refactor: add new kube-proxy mode disable option

api/v1alpha1/clusterconfig_types.go

@@ -83,6 +83,10 @@ type AWSClusterConfigSpec struct {
 	KubeadmClusterConfigSpec `json:",inline"`
 	GenericClusterConfigSpec `json:",inline"`
 
+	// KubeProxy defines the configuration for kube-proxy.
+	// +kubebuilder:validation:Optional
+	KubeProxy *KubeProxy `json:"kubeProxy,omitempty"`
+
 	// +kubebuilder:validation:Optional
 	Addons *AWSAddons `json:"addons,omitempty"`
 
@@ -121,6 +125,10 @@ type DockerClusterConfigSpec struct {
 	KubeadmClusterConfigSpec `json:",inline"`
 	GenericClusterConfigSpec `json:",inline"`
 
+	// KubeProxy defines the configuration for kube-proxy.
+	// +kubebuilder:validation:Optional
+	KubeProxy *KubeProxy `json:"kubeProxy,omitempty"`
+
 	// +kubebuilder:validation:Optional
 	Addons *DockerAddons `json:"addons,omitempty"`
 
@@ -164,6 +172,10 @@ type NutanixClusterConfigSpec struct {
 	KubeadmClusterConfigSpec `json:",inline"`
 	GenericClusterConfigSpec `json:",inline"`
 
+	// KubeProxy defines the configuration for kube-proxy.
+	// +kubebuilder:validation:Optional
+	KubeProxy *KubeProxy `json:"kubeProxy,omitempty"`
+
 	// +kubebuilder:validation:Optional
 	Addons *NutanixAddons `json:"addons,omitempty"`
 
@@ -206,6 +218,10 @@ type EKSClusterConfigSpec struct {
 
 	GenericClusterConfigSpec `json:",inline"`
 
+	// KubeProxy defines the configuration for kube-proxy.
+	// +kubebuilder:validation:Optional
+	KubeProxy *KubeProxy `json:"kubeProxy,omitempty"`
+
 	// +kubebuilder:validation:Optional
 	Addons *AWSAddons `json:"addons,omitempty"`
 }
@@ -243,10 +259,6 @@ type KubeadmClusterConfigSpec struct {
 	// +kubebuilder:validation:Optional
 	DNS *DNS `json:"dns,omitempty"`
 
-	// KubeProxy defines the configuration for kube-proxy.
-	// +kubebuilder:validation:Optional
-	KubeProxy *KubeProxy `json:"kubeProxy,omitempty"`
-
 	// MaxParallelImagePullsPerNode defines the maximum number of parallel image pulls performed by each kubelet.
 	// If not set, the default value of 1 will be used.
 	// If set to 0, the maximum number of parallel image pulls will be unlimited.
@@ -425,14 +437,17 @@ const (
 	// KubeProxyModeNFTables indicates that kube-proxy should be installed in nftables
 	// mode.
 	KubeProxyModeNFTables KubeProxyMode = "nftables"
+	// KubeProxyModeDisabled indicates that kube-proxy should be disabled.
+	KubeProxyModeDisabled KubeProxyMode = "disabled"
 )
 
 type KubeProxy struct {
 	// Mode specifies the mode for kube-proxy:
 	// - iptables means that kube-proxy is installed in iptables mode.
 	// - nftables means that kube-proxy is installed in nftables mode.
+	// - disabled means that kube-proxy is disabled.
 	// +kubebuilder:validation:Optional
-	// +kubebuilder:validation:Enum=iptables;nftables
+	// +kubebuilder:validation:Enum=iptables;nftables;disabled
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value cannot be changed after cluster creation"
 	Mode KubeProxyMode `json:"mode,omitempty"`
 }

api/v1alpha1/crds/caren.nutanix.com_awsclusterconfigs.yaml

@@ -716,9 +716,11 @@ spec:
                         Mode specifies the mode for kube-proxy:
                         - iptables means that kube-proxy is installed in iptables mode.
                         - nftables means that kube-proxy is installed in nftables mode.
+                        - disabled means that kube-proxy is disabled.
                       enum:
                         - iptables
                         - nftables
+                        - disabled
                       type: string
                       x-kubernetes-validations:
                         - message: Value cannot be changed after cluster creation

api/v1alpha1/crds/caren.nutanix.com_dockerclusterconfigs.yaml

@@ -531,9 +531,11 @@ spec:
                         Mode specifies the mode for kube-proxy:
                         - iptables means that kube-proxy is installed in iptables mode.
                         - nftables means that kube-proxy is installed in nftables mode.
+                        - disabled means that kube-proxy is disabled.
                       enum:
                         - iptables
                         - nftables
+                        - disabled
                       type: string
                       x-kubernetes-validations:
                         - message: Value cannot be changed after cluster creation

api/v1alpha1/crds/caren.nutanix.com_eksclusterconfigs.yaml

@@ -435,6 +435,24 @@ spec:
                   type: object
                 maxItems: 32
                 type: array
+              kubeProxy:
+                description: KubeProxy defines the configuration for kube-proxy.
+                properties:
+                  mode:
+                    description: |-
+                      Mode specifies the mode for kube-proxy:
+                      - iptables means that kube-proxy is installed in iptables mode.
+                      - nftables means that kube-proxy is installed in nftables mode.
+                      - disabled means that kube-proxy is disabled.
+                    enum:
+                    - iptables
+                    - nftables
+                    - disabled
+                    type: string
+                    x-kubernetes-validations:
+                    - message: Value cannot be changed after cluster creation
+                      rule: self == oldSelf
+                type: object
               ntp:
                 description: NTP defines the NTP configuration for the cluster.
                 properties:

api/v1alpha1/crds/caren.nutanix.com_kubeadmclusterconfigs.yaml

@@ -112,22 +112,6 @@ spec:
                         type: string
                     type: object
                 type: object
-              kubeProxy:
-                description: KubeProxy defines the configuration for kube-proxy.
-                properties:
-                  mode:
-                    description: |-
-                      Mode specifies the mode for kube-proxy:
-                      - iptables means that kube-proxy is installed in iptables mode.
-                      - nftables means that kube-proxy is installed in nftables mode.
-                    enum:
-                    - iptables
-                    - nftables
-                    type: string
-                    x-kubernetes-validations:
-                    - message: Value cannot be changed after cluster creation
-                      rule: self == oldSelf
-                type: object
               kubernetesImageRepository:
                 description: Sets the Kubernetes image repository used for the KubeadmControlPlane.
                 maxLength: 2048

api/v1alpha1/crds/caren.nutanix.com_nutanixclusterconfigs.yaml

@@ -719,9 +719,11 @@ spec:
                         Mode specifies the mode for kube-proxy:
                         - iptables means that kube-proxy is installed in iptables mode.
                         - nftables means that kube-proxy is installed in nftables mode.
+                        - disabled means that kube-proxy is disabled.
                       enum:
                         - iptables
                         - nftables
+                        - disabled
                       type: string
                       x-kubernetes-validations:
                         - message: Value cannot be changed after cluster creation

api/variables/aggregate_types.go

@@ -25,6 +25,8 @@ type ClusterConfigSpec struct {
 	carenv1.KubeadmClusterConfigSpec `json:",inline"`
 	carenv1.GenericClusterConfigSpec `json:",inline"`
 
+	KubeProxy *carenv1.KubeProxy `json:"kubeProxy,omitempty"`
+
 	Addons *Addons `json:"addons,omitempty"`
 
 	ControlPlane *ControlPlaneSpec `json:"controlPlane,omitempty"`

api/variables/getters.go

@@ -27,3 +27,29 @@ func RegistryAddon(cluster *clusterv1.Cluster) (*carenv1.RegistryAddon, error) {
 
 	return spec.Addons.Registry, nil
 }
+
+// KubeProxyMode retrieves the kube-proxy mode from the cluster's topology variables.
+// Returns nil if the kube-proxy mode is not defined.
+func KubeProxyMode(cluster *clusterv1.Cluster) (*carenv1.KubeProxyMode, error) {
+	spec, err := UnmarshalClusterConfigVariable(cluster.Spec.Topology.Variables)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal cluster variable: %w", err)
+	}
+	if spec == nil {
+		return nil, nil
+	}
+	if spec.KubeProxy == nil {
+		return nil, nil
+	}
+
+	return &spec.KubeProxy.Mode, nil
+}
+
+// KubeProxyIsDisabled returns true if kube-proxy mode from the cluster's topology variables is disabled.
+func KubeProxyIsDisabled(cluster *clusterv1.Cluster) (bool, error) {
+	mode, err := KubeProxyMode(cluster)
+	if err != nil {
+		return false, err
+	}
+	return mode != nil && *mode == carenv1.KubeProxyModeDisabled, nil
+}

docs/content/customization/generic/kube-proxy-mode.md

@@ -60,10 +60,11 @@ metadata:
   name: <NAME>
 spec:
   topology:
-    controlPlane:
-      metadata:
-        annotations:
-          controlplane.cluster.x-k8s.io/skip-kube-proxy: ""
+    variables:
+      - name: clusterConfig
+        value:
+          kubeProxy:
+            mode: disabled
 ```
 
 Applying this configuration will result in the following configuration being applied:

examples/capi-quick-start/aws-cluster-cilium-helm-addon.yaml

@@ -16,9 +16,6 @@ spec:
   topology:
     class: aws-quick-start
     controlPlane:
-      metadata:
-        annotations:
-          controlplane.cluster.x-k8s.io/skip-kube-proxy: ""
       replicas: ${CONTROL_PLANE_MACHINE_COUNT}
     variables:
     - name: clusterConfig
@@ -52,6 +49,8 @@ spec:
         encryptionAtRest:
           providers:
           - aescbc: {}
+        kubeProxy:
+          mode: disabled
     - name: workerConfig
       value:
         aws:

examples/capi-quick-start/eks-cluster.yaml

@@ -62,10 +62,7 @@ metadata:
 spec:
   topology:
     class: eks-quick-start
-    controlPlane:
-      metadata:
-        annotations:
-          controlplane.cluster.x-k8s.io/skip-kube-proxy: ""
+    controlPlane: {}
     variables:
     - name: clusterConfig
       value:
@@ -89,6 +86,8 @@ spec:
           nfd: {}
         eks:
           region: us-west-2
+        kubeProxy:
+          mode: disabled
     version: ${KUBERNETES_VERSION}
     workers:
       machineDeployments:

examples/capi-quick-start/nutanix-cluster-cilium-helm-addon.yaml

@@ -57,9 +57,7 @@ spec:
   topology:
     class: nutanix-quick-start
     controlPlane:
-      metadata:
-        annotations:
-          controlplane.cluster.x-k8s.io/skip-kube-proxy: ""
+      metadata: {}
       replicas: ${CONTROL_PLANE_MACHINE_COUNT}
     variables:
     - name: clusterConfig
@@ -124,6 +122,8 @@ spec:
             secretRef:
               name: ${CLUSTER_NAME}-dockerhub-credentials
           url: https://docker.io
+        kubeProxy:
+          mode: disabled
         nutanix:
           controlPlaneEndpoint:
             host: ${CONTROL_PLANE_ENDPOINT_IP}

examples/capi-quick-start/nutanix-cluster-with-failuredomains-cilium-helm-addon.yaml

@@ -93,9 +93,7 @@ spec:
   topology:
     class: nutanix-quick-start
     controlPlane:
-      metadata:
-        annotations:
-          controlplane.cluster.x-k8s.io/skip-kube-proxy: ""
+      metadata: {}
       replicas: ${CONTROL_PLANE_MACHINE_COUNT}
     variables:
     - name: clusterConfig
@@ -158,6 +156,8 @@ spec:
             secretRef:
               name: ${CLUSTER_NAME}-dockerhub-credentials
           url: https://docker.io
+        kubeProxy:
+          mode: disabled
         nutanix:
           controlPlaneEndpoint:
             host: ${CONTROL_PLANE_ENDPOINT_IP}

hack/examples/patches/skip-kube-proxy.yaml

@@ -1,13 +1,7 @@
 # Copyright 2025 Nutanix. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-apiVersion: cluster.x-k8s.io/v1beta1
-kind: Cluster
-metadata:
-  name: not-used
-spec:
-  topology:
-    controlPlane:
-      metadata:
-        annotations:
-          controlplane.cluster.x-k8s.io/skip-kube-proxy: ""
+- op: "add"
+  path: "/spec/topology/variables/0/value/kubeProxy"
+  value:
+    mode: disabled