CKA Services and Networking Practice Question
Which kube-proxy mode uses iptables rules to handle service traffic?
⚠ Common exam trap
Many exam-takers confuse the iptables mode with the ipvs mode, assuming ipvs also uses iptables rules, but ipvs operates at a different layer (kernel-level load balancing) and does not rely on iptables for service traffic handling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables
Kube-proxy's iptables mode uses Linux iptables rules to handle service traffic. In this mode, kube-proxy watches the Kubernetes API server for Service and Endpoint changes and programs iptables rules in the NAT table (specifically the PREROUTING and OUTPUT chains) to redirect traffic destined for a Service's ClusterIP to the backend Pod IPs via DNAT. This is the default mode in most Kubernetes distributions due to its reliability and moderate performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ipvs
Why it's wrong here
IPVS mode is incorrect because it uses the IPVS kernel module, not iptables rules, to implement service load balancing. It creates virtual servers and uses IPVS load-balancing algorithms such as round-robin or least-connection to pick backend pods. This gives higher scalability and better performance than iptables mode, making the two distinct mechanisms.
- ✗
nftables
Why it's wrong here
nftables is not a kube-proxy mode; Kubernetes kube-proxy runs in userspace, iptables, or ipvs mode (with nftables not a selectable backend). The iptables mode, as its name indicates, is the one that inserts iptables NAT rules while nftables is a separate packet-classification framework that would not match the question's requirement.
- ✗
userspace
Why it's wrong here
Userspace mode is wrong because kube-proxy handles traffic by running its own userspace proxy process on every node, not by using iptables rules for load-balancing decisions. It predates iptables mode and is deprecated because it copies packets between sockets, causing high overhead. Although it may install iptables rules to redirect to the proxy, the actual service handling and backend selection happen in userspace, not directly via iptables DNAT.
- ✓
iptables
Why this is correct
iptables is the correct mode because kube-proxy in this mode programs the kernel's iptables NAT table with rules that translate a service's ClusterIP or NodePort to a selected pod IP. These rules use statistics to randomly choose among healthy endpoints, so packet forwarding and load balancing are entirely implemented with iptables rules. As a result, the service handling is performed by iptables in the kernel, not by a userspace process.
Visual reference
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.