Skip to content
ICATroubleshootingSingle nodeMedium

Half of the requests fail with 503

Scenario ica-trb-002 · about 8 minutes · 8 points · 4 grader checks

A weighted route points at a subset that does not exist; repair the configuration without touching the route.

  • destinationrule
  • subsets
  • istioctl-analyze
  • http-503
  • troubleshooting

What you will practise

  • Find configuration errors with istioctl analyze
  • Relate 503 NR errors to missing subsets
  • Fix a DestinationRule without changing the VirtualService

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-trb-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed. In namespace "reviews" (in the mesh) the Service "helloworld" (port 5000) is backed by the Deployments helloworld-v1 and helloworld-v2 (pod labels version=v1 and version=v2). The VirtualService "helloworld" splits traffic 50/50 between v1 and v2, but about half of the requests from the Deployment "curl" fail. Fix the mesh configuration so that the 50/50 split works and no request fails. Do not modify or recreate the VirtualService "helloworld". Afterwards "istioctl analyze -n reviews" must not report any error or warning.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Troubleshooting
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Troubleshooting labs

ICATroubleshootingEasy

Pods are not getting sidecars

Find out why two Deployments run without the Istio sidecar and fix every cause without recreating them.

Single node · ~7 min · 7 points

  • sidecar-injection
  • istioctl-analyze
  • labels
  • troubleshooting

goldenkube start ica-trb-001

ICATroubleshootingMedium

The control plane is down and new pods are rejected

istiod does not start any more, so the injection webhook blocks pod creation; restore the control plane.

Single node · ~8 min · 8 points

  • istiod
  • control-plane
  • webhook
  • image
  • troubleshooting

goldenkube start ica-trb-003

ICATroubleshootingHard

mTLS mismatch between client and server

A client-side TLS setting contradicts a strict PeerAuthentication; find it with proxy-config and fix the client side.

Single node · ~9 min · 8 points

  • mtls
  • destinationrule
  • peerauthentication
  • proxy-config
  • troubleshooting

goldenkube start ica-trb-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.