Skip to content
ICATroubleshootingSingle nodeEasy

Pods are not getting sidecars

Scenario ica-trb-001 · about 7 minutes · 7 points · 4 grader checks

Find out why two Deployments run without the Istio sidecar and fix every cause without recreating them.

  • sidecar-injection
  • istioctl-analyze
  • labels
  • troubleshooting

What you will practise

  • Diagnose sidecar injection with istioctl analyze and the injection labels
  • Know the namespace and pod level injection controls
  • Roll workloads after fixing injection

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-trb-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed (default revision). The team expects the Deployments "cart" and "checkout" in namespace "orders" to be part of the mesh, but their pods run without the Istio sidecar. Find and fix every cause, so that all pods of both Deployments run with the sidecar. Do not delete or recreate the Deployments. Afterwards "istioctl analyze -n orders" must not report any error or warning.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Troubleshooting
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
7 minutes
Points
7
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Troubleshooting labs

ICATroubleshootingMedium

Half of the requests fail with 503

A weighted route points at a subset that does not exist; repair the configuration without touching the route.

Single node · ~8 min · 8 points

  • destinationrule
  • subsets
  • istioctl-analyze
  • http-503
  • troubleshooting

goldenkube start ica-trb-002

ICATroubleshootingMedium

The control plane is down and new pods are rejected

istiod does not start any more, so the injection webhook blocks pod creation; restore the control plane.

Single node · ~8 min · 8 points

  • istiod
  • control-plane
  • webhook
  • image
  • troubleshooting

goldenkube start ica-trb-003

ICATroubleshootingHard

mTLS mismatch between client and server

A client-side TLS setting contradicts a strict PeerAuthentication; find it with proxy-config and fix the client side.

Single node · ~9 min · 8 points

  • mtls
  • destinationrule
  • peerauthentication
  • proxy-config
  • troubleshooting

goldenkube start ica-trb-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.