kube-proxy and iptables vs IPVS modes

WHAT THIS TESTS Deep networking knowledge: a ClusterIP is virtual and has no interface, so something must redirect packets to real Pods. That something is kube-proxy programming the kernel.

A GOOD ANSWER COVERS kube-proxy runs as a DaemonSet on every node. It watches the API server for Services and their EndpointSlices and translates them into packet-rewriting rules in the node's kernel. When a Pod sends traffic to a Service's ClusterIP, those rules perform destination NAT, rewriting the destination to one of the healthy backend Pod IPs and load-balancing across them. The ClusterIP itself is never bound to a real interface; it exists only as a target in these rules. In iptables mode, kube-proxy creates chains of rules and selects a backend using random probability per rule; the downside is that matching is essentially sequential, so with thousands of Services the rule set grows large and rule updates and lookups slow down. In IPVS mode, kube-proxy uses the kernel's IP Virtual Server, which stores backends in a hash table and supports genuine load-balancing algorithms such as round-robin and least-connection, offering near-constant lookup time and far better performance at scale.

COMMON WRONG ANSWERS Claiming kube-proxy proxies every packet through userspace; the legacy userspace mode is obsolete, and modern modes work in the kernel. Saying iptables does real load balancing algorithms; it only does weighted random.

LIKELY FOLLOW-UPS When to prefer IPVS? Large clusters with many Services. What about eBPF dataplanes? Tools like Cilium can replace kube-proxy entirely. How are unhealthy Pods excluded? They are dropped from EndpointSlices.

ONE CONCRETE EXAMPLE A ClusterIP Service fronts five Pods. In iptables mode, a packet to the ClusterIP traverses a chain that with 20 percent probability each picks one of the five backends and DNATs to it. In IPVS mode, the same Service is a virtual server with five real servers in a hash table, balanced round-robin, which stays fast even as the cluster grows to thousands of Services.