain a hash of the Service identity, so yours will differ. The structure will not.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA4001 | 192.168.0.191 | Ubuntu 26.04 LTS | Control Plane Node (single-node cluster) | 2 Core | 4 GB | 50 GB |
Before you start
- The Services and EndpointSlices guides. This one explains how those two become packet handling.
- Root on a node, and enough iptables familiarity to read
-A CHAIN -j TARGET. - A cluster you can change kube-proxy's mode on. Use a disposable one for the second half.
-
Which mode is kube-proxy in, and how to tell reliably
-
Follow one ClusterIP through three chains
-
Session affinity, visible as a different rule
-
Switch to IPVS
-
The same routing, in a table you can actually read
-
Switch back