ICA study plan: the new curriculum, sidecar versus ambient, and the exam environment

ICA in numbers

The ICA facts below come from the Linux Foundation certification page and candidate documentation. The exam lasts 120 minutes for 15-20 performance-based tasks, the pass mark is 68%, and results arrive by email within 24 hours. The tasks are available in English, Simplified Chinese and Japanese.

The August 2025 curriculum change

The Linux Foundation announced a new ICA outline effective 12 August 2025 at 00:00 UTC. The earlier outline had five domains: Istio Fundamentals, Traffic Management, Security, Observability and Advanced Istio Features. The new one has four, and it shifts the weight toward doing things in a running mesh: installing and upgrading it, routing and shaping traffic, securing it and fixing it when it breaks. Observability is no longer a domain of its own.

Sidecar mode and ambient mode

Istio has two data plane modes, and the curriculum names both. In sidecar mode, an Envoy proxy is injected into every Pod of an enrolled namespace, usually by labelling the namespace istio-injection=enabled and restarting the workloads. In ambient mode, a per-node proxy called ztunnel handles Layer 4 traffic and mTLS for enrolled workloads without changing their Pods, and an optional waypoint proxy adds Layer 7 features such as HTTP routing and authorization for a namespace or service.

For the exam, the useful skill is recognising which mode a namespace is in and enrolling or removing it correctly. Practise installing each profile on a fresh cluster with istioctl install, enrolling a namespace, and confirming the result with istioctl and kubectl.

Traffic management: the largest domain

Traffic Management is 35% of the exam. Most of its topics are expressed in four resources: a Gateway for ingress and egress at the edge, a VirtualService for routing rules, a DestinationRule for subsets and traffic policies, and a ServiceEntry for services outside the mesh. Practise each topic until you can write the resource from the documentation in a few minutes and prove it works with a stream of curl requests.

• Expose a service through an ingress Gateway with a host and a VirtualService.
• Route by header or path to different subsets defined in a DestinationRule.
• Shift traffic by weight between versions, and check the split over many requests.
• Add timeouts, retries, circuit breaking and outlier detection.
• Inject delays and aborts to test resilience.
• Register an external host with a ServiceEntry and control egress.

Securing workloads and troubleshooting

Securing Workloads (25%) covers authorization, authentication with mutual TLS and JWT, and TLS for edge traffic. The resources are PeerAuthentication for mTLS modes, RequestAuthentication for JWT validation, AuthorizationPolicy for allow and deny rules, and a Gateway with a TLS secret for the edge. Troubleshooting (20%) asks you to find faults in configuration, the control plane and the data plane. For troubleshooting, practise in the order the tools report problems: check that the workload has a proxy or is enrolled in ambient mode, run istioctl analyze on the namespace, then compare what the proxy received with proxy-status and proxy-config.

• Set STRICT mTLS for a namespace and a PERMISSIVE exception, then show that plaintext is rejected.
• Allow only one ServiceAccount to call a path, and deny everything else.
• Require a valid JWT for a route and confirm a request without one is denied.
• Use istioctl analyze, proxy-status and proxy-config to find a broken route or an unsynchronised proxy.
• Fix a namespace whose Pods are not getting a sidecar because of a wrong label.

The exam environment and allowed resources

Each task names a host to ssh to. The hosts have kubectl with the k alias and Bash completion, istioctl with Bash completion, yq, curl, wget and man pages; the base system has none of them. You may open the Istio documentation and blog, the Kubernetes documentation, and the task’s Quick Reference links. Searching istio.io is allowed, but you must not open external search results.

The environment runs Istio 1.29, which Istio’s supported-releases page lists as end of life since 15 October 2026 and supported on Kubernetes 1.31 to 1.35. Practise on that pairing, and recheck the instructions page before your exam because a move to a newer release is likely.

A five-week ICA plan

The plan follows the weights and assumes comfortable kubectl skills. Each week ends with a timed set of tasks on a fresh cluster, because rebuilding the mesh from nothing is itself an exam skill under the new outline.

ICA hands-on labs are in preview: the GoldenKube CLI runs its scenarios on your own machine, but it has no public release yet.

Practising on a local cluster

ICA tasks are done on a live mesh, so practice must be too. A local cluster with Istio installed by istioctl is enough for every domain. Keep two clusters, or rebuild often, so that you practise both sidecar and ambient mode, and give each exercise a test you can run: a curl from a client Pod whose answer proves the configuration works.

Match your local Istio minor to the exam environment. The Istio supported-releases table lists 1.31 to 1.35 as the Kubernetes versions for this release, so pick a local Kubernetes version in that range.