Skip to content

6032: initial proposal for localhost NodePort userspace proxy #6042

Open
AustinAbro321 wants to merge 2 commits intokubernetes:masterfrom
AustinAbro321:localhost-userspace-proxy-6032
Open

6032: initial proposal for localhost NodePort userspace proxy #6042
AustinAbro321 wants to merge 2 commits intokubernetes:masterfrom
AustinAbro321:localhost-userspace-proxy-6032

Conversation

@AustinAbro321
Copy link
Copy Markdown

@AustinAbro321 AustinAbro321 commented Apr 29, 2026 •
edited
Loading

  • One-line PR description: initial proposal for localhost NodePort userspace proxy

I have a metric in this proposal, though I am uncertain on its value. I'm open to alternative ideas for metrics

@k8s-ci-robot k8s-ci-robot requested a review from bowei April 29, 2026 15:12
@k8s-ci-robot k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label Apr 29, 2026
@k8s-ci-robot k8s-ci-robot added the sig/network Categorizes an issue or PR as relevant to SIG Network. label Apr 29, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Apr 29, 2026

Welcome @AustinAbro321!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 29, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Apr 29, 2026

Hi @AustinAbro321. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 29, 2026
@AustinAbro321 AustinAbro321 mentioned this pull request Apr 29, 2026
Open
4 tasks
@AustinAbro321 AustinAbro321 force-pushed the localhost-userspace-proxy-6032 branch from a626812 to bac3edc Compare April 29, 2026 15:16
@AustinAbro321 AustinAbro321 mentioned this pull request Apr 29, 2026
Draft
adrianmoisey
adrianmoisey reviewed May 1, 2026
View reviewed changes
Comment thread keps/sig-network/6032-localhost-nodeport-userspace-proxy/README.md

## Summary

This KEP proposes implementing a userspace proxy to enable localhost NodePort services across all proxy backends. The iptables proxy already works with localhost NodePorts; however, it requires enabling a dangerous permission, `route_localnet`, on each node to allow the kernel to rewrite traffic to localhost. By instead rewriting traffic directly at the userspace level, no extra permissions are set, and localhost NodePorts will work on all proxy backends and IPv6.
Copy link
Copy Markdown
Member

@adrianmoisey adrianmoisey May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question for sig leads: do we want to add this feature to IPVS, given that it's deprecated?

Copy link
Copy Markdown
Author

@AustinAbro321 AustinAbro321 May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was also curious on this. I'm fine with the decision either way

Comment thread keps/sig-network/6032-kep-template/README.md Outdated
Comment thread keps/sig-network/6032-localhost-nodeport-userspace-proxy/kep.yaml
@AustinAbro321
localhost nodeport userspace proxy
a67ae3d 
Signed-off-by: Austin Abro <austinabro321@gmail.com>
@AustinAbro321 AustinAbro321 force-pushed the localhost-userspace-proxy-6032 branch from c4e1075 to a67ae3d Compare May 1, 2026 11:56
@adrianmoisey
Copy link
Copy Markdown
Member

adrianmoisey commented May 1, 2026

Oh, you may also need a file in keps/prod-readiness/sig-network/6032.yaml
I think the tests catch that, let's run them:
/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 1, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented May 1, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AustinAbro321
Once this PR has been reviewed and has the lgtm label, please assign thockin, wojtek-t for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@AustinAbro321 AustinAbro321 force-pushed the localhost-userspace-proxy-6032 branch from c291053 to 9b1f3fb Compare May 1, 2026 14:14
AustinAbro321
AustinAbro321 commented May 1, 2026
View reviewed changes
Comment thread keps/sig-network/6032-localhost-nodeport-userspace-proxy/README.md

Add a userspace TCP-only proxy to "kube-proxy" that listens on the loopback address (`127.0.0.1` / `::1`) for each NodePort and forwards connections to a service's endpoints. Each backend proxy (`iptables`, `nftables`, `ipvs`) instantiates this proxy when `--nodeport-addresses` contains a loopback CIDR, and reconciles its set of listeners on every sync.

`iptables` and `ipvs` default to `0.0.0.0/0` or `::/0`, allowing all IPs, including localhost, when `--nodeport-addresses` is unset. `nftables` currently defaults to `primary`, accepting connections only to the node IP. `nftables` will begin defaulting to `primary,<loopback-address>` to include localhost. The `--nodeport-addresses` flag will change to allow using the `primary` keyword alongside IP addresses.
Copy link
Copy Markdown
Author

@AustinAbro321 AustinAbro321 May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing the default of nftables might be controversial. LMK thoughts @danwinship

@AustinAbro321 AustinAbro321 force-pushed the localhost-userspace-proxy-6032 branch from 9b1f3fb to 0f8b0f1 Compare May 1, 2026 14:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@adrianmoisey adrianmoisey adrianmoisey left review comments

@bowei bowei Awaiting requested review from bowei

@guicassolato guicassolato Awaiting requested review from guicassolato

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory ok-to-test Indicates a non-member PR verified by an org member that is safe to test. sig/network Categorizes an issue or PR as relevant to SIG Network. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@AustinAbro321 @k8s-ci-robot @adrianmoisey