CKA Services and Networking Practice Question
You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?
⚠ Common exam trap
Candidates often assume iptables is the default and most performant mode, but the CKA exam expects you to know that IPVS is the only mode that supports advanced scheduling algorithms like 'least connection' and offers better performance at scale.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ipvs
(ipvs) is correct because kube-proxy in IPVS mode uses the Linux kernel's IP Virtual Server (IPVS) to implement Layer 4 load balancing, which supports sophisticated scheduling algorithms such as 'least connection' (lc), round-robin, and others. IPVS operates in kernel space with a hash table structure, providing better performance and scalability compared to iptables, especially in clusters with thousands of services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ipvs
Why this is correct
IPVS (IP Virtual Server) is a kernel-level transport-layer load balancer that kube-proxy uses to implement Kubernetes Services with a virtual server table. Unlike iptables' random chaining, IPVS supports multiple scheduling algorithms, including least connection (lc), which routes new connections to the backend with the fewest active connections. It also offers better scalability and O(1) lookups by using hash tables, making it the correct choice for advanced load-balancing needs.
- ✗
iptables
Why it's wrong here
In iptables mode, kube-proxy installs a chain of DNAT rules per Service, and the kernel randomly picks a backend for each new connection using an i--probability field on each rule. This effectively provides a per-connection random distribution, but it does not implement true load-balancing algorithms like least connection or weighted round-robin. As Services and EndpointSlices grow, the linear rule traversal also degrades performance, so it's not suitable for advanced scheduling.
- ✗
kernelnet
Why it's wrong here
KernelNet is not a real kube-proxy operating mode; the supported modes historically are userspace, iptables, ipvs, and (in recent Kubernetes releases) nftables or kernel netlink-based proxies. kube-proxy's codebase has no mode named 'kernelnet,' so choosing it would be invalid for any configuration. This option is a distractor because it sounds technical but doesn't correspond to any actual implementation.
- ✗
userspace
Why it's wrong here
Userspace mode was the original kube-proxy implementation, where a user-space process accepted and proxied every connection to Service IPs, copying packets between user and kernel space. This double copy (from socket to socket) causes significant latency and CPU overhead, and it is neither scalable nor performant for large clusters. It has been deprecated and removed from modern Kubernetes versions, and it also lacks advanced scheduling algorithms.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.