I85PREP
⌘ K
ICA study materials
ICA study resources

ICA: Troubleshooting

ICA · Work through your exam, one topic at a time.

All guide sections

Troubleshooting

What this domain tests

Troubleshooting tests whether you can locate faults in configuration and in the Envoy data plane without guessing. Expect istioctl diagnostics, xDS sync status, response flags, and checks for injection, routing, and policy.

Core rules

  • istioctl analyze finds static configuration errors; proxy-status shows whether Envoy has synced xDS; proxy-config prints listeners, routes, clusters, and endpoints.
  • istioctl x describe pod summarizes effective config; istioctl bug-report collects cluster state.
  • 503 response flags narrow the cause: NR means no route, UF an upstream connection failure, and UH no healthy upstream.
  • Check injection labels, revision labels, Gateway selector, VirtualService host and gateway binding, DestinationRule subset labels, and service port protocol.
  • mTLS STRICT with a plaintext client, or an AuthorizationPolicy deny, can look like an application failure.

Worked example

Ingress returns 503. proxy-status is SYNCED. proxy-config route shows no route for Host shop.example.com. The VirtualService lists shop.example instead of shop.example.com, or the Gateway is not bound. Fix the hosts and bind the gateway, then recheck. Reasoning: Envoy matches the Host header against VirtualService hosts; no match gives no route. If a route exists but its cluster has no endpoints, inspect subset labels and pod readiness.

Traps

Trusting analyze as a runtime check; editing config without checking Envoy's route; deleting pods before checking labels; ignoring response flags; and assuming every 503 is application code.