Skip to content
ICASecuring WorkloadsSingle nodeEasy

Mesh-wide strict mTLS with a namespace exception

Scenario ica-sec-001 · about 7 minutes · 7 points · 5 grader checks

Require mutual TLS for the whole mesh while one legacy namespace keeps accepting plain text.

  • mtls
  • peerauthentication
  • strict
  • permissive
  • securing-workloads

What you will practise

  • Enforce mTLS mesh-wide with a PeerAuthentication in the root namespace
  • Override the mesh policy for one namespace
  • Verify that plain-text clients are refused

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-sec-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed. Namespaces "secure" and "legacy" are in the mesh and each runs the Service "httpbin" (port 8000). Namespace "outside" is not in the mesh; its Deployment "curl" has no sidecar. "secure" also runs a Deployment "curl". 1. Require mutual TLS for every workload in the mesh: create the PeerAuthentication "default" in the root namespace "istio-system" with mode STRICT. 2. Workloads in namespace "legacy" must still accept plain-text traffic: create a PeerAuthentication "default" in "legacy" with mode PERMISSIVE.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Securing Workloads
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
7 minutes
Points
7
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Securing Workloads labs

ICASecuring WorkloadsMedium

Allow one service account to call two paths

Write an ALLOW AuthorizationPolicy that admits a single workload identity for GET on two paths and nothing else.

Single node · ~8 min · 8 points

  • authorizationpolicy
  • allow
  • principals
  • spiffe
  • securing-workloads

goldenkube start ica-sec-002

ICASecuring WorkloadsHard

Require a valid JWT for a workload

Validate end-user JWTs with a RequestAuthentication and an inline key set, and deny requests that carry no token.

Single node · ~9 min · 9 points

  • jwt
  • requestauthentication
  • authorizationpolicy
  • request-principals
  • securing-workloads

goldenkube start ica-sec-003

ICASecuring WorkloadsHard

Terminate TLS at the ingress gateway with an HTTPS redirect

Serve a host over HTTPS at the ingress gateway from a Kubernetes TLS secret and redirect plain HTTP to HTTPS.

Single node · ~10 min · 10 points

  • gateway
  • tls
  • https-redirect
  • credentialname
  • securing-workloads

goldenkube start ica-sec-004

ICASecuring WorkloadsMedium

Deny by default, allow reads, deny one caller

Combine a namespace-wide deny-all with an ALLOW and a DENY AuthorizationPolicy and reason about their evaluation order.

Single node · ~9 min · 9 points

  • authorizationpolicy
  • deny-by-default
  • allow-nothing
  • deny
  • securing-workloads

goldenkube start ica-sec-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.