Rewriting the Rules: Why Kubernetes Is Moving To NFTables

on YouTube ↗22m

" summary

Claims that nftables replaces iptables/IPVS for kube-proxy by switching from linear rule processing to hash maps, delivering constant-time lookups and 30k services scale tested on ~100-node clusters. Migration uses kube-proxy in nftables mode (configMap or flag), requires kernel >5.13 (kernel 6.1 fixes an invalid-packet bug) and Kubernetes 1.29+ (GA in 1.33). Measured restore/programmability goes from 6 minutes vs 10 seconds, but NodePort-to-127.0.0.1 no longer works without risky route_localnet changes.

AI-written summary · about

" chapters (5)

1. 0:00Kubernetes and NF tables intro
2. 2:31IP tables limitations
3. 7:23NF tables advantages
4. 10:53Recommendations with NF tables
5. 12:15Q&A

" related talks

• 31mBuilding a Hypervisor Firewall with nftables and RustStefan Hanreich · LinuxCon @ OSS EU 2024
• 33mNavigating the Container JungleCasey Davenport · KubeCon + CloudNativeCon North America 2016
• 31mBuilding a Hypervisor Firewall with nftables and RustStefan Hanreich · Open Source Summit Europe 2024
• 29mSimplifying the Networking and Secur...Bowei Du, Bill Mulligan, Anna Kapuścińska, Amir Kheirkhahan · KubeCon + CloudNativeCon Europe 2025
• 22mFirewalld Changes Coming to Your OSEric Garver · DevConf.CZ 2019
• 40mAttacking Kubernetes Clusters Through Your Network PlumbingNir Chako · RSAC 2021
• 21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...Donia Chaiehloudj · Cloud Native University North America 2025
• 45mTo the tables! Routing efficiently with iproute and NetfilterJulien Durillon · Devfest Lille 2018