Switching kube-proxy mode from IPVS to nftables

Many of you have heard about the nginx-ingress controller retirement, right? But have you also heard about the deprecation of IPVS mode in Kubernetes 1.35?

Kubernetes 1.35 release notes: https://kubernetes.io/blog/2025/12/17/kubernetes-v1-35-release/#deprecation-of-ipvs-mode-in-kube-proxy

If your Kubernetes clusters are running kube-proxy in IPVS mode, it is time to prepare for switching to nftables.

What I found interesting is that the official AWS EKS documentation still recommends IPVS mode, with only a small mention that nftables is ‘in development’: https://docs.aws.amazon.com/eks/latest/best-practices/ipvs.html

But the reality is: nftables mode is already available in 1.34, and you can switch to it today.

Requirements

Before switching, make sure you meet the requirements:

  • EKS 1.34 or later
  • Linux kernel 5.13 or later
  • Your node OS supports nftables kube-proxy mode

I am using Bottlerocket, and nftables support was added in v1.47.0: https://github.com/bottlerocket-os/bottlerocket/releases/v1.47.0

Switching kube-proxy mode

I manage my EKS cluster with Terraform, so here is the change I made to the kube-proxy configuration:

kube-proxy = {
  most_recent                 = true
  resolve_conflicts_on_update = 'OVERWRITE'
  configuration_values = jsonencode({
    mode = 'nftables'
  })
}

After applying the change, you can verify kube-proxy mode with:

kubectl get configmap -n kube-system kube-proxy -o yaml | grep mode

You should see:

mode: nftables

You can also confirm everything works correctly by checking kube-proxy logs:

kubectl -n kube-system logs -l k8s-app=kube-proxy --tail=100 | grep -i proxier

If you see log lines like these, you are good to go:

I0110 06:43:40.690372       1 proxier.go:1132] 'SyncProxyRules complete' ipFamily='IPv4' elapsed='32.078517ms'
I0110 06:43:41.691639       1 proxier.go:1138] 'Syncing nftables rules' ipFamily='IPv4' fullSync=false
I0110 06:43:41.713381       1 proxier.go:1777] 'Reloading service nftables data' ipFamily='IPv4' numServices=222 numEndpoints=441
I0110 06:43:41.756759       1 proxier.go:1132] 'SyncProxyRules complete' ipFamily='IPv4' elapsed='65.354655ms'
Important

Test on a dev cluster first, validate everything works, and only then roll out to production.

Conclusion

Kubernetes 1.35 is clearly signaling that the future of kube-proxy is not IPVS, but nftables. If you still run IPVS today, switching early (while you have time) is the best approach.

The migration itself is straightforward, but only if your platform supports it (kernel version + node OS). So check your nodes, test on dev, and then move your production clusters step by step.

The sooner you switch, the less painful the Kubernetes upgrade path will be.

Great article comparing kube-proxy modes: https://kubernetes.io/blog/2025/02/28/nftables-kube-proxy/