ICA case studies
ICA · Put your knowledge to work in context.
The Istio Certified Associate (ICA) is a pre-professional certification from the Linux Foundation, originally developed by Tetrate, aimed at engineers, CI/CD practitioners, and anyone with a strong interest in Istio. It validates foundational knowledge of Istio principles, terminology, and best practices, and the ability to set up a service mesh. The exam is online and proctored, mixing performance-based tasks with multiple-choice questions over two hours. Four domains carry the weight: Installation, Upgrade & Configuration (20%), Traffic Management (35%), Securing Workloads (25%), and Troubleshooting (20%). Topics on this exam: Installation, Upgrade & Configuration, Traffic Management, Securing Workloads, and Troubleshooting. The ICA case studies are 5 cases and about 3,062 words.
1Canary Control-Plane Upgrade Stalls at Sidecar Injection
Your production cluster runs Istio 1.20.4 installed with the default revision. The mesh has 3 istiod replicas, 42 namespaces, about 900 sidecar-injected pods, strict mTLS, and a single ingress gateway.
621 words, about 3 min2Canary Release Returns 503 UF for One Subset
Your team runs a reviews service with three Deployments: v1 with 8 replicas, v2 with 4 replicas, and v3 with 1 replica. A VirtualService sends 80% to v1, 15% to v2, and 5% to v3 using DestinationRule subsets.
595 words, about 3 min3Strict mTLS Blocks a Legacy Billing Client
The payments namespace enforces PeerAuthentication STRICT and has a default-deny AuthorizationPolicy. All in-mesh callers use SPIFFE identities.
657 words, about 3 min4Restricted Pod Security Blocks the Istio Init Container
Your cluster runs Kubernetes 1.28 with Pod Security Admission enforced cluster-wide at the restricted level. Istio 1.21 was installed with the default profile, sidecar injection enabled per namespace, and no CNI plugin.
595 words, about 3 min5Retries Turn a Timeout into Duplicate Charges
Your payments API exposes POST /v1/charges. The VirtualService for payments has a 5s timeout, retries with attempts: 3, perTryTimeout: 2s, and retryOn: 5xx,reset,connect-failure.
594 words, about 3 min