Istio Certified Associate study plan
Istio Certified Associate · Give each week a clear focus.
8 weeks · About 6 hours per week
Installation, Upgrade & Configuration & Traffic Management
Install a local Kubernetes cluster (kind or minikube) and deploy Istio using the istioctl profile-based installer (demo profile).
Verify control plane components (istiod, ingress gateway) are running and inspect their configuration with istioctl proxy-status and istioctl analyze.
Compare sidecar injection methods (namespace label vs. manual) and enable automatic injection for a test namespace.
Deploy the Bookinfo sample application and confirm all pods have the istio-proxy sidecar injected.
Your checkpoint
A working local cluster with Istio and Bookinfo deployed; capture the output of istioctl proxy-status showing all proxies synced.
Traffic Management
Configure a Gateway and VirtualService to expose Bookinfo externally on a chosen hostname.
Implement path-based and header-based routing rules to send traffic to different subsets of a service.
Perform a canary rollout by shifting traffic weights between v1 and v2 of the reviews service (e.g., 80/20) and verify with repeated curl requests.
Inject HTTP faults (delay and abort) using a VirtualService and observe client behavior.
Your checkpoint
A YAML manifest set (Gateway, VirtualService, DestinationRule) that implements weighted routing and fault injection; a short log showing traffic distribution matches configured weights.
Traffic Management
Configure request timeouts and retries on a VirtualService and validate behavior with a slow or failing backend.
Set up an egress Gateway to route traffic to an external service and restrict outbound access using a ServiceEntry.
Implement traffic mirroring (shadowing) to send a copy of production traffic to a test version.
Use istioctl to inspect route configurations (istioctl proxy-config routes) and confirm applied rules.
Your checkpoint
A working egress gateway configuration plus a traffic mirroring rule; a command transcript showing mirrored traffic reaching the test version while primary responses are unaffected.
Securing Workloads
Enable strict mutual TLS (mTLS) for a namespace and verify connections are encrypted using istioctl authn tls-check.
Create a PeerAuthentication policy that enforces STRICT mode and a RequestAuthentication policy that validates JWT tokens.
Write an AuthorizationPolicy to allow only requests with a valid JWT and a specific HTTP method to reach a service.
Test that unauthorized requests are rejected with 401/403 and authorized requests succeed.
Your checkpoint
A security policy bundle (PeerAuthentication, RequestAuthentication, AuthorizationPolicy) applied to Bookinfo; a test script showing 401/403 for unauthorized calls and 200 for authorized calls.
Securing Workloads
Configure an Ingress Gateway with TLS termination using a self-signed certificate and verify HTTPS access.
Apply a Sidecar resource to restrict the set of services a workload can reach and observe the reduced configuration.
Use AuthorizationPolicy with service account-based rules to allow traffic only from a specific workload identity.
Audit mTLS and authorization policies across namespaces using istioctl analyze and istioctl experimental authz.
Your checkpoint
A TLS-enabled ingress gateway and a Sidecar scoping configuration; a report showing the sidecar's Envoy config only includes allowed services and that cross-service-account access is denied.
Troubleshooting & Installation, Upgrade & Configuration
Diagnose a broken VirtualService (e.g., wrong subset reference) using istioctl analyze and proxy-config endpoints.
Simulate a control plane failure (stop istiod) and observe data plane behavior; document recovery steps.
Perform a canary upgrade of the control plane using istioctl upgrade or revision-based upgrade and verify workloads continue to function.
Collect and inspect Envoy access logs and proxy metrics to trace a failing request path.
Your checkpoint
A troubleshooting runbook documenting three failure scenarios (misconfigured route, control plane outage, upgrade) with the commands used and the resolution for each.
Troubleshooting & Traffic Management
Use istioctl bug-report to capture a diagnostic snapshot and identify key artifacts (logs, config dumps).
Debug a mTLS mismatch between two services by inspecting PeerAuthentication and DestinationRule settings.
Tune sidecar resource limits and concurrency settings and measure impact on latency using a simple load generator.
Resolve a DNS resolution failure for an external service by adding a ServiceEntry and verifying with istioctl proxy-config clusters.
Your checkpoint
A diagnostic report for a mTLS mismatch and a DNS resolution issue, including the root cause, the fix applied, and verification output.
Installation, Upgrade & Configuration & Traffic Management & Securing Workloads & Troubleshooting
Review all domain objectives and re-run hands-on labs for any weak areas identified in practice tests.
Complete a timed practice exam (if available) or build a 30-question self-assessment covering all domains and score it.
Re-deploy the full Bookinfo stack from scratch with security policies, traffic routing, and egress in under 60 minutes.
Document a one-page cheat sheet of critical istioctl commands and configuration snippets for each domain.
Your checkpoint
A timed end-to-end deployment of the complete lab environment with all policies and routing rules, plus a scored self-assessment and a personal cheat sheet.
Milestones
Week 2: Can independently deploy Istio, inject sidecars, and implement weighted traffic routing between two service versions without referencing notes.
Week 4: Can enforce strict mTLS and JWT-based authorization, and demonstrate that unauthorized requests are rejected.
Week 6: Can diagnose and fix a misconfigured VirtualService and perform a control plane upgrade without downtime.
Week 8: Score at least 80% on a comprehensive self-assessment covering all four domains and complete the end-to-end deployment within the time limit.