Hi Kubernetes community,
I have a question about NodeLocal DNSCache and kube-proxy `nftables` mode.
From the current NodeLocal DNSCache documentation, I can see configuration notes for kube-proxy `iptables` mode and `ipvs` mode. However, I could not find a clear description for kube-proxy `nftables` mode.
I would like to ask:
1. Is NodeLocal DNSCache expected to work with kube-proxy `nftables` mode?
2. If yes, should it follow the same configuration approach as `iptables` mode or `ipvs` mode?
3. Are there any known limitations or extra configuration requirements when using NodeLocal DNSCache with `nftables` mode?
4. Is NodeLocal DNSCache expected to remain usable in Kubernetes 1.35 and later?
Background:
We are evaluating a future Kubernetes upgrade and also looking at kube-proxy `nftables` mode.
Our current understanding is:
- NodeLocal DNSCache is a stable feature.
- The current documentation mainly describes `iptables` and `ipvs` kube-proxy modes.
- kube-proxy `nftables` mode is now available as a stable option.
- IPVS proxy mode is being deprecated in Kubernetes 1.35.
Because of this, we would like to better understand the recommended setup for NodeLocal DNSCache when moving towards `nftables`.
Cluster information:
Kubernetes version: Planning for Kubernetes 1.35 upgrade
Cloud being used: bare-metal
Installation method: kubeadm
Host OS: Linux
CNI and version: Calico
CRI and version: containerd
This is not a production incident. We are mainly asking about the expected support status and recommended configuration for NodeLocal DNSCache with kube-proxy `nftables` mode.
Documentation references:
- NodeLocal DNSCache documentation:
https://kubernetes.io/docs/tasks/administer-cluster/nodelocaldns/
- kube-proxy nftables mode documentation:
https://kubernetes.io/docs/reference/networking/virtual-ips/#nftables-proxy-mode
- IPVS proxy mode documentation:
https://kubernetes.io/docs/reference/networking/virtual-ips/#ipvs-proxy-mode
It would be helpful to know whether NodeLocal DNSCache is already compatible with kube-proxy `nftables` mode, or whether this area still needs additional documentation or implementation work.
Thanks!