Add nftables and conntrack config support to kube-proxy

- Add NFTables arg mapping (masquerade-bit, masquerade-all,
  sync-period, min-sync-period) to allow proxy-mode: nftables
- Add conntrack-tcp-be-liberal arg mapping
- Add getStringList helper and use it for nodeport-addresses since
  it will support non-CIDR values in the future
- Accept both nodeport-addresses (correct) and node-port-addresses
  (legacy misspelling) for NodePortAddresses config

Assisted By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Signed-off-by: Benjamin Pickard <bpickard@redhat.com>

Author: bpickard22

pkg/util/k8s/kubeproxy.go

@@ -63,6 +63,11 @@ func GenerateKubeProxyConfiguration(args map[string]operv1.ProxyArgumentList) (s
 	kpc.IPTables.SyncPeriod.Duration = ka.getDuration("iptables-sync-period")
 	kpc.IPTables.MinSyncPeriod.Duration = ka.getDuration("iptables-min-sync-period")
 
+	kpc.NFTables.MasqueradeBit = ka.getOptInt32("nftables-masquerade-bit")
+	kpc.NFTables.MasqueradeAll = ka.getBool("nftables-masquerade-all")
+	kpc.NFTables.SyncPeriod.Duration = ka.getDuration("nftables-sync-period")
+	kpc.NFTables.MinSyncPeriod.Duration = ka.getDuration("nftables-min-sync-period")
+
 	kpc.IPVS.SyncPeriod.Duration = ka.getDuration("ipvs-sync-period")
 	kpc.IPVS.MinSyncPeriod.Duration = ka.getDuration("ipvs-min-sync-period")
 	kpc.IPVS.Scheduler = ka.getString("ipvs-scheduler")
@@ -84,10 +89,16 @@ func GenerateKubeProxyConfiguration(args map[string]operv1.ProxyArgumentList) (s
 	if duration := ka.getDuration("conntrack-tcp-timeout-close-wait"); duration != 0 {
 		kpc.Conntrack.TCPCloseWaitTimeout = &metav1.Duration{Duration: duration}
 	}
+	kpc.Conntrack.TCPBeLiberal = ka.getBool("conntrack-tcp-be-liberal")
 
 	kpc.ConfigSyncPeriod.Duration = ka.getDuration("config-sync-period")
 
-	kpc.NodePortAddresses = ka.getCIDRList("node-port-addresses")
+	kpc.NodePortAddresses = ka.getStringList("nodeport-addresses")
+	if kpc.NodePortAddresses == nil {
+		kpc.NodePortAddresses = ka.getStringList("node-port-addresses")
+	} else {
+		ka.getStringList("node-port-addresses")
+	}
 
 	// kpc.Winkernel : CNO's kube-proxy config is never used for Windows kube-proxy so
 	// there's no need to allow overriding this.
@@ -217,6 +228,15 @@ func (ka *kpcArgs) getCIDRList(key string) []string {
 	return values
 }
 
+// getStringList parses a comma-separated list and returns an array of strings
+func (ka *kpcArgs) getStringList(key string) []string {
+	value := ka.get(key)
+	if value == "" {
+		return nil
+	}
+	return strings.Split(value, ",")
+}
+
 // getOptInt32 returns an optional int32
 func (ka *kpcArgs) getOptInt32(key string) *int32 {
 	value := ka.get(key)

pkg/util/k8s/kubeproxy_test.go

@@ -396,6 +396,85 @@ nodePortAddresses: null
 oomScoreAdj: null
 portRange: 1000+10
 showHiddenMetricsForVersion: ""
+winkernel:
+  enableDSR: false
+  forwardHealthCheckVip: false
+  networkName: ""
+  rootHnsEndpointName: ""
+  sourceVip: ""
+`,
+		},
+		{
+			description: "nftables overrides",
+			overrides: map[string]operv1.ProxyArgumentList{
+				"proxy-mode":               {"nftables"},
+				"nftables-masquerade-bit":  {"14"},
+				"nftables-masquerade-all":  {"true"},
+				"nftables-sync-period":     {"30s"},
+				"nftables-min-sync-period": {"10s"},
+			},
+			output: `
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+bindAddress: 0.0.0.0
+bindAddressHardFail: false
+clientConnection:
+  acceptContentTypes: ""
+  burst: 0
+  contentType: ""
+  kubeconfig: ""
+  qps: 0
+clusterCIDR: ""
+configSyncPeriod: 0s
+conntrack:
+  maxPerCore: null
+  min: null
+  tcpBeLiberal: false
+  tcpCloseWaitTimeout: null
+  tcpEstablishedTimeout: null
+  udpStreamTimeout: 0s
+  udpTimeout: 0s
+detectLocal:
+  bridgeInterface: ""
+  interfaceNamePrefix: ""
+detectLocalMode: ""
+enableProfiling: false
+healthzBindAddress: ""
+hostnameOverride: ""
+iptables:
+  localhostNodePorts: null
+  masqueradeAll: false
+  masqueradeBit: 0
+  minSyncPeriod: 0s
+  syncPeriod: 0s
+ipvs:
+  excludeCIDRs: null
+  minSyncPeriod: 0s
+  scheduler: ""
+  strictARP: false
+  syncPeriod: 0s
+  tcpFinTimeout: 0s
+  tcpTimeout: 0s
+  udpTimeout: 0s
+kind: KubeProxyConfiguration
+logging:
+  flushFrequency: 0
+  options:
+    json:
+      infoBufferSize: "0"
+    text:
+      infoBufferSize: "0"
+  verbosity: 0
+metricsBindAddress: 0.0.0.0:9102
+mode: nftables
+nftables:
+  masqueradeAll: true
+  masqueradeBit: 14
+  minSyncPeriod: 10s
+  syncPeriod: 30s
+nodePortAddresses: null
+oomScoreAdj: null
+portRange: ""
+showHiddenMetricsForVersion: ""
 winkernel:
   enableDSR: false
   forwardHealthCheckVip: false