Istio Certified Associate: exam-style tasks on a real kubeadm cluster on your own Mac, built and graded by the GoldenKube CLI. Each card shows the domain, the cluster topology it needs, the recommended time and its points; the scenario page has the full task text. Scenarios run Istio 1.29, the version the ICA exam environment runs, on Kubernetes 1.35.
The Linux Foundation product page calls ICA "an online, proctored, performance-based and multiple-choice exam", but the ICA candidate instructions say "The exam consists of 15-20 performance-based tasks", completed on a designated host, and mention no multiple-choice section; they also state that "The ICA environment is currently running Istio v1.29". GoldenKube therefore practises ICA with hands-on labs only: each scenario is an Istio task on a local Kubernetes cluster, graded on the state you leave behind.
The scenarios are written against the four official domains: installing Istio with istioctl or Helm, in sidecar or ambient mode, customizing the installation and upgrading it with a canary or in place (installation, upgrade and configuration); ingress and egress traffic, routing, destination rules, traffic shifting, connecting to external services, resilience features such as timeouts, retries, circuit breaking and outlier detection, and fault injection (traffic management); authorization, authentication with mTLS and JWT, and TLS at the edge (securing workloads); and configuration, control plane and data plane problems (troubleshooting).
| Questions | 15-20 performance-based tasks source |
|---|---|
| Duration (minutes) | 120 source |
| Passing score | 68% source |
| Price (USD) | 250 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, performance-based and multiple-choice source |
| Prerequisites | None source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | Exam environment runs Istio v1.29 source |
Published scenarios per official ICA domain, next to the domain's exam weight (checked 2026-10-28 on the official page). 20 published scenarios today.
| Domain | Exam weight | Published scenarios |
|---|---|---|
| Installation, Upgrade & Configuration | 20% | 4 |
| Traffic Management | 35% | 7 |
| Securing Workloads | 25% | 5 |
| Troubleshooting | 20% | 4 |
goldenkube exam ica draws a curriculum-weighted set: 15 tasks in 120 minutes, pass at 68%. Solutions and hints are hidden in exam mode.
20 published scenarios
Install the Istio control plane with the default profile and bring an existing namespace into the sidecar mesh.
Single node · ~8 min · 8 points
goldenkube start ica-ins-001
Write an IstioOperator that changes mesh defaults and gateways, then use it for an in-place upgrade from 1.29.9 to 1.29.10.
Single node · ~10 min · 9 points
goldenkube start ica-ins-002
Run a second Istio control plane as a revision and move one namespace to it while another stays on the old revision.
Single node · ~12 min · 10 points
goldenkube start ica-ins-003
Install the ambient profile and add an existing namespace to the ambient data plane without sidecars.
Single node · ~10 min · 8 points
goldenkube start ica-ins-004
Require mutual TLS for the whole mesh while one legacy namespace keeps accepting plain text.
Single node · ~7 min · 7 points
goldenkube start ica-sec-001
Write an ALLOW AuthorizationPolicy that admits a single workload identity for GET on two paths and nothing else.
Single node · ~8 min · 8 points
goldenkube start ica-sec-002
Validate end-user JWTs with a RequestAuthentication and an inline key set, and deny requests that carry no token.
Single node · ~9 min · 9 points
goldenkube start ica-sec-003
Serve a host over HTTPS at the ingress gateway from a Kubernetes TLS secret and redirect plain HTTP to HTTPS.
Single node · ~10 min · 10 points
goldenkube start ica-sec-004
Combine a namespace-wide deny-all with an ALLOW and a DENY AuthorizationPolicy and reason about their evaluation order.
Single node · ~9 min · 9 points
goldenkube start ica-sec-005
Find out why two Deployments run without the Istio sidecar and fix every cause without recreating them.
Single node · ~7 min · 7 points
goldenkube start ica-trb-001
A weighted route points at a subset that does not exist; repair the configuration without touching the route.
Single node · ~8 min · 8 points
goldenkube start ica-trb-002
istiod does not start any more, so the injection webhook blocks pod creation; restore the control plane.
Single node · ~8 min · 8 points
goldenkube start ica-trb-003
A client-side TLS setting contradicts a strict PeerAuthentication; find it with proxy-config and fix the client side.
Single node · ~9 min · 8 points
goldenkube start ica-trb-004
Publish an in-mesh HTTP service on a host name through the Istio ingress gateway with a Gateway and a VirtualService.
Single node · ~7 min · 7 points
goldenkube start ica-trf-001
Define service subsets and send requests of one user to v2 while everybody else stays on v1.
Single node · ~8 min · 8 points
goldenkube start ica-trf-002
Split traffic between two versions of a service with weighted routes.
Single node · ~7 min · 6 points
goldenkube start ica-trf-003
Switch the mesh to registry-only outbound traffic and allow exactly one external host with a ServiceEntry.
Single node · ~9 min · 9 points
goldenkube start ica-trf-004
Make a slow backend fail fast with a timeout and retries, and protect it with a connection pool and outlier detection.
Single node · ~10 min · 10 points
goldenkube start ica-trf-005
Use VirtualService fault injection to delay test traffic and fail half of the remaining requests.
Single node · ~8 min · 8 points
goldenkube start ica-trf-006
Configure locality-aware load balancing that fails over from one region to another when endpoints are ejected.
Single node · ~7 min · 7 points
goldenkube start ica-trf-007
goldenkube doctor.goldenkube login (free account).goldenkube submit; the result appears on your dashboard.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.
Not yet. The ICA scenarios are published and readable here, but the first signed build of the CLI is not on the Homebrew tap, so the catalog is a preview. Running a scenario needs that release and a free account.
The Linux Foundation product page describes it as "performance-based and multiple-choice", while the ICA candidate instructions list 15 to 20 performance-based tasks and no multiple-choice section. GoldenKube treats ICA as a hands-on exam and practises it with labs, not quiz questions.
The ICA candidate instructions state that the exam environment "is currently running Istio v1.29", and the GoldenKube ICA scenarios target that version. Istio 1.29 reached its upstream end of life on 15 October 2026, so the Linux Foundation may move the exam to a newer release; check the official instructions before you book.