summary
microk8s fails silently on kernels that ship without the ip_tables module (nftables-only kernels). kube-proxy tries to load ip_tables on startup, fails, and the cluster enters an unstable crash-restart loop with no clear error surfaced by microk8s status or microk8s inspect.
steps to reproduce
- install microk8s on a system with a nftables-only kernel (no
ip_tables module in /lib/modules/$(uname -r)/)
microk8s startmicrok8s status -- reports not runningmicrok8s inspect -- shows all services running, no warnings
the actual error is only visible in journalctl:
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/
a workaround is to add --proxy-mode=nftables to kube-proxy args:
echo '--proxy-mode=nftables' | sudo tee -a /var/snap/microk8s/current/args/kube-proxy
sudo snap restart microk8s
tested this on my machine and works great.
microk8s should either auto-detect that ip_tables is unavailable and fall back to --proxy-mode=nftables, or microk8s inspect should be more helpful here.
environment
- microk8s 1.35/stable (snap rev 8739)
- Ubuntu 26.04, arm64 (Qualcomm X1E, kernel
7.0.0-34-qcom-x1e) courtesy of @tobhe
nf_tables present, ip_tables absent
summary
microk8s fails silently on kernels that ship without the
ip_tablesmodule (nftables-only kernels). kube-proxy tries to loadip_tableson startup, fails, and the cluster enters an unstable crash-restart loop with no clear error surfaced bymicrok8s statusormicrok8s inspect.steps to reproduce
ip_tablesmodule in/lib/modules/$(uname -r)/)microk8s startmicrok8s status-- reports not runningmicrok8s inspect-- shows all services running, no warningsthe actual error is only visible in
journalctl:a workaround is to add
--proxy-mode=nftablesto kube-proxy args:tested this on my machine and works great.
microk8s should either auto-detect that
ip_tablesis unavailable and fall back to--proxy-mode=nftables, ormicrok8s inspectshould be more helpful here.environment
7.0.0-34-qcom-x1e) courtesy of @tobhenf_tablespresent,ip_tablesabsent