CKA Services and Networking Practice Question
What is the default kube-proxy mode in modern Kubernetes clusters?
⚠ Common exam trap
A common misconception in the CKA exam is that `ipvs` is the default in modern clusters, but the expected answer is `iptables` unless the question explicitly specifies a different mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables
In modern Kubernetes clusters (v1.30+), the default kube-proxy mode is `iptables`. This mode uses Linux Netfilter rules to intercept and redirect traffic to backend pods, offering better performance and scalability than the legacy `userspace` mode while remaining the default for broad compatibility across distributions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kernelspace
Why it's wrong here
Kernelspace is not a recognized kube-proxy mode. While all kube-proxy implementations ultimately interact with kernel networking (netfilter/iptables or IPVS), the actual mode names are 'userspace', 'iptables', and 'ipvs'. The term 'kernelspace' is a misnomer that may confuse the underlying kernel-level packet handling with a specific configuration, which does not exist in Kubernetes.
- ✓
iptables
Why this is correct
Iptables is the default kube-proxy mode in virtually all modern Kubernetes clusters. In this mode, kube-proxy programs iptables rules to intercept packets destined for Service ClusterIPs and apply DNAT to randomly selected backend Pods. It has been the default since Kubernetes 1.2 and requires no extra kernel modules, making it the most universally compatible option, although its rule-chain traversal can become inefficient in very large clusters.
- ✗
userspace
Why it's wrong here
Userspace mode is deprecated and not the default. Historically, the original kube-proxy ran a userspace proxy process that accepted connections on a Service's ClusterIP and proxied them to backend Pods via a round-robin algorithm. This approach incurred high context-switching and copy overhead, and was superseded by iptables (then IPVS) modes that leverage kernel forwarding for better performance. It remains available only for backwards compatibility and is not active by default.
- ✗
ipvs
Why it's wrong here
IPVS is an alternative kube-proxy mode that can be explicitly enabled via the '--proxy-mode=ipvs' flag or the kube-proxy config file. It uses the Linux kernel's IPVS module to provide more efficient load balancing, a richer set of scheduling algorithms (e.g., least-connection, weighted round-robin), and better scalability than iptables. However, IPVS support depends on the kernel module being loaded and has not replaced iptables as the default, so unless an administrator configures it, iptables remains in effect.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.