1
Diagnostic step 1
On the affected Debian nodes, check kernel modules: lsmod | egrep 'ip_vs|nf_conntrack' and load if missing (modprobe ip_vs; modprobe ip_vs_rr; modprobe nf_conntrack_netlink).
FULL AI ANALYSIS
CoreDNS resolution breaks inside pods after kube-proxy switch to IPVS on Debian worker nodes
Generated Oct 12, 2026, 10:57:58 PM
Analysis summary
kube-proxy in IPVS mode relies on kernel IPVS modules and proper netfilter/sysctl settings; errors and missing modules on Debian workers indicate the nodes lack required kernel support or configuration. Because host-level DNS works while in-pod resolution fails, the issue is at the kube-proxy/IPVS service level creating virtual IPs for ClusterIP services. Reverting to iptables is a safe mitigation when IPVS prerequisites cannot be satisfied quickly.
Possible causes
Missing or unloaded kernel IPVS modules (ip_vs, ip_vs_rr, nf_conntrack) on Debian workers.
95%Kernel compiled without required IPVS support or running an older kernel lacking necessary features.
80%kube-proxy IPVS mode incompatible with underlying distributions' netfilter setup or a custom kernel/packaging difference on Debian nodes.
75%sysctl/bridge settings preventing iptables/nat hooks from operating for pod traffic (bridge-nf-call-iptables disabled).
50%Suggested fixes
2
Diagnostic step 2
Verify kernel supports IPVS: review dmesg for ipvs errors and check uname -a; if custom kernel lacking IPVS, plan a kernel upgrade or fallback.
3
Diagnostic step 3
Ensure sysctls are set: sysctl net.bridge.bridge-nf-call-iptables=1 and net.ipv4.ip_forward=1. Apply temporarily and test.
4
Diagnostic step 4
If quick remediation is needed, roll kube-proxy back to iptables mode by editing the kube-proxy ConfigMap (mode: "iptables") and redeploying the daemonset. Test DNS resolution after the change; this is reversible.
5
Diagnostic step 5
If node kernels cannot be changed, consider re-scheduling critical services away from affected nodes until either kernel support is added or kube-proxy mode is changed; escalate to platform/kernel team for permanent kernel/module fix.