Istio Certified Associate: Installation, Upgrade & Configuration

What this domain tests

The Installation, Upgrade & Configuration domain checks whether you can select an Istio profile, install a control plane, control sidecar injection, and upgrade a mesh without dropping traffic. Questions focus on istioctl install, revisions, namespace labels, and mesh-wide configuration.

Core rules

Profiles bundle component settings: default is production-oriented, demo enables add-ons and permissive settings, minimal installs only the control plane, and remote supports a shared control plane.
istioctl install --set profile=demo installs directly; istioctl manifest generate renders YAML for GitOps. istioctl analyze validates configuration before or after apply.
Sidecar injection is namespace-scoped. Use istio-injection=enabled for the default revision or istio.io/rev=<revision> for a specific revision. Do not mix the two labels on one namespace.
Revision-based upgrades let old and new control planes coexist. Install a new revision, move namespaces by label, restart pods so new sidecars are created, then remove the old revision.

Worked example

A mesh runs revision 1-19. You install 1-20 with istioctl install --set revision=1-20 --set profile=default. Label namespace payments with istio.io/rev=1-20, then restart its Deployments. The 1-19 control plane still exists, so rollback means relabeling to 1-19 and restarting again. Reasoning: injection happens at pod creation, so a label change alone does not replace existing sidecars.

Traps

Installing without --set revision reuses the default revision and can overwrite the current control plane.
Relabeling a namespace but not restarting pods leaves old sidecars connected to the old revision.
Using a revision label while istio-injection=enabled is also present creates ambiguous injection behavior.
istioctl analyze is not a runtime health check; it will not detect pods that were never restarted.