#142183·Kubernetes

Localhost nodeport nftables proxy doesn't flip to enabled when conditions are met during proxy restart

Author: AustinAbro321Created Sep 17, 2026Updated Sep 17, 2026
Labelskind/bugsig/networkneeds-triage

What happened?

The userspace localhost nodeport proxy (https://github.com/kubernetes/enhancements/issues/6032) has a bug. If you create a nodeport service on a cluster without localhost in --nodeport-addressees it properly won't create the proxy. However if you restart kube-proxy with localhost in --nodeport-addresses it still won't work.

What did you expect to happen?

The userspace proxy to work properly.

How can we reproduce it (as minimally and precisely as possible)?

  1. Start kube-proxy in nftables mode with KubeProxyNFTablesLocalhostNodePorts=true, but without an explicit loopback nodePortAddresses CIDR.
  2. Create a TCP NodePort Service. kube-proxy installs a TCP localhost reject map entry.
  3. Update nodePortAddresses to include 127.0.0.0/8 and restart kube-proxy.

Anything else we need to know?

No response

Kubernetes version

$ kubectl version
# paste output here

Cloud provider

NA, used Kind

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)