ICA
Istio Certified Associate (ICA)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Istio Certified Associate (ICA) is a pre-professional certification from the Linux Foundation, originally developed by Tetrate, aimed at engineers, CI/CD practitioners, and anyone with a strong interest in Istio. It validates foundational knowledge of Istio principles, terminology, and best practices, and the ability to set up a service mesh. The exam is online and proctored, mixing performance-based tasks with multiple-choice questions over two hours. Four domains carry the weight: Installation, Upgrade & Configuration (20%), Traffic Management (35%), Securing Workloads (25%), and Troubleshooting (20%). That split tells you where to spend your time - routing, destination rules, ingress and egress, resilience features, and fault injection matter more than anything else, while mTLS, JWT authentication, authorization policies, and edge TLS round out the security domain. Note that the exam has changed and all exams now test the new curriculum, so confirm details on the official page before booking. There are no prerequisites, and the experience level is listed as intermediate. To prepare, work hands-on in a cluster: install Istio with istioctl and Helm in sidecar and ambient modes, customize the installation, practice canary and in-place upgrades, then build routing and security configurations from scratch and deliberately break them to practice troubleshooting the control plane and data plane. The exam bundle with the LFS245 Istio Service Mesh Essentials course is a reasonable starting point.
What you'll study
About ICA preparation
What is the ICA exam format?
It is an online, proctored exam that combines performance-based tasks with multiple-choice questions. You should expect to work in a live environment rather than only answer theory questions, so hands-on fluency with kubectl and istioctl matters as much as recall.
How long is the exam and what does it cost?
The exam duration is two hours. Exam-only pricing is $250. Bundles are also offered: exam plus the THRIVE-ONE annual subscription for $495, or exam plus the LFS245 Istio Service Mesh Essentials course for $299.
How long is the certification valid, and can I retake it?
The online certification is valid for two years, and exam eligibility runs for 12 months and includes one retake. Plan to recertify before the two-year mark if your role depends on holding a current credential.
Are there prerequisites?
No. The Linux Foundation states there are no prerequisites for this exam, and the experience level is listed as intermediate. That said, comfort with Kubernetes workloads, services, and YAML is effectively assumed by the hands-on tasks.
Which domain should I study first?
Start with Traffic Management, which carries 35% - the largest share. Get comfortable with ingress and egress, routing within the mesh, destination rules, traffic shifting, resilience features, and fault injection. Then move to Securing Workloads at 25%, and treat installation and troubleshooting as ongoing practice.
Is the exam based on the current curriculum?
Yes. The Linux Foundation notes the ICA exam has changed and states that all exams will now be tested on the new curriculum. Check the official certification page for the details of those changes before you schedule, since older study material may not match.
What are common failure modes?
Candidates typically lose points on installation variants - istioctl versus Helm, sidecar versus ambient mode - and on upgrades such as canary and in-place. Troubleshooting is the other trap: you need a methodical way to isolate control plane versus data plane problems under time pressure.
How should I prepare in practice?
Build a cluster and do the work repeatedly: customize an installation, upgrade it, then configure routing and security from scratch. Deliberately misconfigure VirtualServices, destination rules, and authorization policies, then diagnose the failures. The bundled LFS245 course covers the essentials if you want structured material.
What does the certification demonstrate to employers?
It confirms foundational knowledge of Istio principles, terminology, and best practices, plus the ability to set up Istio. It is positioned as a pre-professional credential, so it signals readiness to work with a service mesh rather than deep production mastery.