{"record":{"id":"68d56a04e517f280","repo":"kubernetes/kubernetes","slug":"unable-to-create-proxier-v","errorCode":null,"errorMessage":"unable to create proxier: %v","messagePattern":"unable to create proxier: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/kube-proxy/app/server_linux.go","lineNumber":181,"sourceCode":"\n\t\t\t// TODO this has side effects that should only happen when Run() is invoked.\n\t\t\tproxier, err = iptables.NewProxier(\n\t\t\t\tctx,\n\t\t\t\tconfig,\n\t\t\t\ts.PrimaryIPFamily,\n\t\t\t\tipts[s.PrimaryIPFamily],\n\t\t\t\tutilsysctl.New(),\n\t\t\t\tlocalDetectors[s.PrimaryIPFamily],\n\t\t\t\ts.NodeName,\n\t\t\t\ts.NodeIPs[s.PrimaryIPFamily],\n\t\t\t\ts.Recorder,\n\t\t\t\ts.HealthzServer,\n\t\t\t\tinitOnly,\n\t\t\t)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to create proxier: %v\", err)\n\t\t}\n\t} else if config.Mode == kubeproxyconfig.ProxyModeIPVS {\n\t\tipsetInterface := utilipset.New()\n\t\tipvsInterface := utilipvs.New()\n\t\tif err := ipvs.CanUseIPVSProxier(ctx, ipvsInterface, ipsetInterface, config.IPVS.Scheduler); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can't use the IPVS proxier: %v\", err)\n\t\t}\n\t\tipts := utiliptables.NewBestEffort()\n\n\t\tlogger.Info(\"Using ipvs Proxier\")\n\t\tmessage := \"The ipvs proxier has been deprecated and will be disabled by default in Kubernetes 1.40 and removed in Kubernetes 1.43. Migrate to the 'nftables' proxier instead.\"\n\t\tlogger.Error(nil, message)\n\t\ts.Recorder.Eventf(s.NodeRef, nil, v1.EventTypeWarning, \"IPVSDeprecation\", \"StartKubeProxy\", message)\n\t\tif dualStack {\n\t\t\tproxier, err = ipvs.NewDualStackProxier(\n\t\t\t\tctx,\n\t\t\t\tconfig,\n\t\t\t\tipts,","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-proxy/app/server_linux.go#L163-L199","documentation":"Returned from createProxier (server_linux.go:180-182) when iptables.NewDualStackProxier or iptables.NewProxier returns an error. This wraps iptables-mode proxier construction failures: usually iptables version too old, sysctl operations failing, the masquerade chain failing to be created, or kernel feature probe failures.","triggerScenarios":"Triggered at server_linux.go:180-181 after the iptables proxier constructor returns err != nil. NewProxier probes iptables version, ensures the KUBE-MARK-MASQ chain, sets net.ipv4.ip_forward and related sysctls, and validates kernel features; any failure surfaces here.","commonSituations":"Old iptables userspace (<1.4.11) lacking --random support; ip_forward disabled and sysctl write blocked; conntrack-related sysctl failure; missing iptables modules for the chosen rules.","solutions":["Inspect the wrapped %v in kube-proxy logs to find the underlying constructor error.","Upgrade the kube-proxy image to match the cluster version so the bundled iptables is recent enough.","Ensure CAP_NET_ADMIN and CAP_SYS_ADMIN are present so sysctl writes succeed.","Switch mode to nftables to bypass iptables-version probes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-flight: ensure net.ipv4.ip_forward is settable and iptables version supports required features.\nfunc validateIPTablesForwarding() error {\n    if _, err := exec.LookPath(\"iptables\"); err != nil { return fmt.Errorf(\"iptables missing: %w\", err) }\n    out, err := exec.Command(\"iptables\", \"--version\").CombinedOutput()\n    if err != nil { return fmt.Errorf(\"iptables unusable: %w (%s)\", err, out) }\n    f, err := os.OpenFile(\"/proc/sys/net/ipv4/ip_forward\", os.O_WRONLY, 0)\n    if err != nil { return fmt.Errorf(\"cannot write ip_forward (need CAP_NET_ADMIN): %w\", err) }\n    _ = f.Close()\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Wrap newProxyServer so a construction error surfaces the underlying cause cleanly.\nif s, err := newProxyServer(ctx, cfg, master, initOnly, fr); err != nil {\n    return fmt.Errorf(\"kube-proxy startup failed: %w\", err)\n}","preventionTips":["Match the kube-proxy image version to the cluster to keep iptables/proxier features aligned.","Grant CAP_NET_ADMIN and CAP_SYS_ADMIN in the pod securityContext."],"tags":["kube-proxy","iptables","proxier","startup"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}