How to disable kube-proxy when using CNI's built-in kube-proxy replacement?

[hkajikawa]

Hello,

Is there a way to disable the deployment of kube-proxy? We intend to utilize the built-in kube-proxy replacement function of our CNI plugin.

Thank you in advance for your help.

[yudin-s]

Yes: for a CNI with kube-proxy replacement, leave Kamaji's kube-proxy addon disabled for that TenantControlPlane.

In the current API this is controlled by spec.addons.kubeProxy. It is optional: the reconciler is a no-op when that field is absent, and it only creates the kube-proxy ServiceAccount/RBAC/ConfigMap/DaemonSet when spec.addons.kubeProxy is present.

So the tenant spec should omit it, for example:

spec:
  addons:
    coreDNS: {}
    # no kubeProxy here

If it was enabled before, remove spec.addons.kubeProxy or set it back to null and let Kamaji reconcile. One caveat: the cleanup path only deletes kube-proxy objects that were labelled as Kamaji-managed, so it will not clean up a kube-proxy DaemonSet that was installed by another bootstrap flow.

After reconciliation, verify from the tenant cluster:

kubectl -n kube-system get ds kube-proxy

If your CNI needs kubeProxyReplacement plus a specific Kubernetes service CIDR, keep that configured on the CNI side; Kamaji's part is just not deploying its kube-proxy addon.

If this matches your setup, please mark the answer as accepted.

[prometherion]

Thanks @yudin-s, I was going to write the same answer, and yours is absolutely well-structured! 👏🏻

[hkajikawa]

Thank you for the helpful responses! That solved my issue.

I was able to configure the cluster without kube-proxy successfully. Appreciate the help!