ICA study plan

Install a single-cluster control plane and worker node from scratch, recording every flag and version you chose.

Map each install-time configuration object (mesh config, revision tags, injection settings) to the domain-1 objectives so you know what is examinable.

Compare two installation profiles (minimal vs. production-style multi-revision) and write down the tradeoffs in your own notes.

Verify the installed version and confirm which API versions your cluster serves for the core custom resources.

Perform an in-place upgrade of a running installation and document the ordering constraints between control plane and data plane components.

Practice changing configuration on a live cluster (revision tag, resource limits, injection policy) without reinstalling.

Break the configuration deliberately (invalid setting, mismatched version) and record the exact error message and recovery step.

Write down which settings are immutable and require a reinstall or migration path.

Configure ingress so that a single gateway serves two distinct hostnames and route each to a different backend.

Implement a 90/10 traffic split between two versions of one service and prove the ratio with repeated requests.

Configure a request timeout and a retry policy, then trigger a failure to confirm each behaves as configured.

Explain in writing how virtual service and destination rule resources interact for the routing you just built.

Implement header- or path-based routing and verify with curl that unmatched traffic falls back to the default route.

Configure egress control so that an external host is reachable only through a defined exit point.

Apply a fault-injection rule (delay and abort) and measure the client-visible effect.

Set up locality-aware or weighted failover between two subsets and force a failover.

Enable mutual TLS in strict mode for one namespace and confirm plaintext requests are rejected.

Write an authorization policy that allows one service identity to call another and denies everything else, then test both the allowed and denied path.

Configure JWT-based request authentication and reject a request with a missing or expired token.

Enumerate the identity and certificate mechanisms involved and note where trust is anchored.

Diagnose why a previously working route stopped responding after a policy change, using only logs and status output.

Trace a failed mTLS handshake to its root cause and document the fix.

Practice reading proxy configuration dumps to confirm which policy actually took effect.

Build a triage checklist ordered from symptom to likely layer (config, routing, identity, certificate).

Reproduce and resolve a configuration rejection caused by an invalid or conflicting resource.

Diagnose a traffic split that silently sends 100% to one subset and explain the misconfiguration.

Collect and interpret metrics that show error rate and latency for a failing route.

Time yourself resolving two faults end to end and record where you lost time.

Rebuild the full lab from scratch in under 90 minutes using only your own runbook.

Run a 30-question self-written review covering all four domains and score it honestly.

Re-drill your three weakest objectives until each is completed without notes.

Finalize a one-page quick-reference sheet of commands and manifest skeletons you can recall under time pressure.