kubernetes/kubernetes · critical

unable to create proxier: %v

Error message

unable to create proxier: %v

What it means

Returned from createProxier (server_linux.go:180-182) when iptables.NewDualStackProxier or iptables.NewProxier returns an error. This wraps iptables-mode proxier construction failures: usually iptables version too old, sysctl operations failing, the masquerade chain failing to be created, or kernel feature probe failures.

Source

Thrown at cmd/kube-proxy/app/server_linux.go:181

			// TODO this has side effects that should only happen when Run() is invoked.
			proxier, err = iptables.NewProxier(
				ctx,
				config,
				s.PrimaryIPFamily,
				ipts[s.PrimaryIPFamily],
				utilsysctl.New(),
				localDetectors[s.PrimaryIPFamily],
				s.NodeName,
				s.NodeIPs[s.PrimaryIPFamily],
				s.Recorder,
				s.HealthzServer,
				initOnly,
			)
		}

		if err != nil {
			return nil, fmt.Errorf("unable to create proxier: %v", err)
		}
	} else if config.Mode == kubeproxyconfig.ProxyModeIPVS {
		ipsetInterface := utilipset.New()
		ipvsInterface := utilipvs.New()
		if err := ipvs.CanUseIPVSProxier(ctx, ipvsInterface, ipsetInterface, config.IPVS.Scheduler); err != nil {
			return nil, fmt.Errorf("can't use the IPVS proxier: %v", err)
		}
		ipts := utiliptables.NewBestEffort()

		logger.Info("Using ipvs Proxier")
		message := "The ipvs proxier has been deprecated and will be disabled by default in Kubernetes 1.40 and removed in Kubernetes 1.43. Migrate to the 'nftables' proxier instead."
		logger.Error(nil, message)
		s.Recorder.Eventf(s.NodeRef, nil, v1.EventTypeWarning, "IPVSDeprecation", "StartKubeProxy", message)
		if dualStack {
			proxier, err = ipvs.NewDualStackProxier(
				ctx,
				config,
				ipts,

View on GitHub (pinned to b882c60b40)

Solutions

1. Inspect the wrapped %v in kube-proxy logs to find the underlying constructor error.
2. Upgrade the kube-proxy image to match the cluster version so the bundled iptables is recent enough.
3. Ensure CAP_NET_ADMIN and CAP_SYS_ADMIN are present so sysctl writes succeed.
4. Switch mode to nftables to bypass iptables-version probes.

// Pre-flight: ensure net.ipv4.ip_forward is settable and iptables version supports required features.
func validateIPTablesForwarding() error {
    if _, err := exec.LookPath("iptables"); err != nil { return fmt.Errorf("iptables missing: %w", err) }
    out, err := exec.Command("iptables", "--version").CombinedOutput()
    if err != nil { return fmt.Errorf("iptables unusable: %w (%s)", err, out) }
    f, err := os.OpenFile("/proc/sys/net/ipv4/ip_forward", os.O_WRONLY, 0)
    if err != nil { return fmt.Errorf("cannot write ip_forward (need CAP_NET_ADMIN): %w", err) }
    _ = f.Close()
    return nil
}

// Wrap newProxyServer so a construction error surfaces the underlying cause cleanly.
if s, err := newProxyServer(ctx, cfg, master, initOnly, fr); err != nil {
    return fmt.Errorf("kube-proxy startup failed: %w", err)
}

When it happens

Trigger: Triggered at server_linux.go:180-181 after the iptables proxier constructor returns err != nil. NewProxier probes iptables version, ensures the KUBE-MARK-MASQ chain, sets net.ipv4.ip_forward and related sysctls, and validates kernel features; any failure surfaces here.

Common situations: Old iptables userspace (<1.4.11) lacking --random support; ip_forward disabled and sysctl write blocked; conntrack-related sysctl failure; missing iptables modules for the chosen rules.

Related errors

• no support for primary IP family %q
• iptables is not available on this host : %w
• encountered an error while tearing down rules
• unable to register configz: %w
• unable to set configz: %w

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/68d56a04e517f280. Report an issue: GitHub.