Skip to content
ICATroubleshootingSingle nodeHard

mTLS mismatch between client and server

Scenario ica-trb-004 · about 9 minutes · 8 points · 5 grader checks

A client-side TLS setting contradicts a strict PeerAuthentication; find it with proxy-config and fix the client side.

  • mtls
  • destinationrule
  • peerauthentication
  • proxy-config
  • troubleshooting

What you will practise

  • Read the client's TLS settings with istioctl proxy-config cluster
  • Relate DestinationRule tls modes to PeerAuthentication
  • Fix a data-plane mismatch without weakening server policy

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-trb-004

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed. Requests from the Deployment "curl" in namespace "ledger" (in the mesh) to the Service "ledger" (port 8000) fail with HTTP 503. The workload "ledger" must accept mutual TLS only. Fix the configuration so that in-mesh requests to "ledger" succeed again. Do not modify or delete the PeerAuthentication "ledger-strict" and do not create any other PeerAuthentication. Plain-text clients outside the mesh (Deployment "curl" in namespace "outside") must still be refused.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Troubleshooting
Difficulty
Hard
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
8
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Troubleshooting labs

ICATroubleshootingEasy

Pods are not getting sidecars

Find out why two Deployments run without the Istio sidecar and fix every cause without recreating them.

Single node · ~7 min · 7 points

  • sidecar-injection
  • istioctl-analyze
  • labels
  • troubleshooting

goldenkube start ica-trb-001

ICATroubleshootingMedium

Half of the requests fail with 503

A weighted route points at a subset that does not exist; repair the configuration without touching the route.

Single node · ~8 min · 8 points

  • destinationrule
  • subsets
  • istioctl-analyze
  • http-503
  • troubleshooting

goldenkube start ica-trb-002

ICATroubleshootingMedium

The control plane is down and new pods are rejected

istiod does not start any more, so the injection webhook blocks pod creation; restore the control plane.

Single node · ~8 min · 8 points

  • istiod
  • control-plane
  • webhook
  • image
  • troubleshooting

goldenkube start ica-trb-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.