kube-proxy: iptables and IPVS Modes

Services and Networking / Guide 53 of 103 / Advanced

• Kubernetes1.36.4
• Clusters2 (4-node and 1-node)
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 40 min

Chain names contain a hash of the Service identity, so yours will differ. The structure will not.

This guide includes

Use this when a Service works, or fails, and you want to see the actual rule deciding it. This matters because kube-proxy turns every Service into packet-filter rules, and being able to trace one ClusterIP to its DNAT rule ends most Service debugging outright.

• determining which mode kube-proxy is really in, since the obvious place to look is misleading
• following one ClusterIP through three iptables chains to the DNAT rule that rewrites it
• turning on session affinity and watching a new recent rule appear to implement it
• switching to IPVS and reading the same routing in a table you can actually read
• switching back, and restarting the DaemonSet to apply it

Before you start

• The Services and EndpointSlices guides. This one explains how those two become packet handling.
• Root on a node, and enough iptables familiarity to read -A CHAIN -j TARGET.
• A cluster you can change kube-proxy's mode on. Use a disposable one for the second half.

1. 1

   Which mode is kube-proxy in, and how to tell reliably

2. 2

   Follow one ClusterIP through three chains

3. 3

   Session affinity, visible as a different rule

4. 4

   Switch to IPVS

5. 5

   The same routing, in a table you can actually read

6. 6

   Switch back

Official sources

• Virtual IPs and Service proxies
• kube-proxy reference
• KubeProxyConfiguration reference
• nftables proxy mode
• Debug Services