Localhost nodeport nftables proxy doesn't flip to enabled when conditions are met during proxy restart
Author: AustinAbro321Created Sep 17, 2026Updated Sep 17, 2026
Labelskind/bugsig/networkneeds-triage
What happened?
The userspace localhost nodeport proxy (https://github.com/kubernetes/enhancements/issues/6032) has a bug. If you create a nodeport service on a cluster without localhost in --nodeport-addressees it properly won't create the proxy. However if you restart kube-proxy with localhost in --nodeport-addresses it still won't work.
What did you expect to happen?
The userspace proxy to work properly.
How can we reproduce it (as minimally and precisely as possible)?
- Start kube-proxy in nftables mode with
KubeProxyNFTablesLocalhostNodePorts=true, but without an explicit loopback nodePortAddresses CIDR. - Create a TCP NodePort Service. kube-proxy installs a TCP localhost reject map entry.
- Update nodePortAddresses to include 127.0.0.0/8 and restart kube-proxy.
Anything else we need to know?
No response
Kubernetes version
$ kubectl version
# paste output here
Cloud provider
NA, used Kind
OS version
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here
# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
Install tools
Container runtime (CRI) and version (if applicable)
Related plugins (CNI, CSI, ...) and versions (if applicable)
Source: kubernetes/kubernetes