Istio Certified Associate (ICA)
Demonstrate competence in Istio service mesh architecture, Envoy sidecar proxies, traffic management, canary rollouts, fault injection, mutual TLS security, and distributed observability.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The ICA is a performance and scenario-based certification administered by the CNCF and Linux Foundation validating practical knowledge of the Istio service mesh.
The ICA is a 2-hour hands-on command-line exam where candidates configure traffic routing, security policies, and observability on live Kubernetes clusters running Istio.
A passing scaled score of 70% is required. One free retake is included with registration.
Domains include: (1) Installation, Upgrade & Configuration (17%), (2) Traffic Management (35%), (3) Resiliency & Fault Injection (18%), (4) Securing Workloads (20%), and (5) Observability (10%).
istiod manages configurations, translates high-level routing rules, and distributes certificates. The data plane consists of Envoy sidecar proxies co-located with application pods intercepting all network traffic.
When a namespace is labeled with istio-injection=enabled, the Istio mutating admission webhook automatically injects an Envoy sidecar proxy container and init container into newly created pods.
A VirtualService defines routing rules (traffic splitting, URI matching, rewrites) directing traffic to destinations. A DestinationRule defines policies (subsets, load balancing algorithms, mTLS settings) applied after routing occurs.
Ambient Mesh is a sidecar-less architecture that decouples L4 transport security (handled by ztunnel daemonsets) from L7 processing (handled by optional waypoint proxies), reducing resource overhead.
PeerAuthentication defines mTLS modes (STRICT, PERMISSIVE, DISABLE). In STRICT mode, sidecars accept only encrypted mTLS traffic authenticated by Istio CA certificates.
VirtualService fault stanzas inject delays (latency simulation) or aborts (HTTP status errors) into selected request paths without modifying application code.
AuthorizationPolicy enforces access control on incoming requests to workloads based on source identity, namespace, HTTP methods, paths, and JWT claims.
Envoy proxies automatically generate detailed metrics (request counts, duration, response codes) scraped by Prometheus, and inject tracing headers (W3C TraceContext/B3) forwarded to Jaeger/Zipkin.