The Kernel Underneath Kubernetes: nftables, netfilter, and Why svclb-traefik Kept Crash-Looping

Netfilter, the foundation of the Linux networking stack, is a kernel subsystem that intercepts packets at various points in the network stack and makes decisions about them. Before nftables and iptables, there was netfilter, which provides a set of five hook points where kernel code can intercept packets and hand back a verdict.

Packet classification is the process of determining which rules apply to a packet at each hook. There are two main ways to implement this: linear evaluation and indexed evaluation. Linear evaluation is a simple, sequential process that scans through a list of rules until a match is found, while indexed evaluation uses hash tables, sets, or interval trees to jump directly to the relevant rules, resulting in faster performance.

Iptables, ip6tables, arptables, and ebtables are four separate tools that were historically created to handle different protocol families (IPv4, IPv6, ARP, and Ethernet). Each tool has its own binary, kernel modules, match/target extensions, and no shared rule-set with the others. This fragmentation made it difficult to evaluate packets in complex environments like Kubernetes clusters with multiple network layers.

nftables is an improvement over the previous tools, as it implements an indexed-evaluation engine as a small in-kernel virtual machine that interprets a compact bytecode program against structured data, such as sets, maps, and concatenated key lookups. This allows for faster performance and a more cohesive rule-set across different protocol families.

By creating a single engine with multiple table families (ip, ip6, inet, arp, bridge, and netdev), nftables simplifies the packet classification process and improves overall system performance.