Skip to content
ICATroubleshootingSingle nodeMedium

The control plane is down and new pods are rejected

Scenario ica-trb-003 · about 8 minutes · 8 points · 4 grader checks

istiod does not start any more, so the injection webhook blocks pod creation; restore the control plane.

  • istiod
  • control-plane
  • webhook
  • image
  • troubleshooting

What you will practise

  • Recognise a failing injection webhook from ReplicaSet events
  • Diagnose an istiod rollout that cannot pull its image
  • Restore the control plane without reinstalling from scratch

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-trb-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio 1.29.10 was installed in "istio-system" (default revision). Since a recent change the control plane does not work: the Deployment "web" in namespace "web" (in the mesh) is scaled to 2 replicas but only one pod exists. Repair the control plane so that istiod runs Istio 1.29.10 again. Do not delete the Deployment "istiod". Afterwards "web" must run 2 pods with the sidecar.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Troubleshooting
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Troubleshooting labs

ICATroubleshootingEasy

Pods are not getting sidecars

Find out why two Deployments run without the Istio sidecar and fix every cause without recreating them.

Single node · ~7 min · 7 points

  • sidecar-injection
  • istioctl-analyze
  • labels
  • troubleshooting

goldenkube start ica-trb-001

ICATroubleshootingMedium

Half of the requests fail with 503

A weighted route points at a subset that does not exist; repair the configuration without touching the route.

Single node · ~8 min · 8 points

  • destinationrule
  • subsets
  • istioctl-analyze
  • http-503
  • troubleshooting

goldenkube start ica-trb-002

ICATroubleshootingHard

mTLS mismatch between client and server

A client-side TLS setting contradicts a strict PeerAuthentication; find it with proxy-config and fix the client side.

Single node · ~9 min · 8 points

  • mtls
  • destinationrule
  • peerauthentication
  • proxy-config
  • troubleshooting

goldenkube start ica-trb-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.