Istio Certified Associate study guide
Istio Certified Associate · Work through your exam, one topic at a time.
The Istio Certified Associate (ICA) is a pre-professional certification from the Linux Foundation, originally developed by Tetrate, aimed at engineers, CI/CD practitioners, and anyone with a special interest in Istio. It confirms foundational knowledge of Istio principles, terminology, and best practices and the ability to set up Istio, with a focus on enhancing the performance, reliability, and security of applications running on Kubernetes-based container orchestration systems. The exam is online and proctored, mixing multiple-choice items with performance-based tasks, and runs 2 hours. Four domains are published: Installation, Upgrade & Configuration (20%), covering istioctl or Helm installs, sidecar or ambient mode, customization, and canary or in-place upgrades; Traffic Management (35%), the largest block, covering ingress and egress, in-mesh routing, destination rules, traffic shifting, external workload connectivity, resilience features, and fault injection; Securing Workloads (25%), covering authorization, authentication via mTLS and JWT, and TLS at the edge; and Troubleshooting (20%), covering configuration, control plane, and data plane issues. The Istio Certified Associate study guide has 4 sections and about 1,272 words.
01Installation, Upgrade & Configuration
The Installation, Upgrade & Configuration domain checks whether you can select an Istio profile, install a control plane, control sidecar injection, and upgrade a mesh without dropping traffic. Questions focus on istioctl install , revisions, namespace labels, and mesh-wide configuration.
328 words, about 2 min02Traffic Management
Traffic Management tests how you expose, route, split, and protect traffic using Gateway, VirtualService, and DestinationRule. Expect subsets, weighted routes, match conditions, retries, timeouts, fault injection, and load-balancing policy.
335 words, about 2 min03Securing Workloads
Securing Workloads tests identity, mutual TLS, request authentication, and authorization. You need to know how PeerAuthentication, AuthorizationPolicy, and RequestAuthentication interact, and how SPIFFE identities appear in policy.
295 words, about 1 min04Troubleshooting
Troubleshooting tests whether you can localize a failure across the control plane, sidecar, gateway, and application. You need istioctl analyze , proxy-status , proxy-config , logs, and a clear model of Envoy xDS sync and endpoint health.
314 words, about 2 min