kube-proxy mode nftables

[RomainMou]

What would you like to be added

I would like to be able to use the kub-proxy mode nftables that seams to be the future of kube-proxy. https://kubernetes.io/docs/reference/networking/virtual-ips/#proxy-mode-nftables

Why is this needed

nftables seems to be the futur for kube-proxy, at least that what is explain here: https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/3866-nftables-proxy/README.md#the-ipvs-mode-of-kube-proxy-will-not-save-us.

[VannTen]

This is pretty interesting. I'm not sure how much work that would be 🤔 ?

Also, is there a manual migration steps on existing clusters ? I see in your links the behaviour is slighty different on some corner cases, but do existing clusters can just switch without problems ?

[RomainMou]

In the enhancement proposal, there is some information about the update / upgrade:

The new mode should not introduce any upgrade/downgrade problems, excepting that you can't downgrade or feature-disable a cluster using the new kube-proxy mode without switching it back to iptables or ipvs first. (The older kube-proxy would refuse to start if given --proxy-mode nftables, and wouldn't know how to clean up stale nftables service rules if any were present.)

When rolling out or rolling back the feature, it should be safe to enable the feature gate and change the configuration at the same time, since nothing cares about the feature gate except for kube-proxy itself. Likewise, it is expected to be safe to roll out the feature in a live cluster, even though this will result in different proxy modes running on different nodes, because Kubernetes service proxying is defined in such a way that no node needs to be aware of the implementation details of the service proxy implementation on any other node.

https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/3866-nftables-proxy#upgrade--downgrade-strategy

So I'm guessing there is no special manual migration except for the case where you use some of the behaviors that are different in this mode, but I didn't have time to test anything yet.

Another consideration is the compatibility of the network plugins, I guess.

[VannTen]

Thanks, that looks straightforward. /triage accepted