ICA study guide
ICA · Work through your exam, one topic at a time.
The Istio Certified Associate (ICA) is a pre-professional certification from the Linux Foundation, originally developed by Tetrate, aimed at engineers, CI/CD practitioners, and anyone with a strong interest in Istio. It validates foundational knowledge of Istio principles, terminology, and best practices, and the ability to set up a service mesh. The exam is online and proctored, mixing performance-based tasks with multiple-choice questions over two hours. Four domains carry the weight: Installation, Upgrade & Configuration (20%), Traffic Management (35%), Securing Workloads (25%), and Troubleshooting (20%). Topics on this exam: Installation, Upgrade & Configuration, Traffic Management, Securing Workloads, and Troubleshooting. The ICA study guide has 4 sections and about 1,193 words.
01Installation, Upgrade & Configuration
The Installation, Upgrade & Configuration domain checks whether you can choose an Istio profile, install a control plane, upgrade by revision, and wire injection and mesh configuration without breaking workloads. Expect questions on istioctl , IstioOperator overlays, revisions, and namespace labels. istioctl install -f overlay.yaml merges an IstioOperator overlay onto a profile. Profiles include default , demo , minimal , ambient , and empty .
304 words, about 2 min02Traffic Management
Traffic Management tests the request path from a gateway to a workload: how Gateways expose ports, VirtualServices match and split requests, and DestinationRules define subsets and resilience. Questions often ask why a route is ignored or why weights do not reach the intended pods. The edge path is client - Gateway - VirtualService - DestinationRule - subset endpoints. A Gateway selects gateway pods by selector labels; a VirtualService binds to it with gateways and matches on hosts .
319 words, about 2 min03Securing Workloads
Securing Workloads covers Istio identity, mutual TLS, request authentication, and authorization. You must know which resource enforces encryption, which one validates a JWT, and which one actually blocks a request. Istio issues X.509 certificates with SPIFFE identity spiffe://cluster.local/ns/<namespace /sa/<service-account . Istiod rotates certificates; Envoy fetches them through SDS.
299 words, about 1 min04Troubleshooting
Troubleshooting tests whether you can locate faults in configuration and in the Envoy data plane without guessing. Expect istioctl diagnostics, xDS sync status, response flags, and checks for injection, routing, and policy. istioctl analyze finds static configuration errors; proxy-status shows whether Envoy has synced xDS; proxy-config prints listeners, routes, clusters, and endpoints. istioctl x describe pod summarizes effective config; istioctl bug-report collects cluster state.
271 words, about 1 min