Kubeproxy

Kube-proxy is a network proxy and load balancer that runs on each node in a Kubernetes cluster. Its primary job is to implement Kubernetes Service objects by routing traffic destined for a service's cluster IP and port to one of the pods backing that Service. To do this, kube-proxy watches the Kubernetes API for changes to Service and Endpoints objects and updates the node's networking rules accordingly.

On Linux, kube-proxy can operate in several proxy modes. The traditional userspace mode handles proxying in user space. In modern deployments, iptables mode uses Linux kernel netfilter rules to direct traffic, while IPVS mode leverages the kernel IPVS module for scalable load balancing. The chosen mode is configured via command-line flags or a configuration file and can be tuned for performance and scale.

Kube-proxy runs as a daemon on every node (typically managed as a DaemonSet). It supports the standard Kubernetes service types, including ClusterIP, NodePort, and LoadBalancer, and it routes traffic to the pods backing the service. For NodePort or LoadBalancer services, kube-proxy opens ports on each node or relies on an external load balancer while continuing to route to the service's endpoints.

Observability and lifecycle: kube-proxy exposes metrics and logs for monitoring, and its behavior can be controlled with flags or a ConfigMap. It remains a core component of cluster networking, enabling service discovery and intra-cluster communication even as services scale and change.