Istio Certified Associate (ICA) Roadmap

Start with the request path, not isolated YAML fields. Learn how Kubernetes service discovery feeds Istio's registry, how istiod calculates configuration, and how the data plane enforces it. Compare the sidecar model with ambient's layered model: per-workload Envoy versus per-node ztunnel plus optional destination waypoints. Build a disposable cluster whose Kubernetes and Istio versions are supported together.

Install with `istioctl` from a saved configuration and understand the default versus demo profiles. Repeat with Helm so base CRDs, istiod, optional CNI, and gateway ordering are familiar. Practice deterministic sidecar enrollment and ambient namespace enrollment. Confirm that ambient enrollment does not add a container to application Pods, while sidecar injection affects newly created Pods and therefore usually requires replacement.

Build routing from first principles. `VirtualService` selects an ordered route based on host, URI, headers, method, gateway, source context, or weights. `DestinationRule` defines subsets and post-routing policies. Practice using FQDNs, placing specific matches before the catch-all, and measuring weighted behavior with enough requests to avoid false conclusions from tiny samples.

Separate listener configuration from routing. A Gateway describes edge ports, protocols, hosts, SNI and TLS; a bound VirtualService forwards traffic. Model external dependencies with ServiceEntry. Then tune timeout, retry, connection-pool, outlier-detection, failover and fault policies as interacting budgets—not independent switches. Performance-oriented practice means measuring latency, error rates, retry amplification, overflow and ejection, not memorizing fields alone.

Keep three identities separate: peer workload identity from mTLS, request identity from JWT, and edge server/client identity from gateway TLS. Move a controlled namespace from PERMISSIVE to STRICT only after mesh clients are ready. Use RequestAuthentication to validate tokens and AuthorizationPolicy to require request principals and claims. Begin authorization from allow-nothing and add minimal identities and operations.

Adopt a consistent order: reproduce one request, verify Kubernetes resources and endpoints, analyze configuration, check istiod health and logs, then inspect xDS connection state. `istioctl analyze` detects many static errors but is not a traffic test. `proxy-status` shows whether proxies connect and acknowledge configuration; a missing proxy, STALE proxy and NOT SENT resource represent different conditions.

Move from intended resources to effective Envoy state. Follow listener → route → cluster → endpoint → secret. Read access-log response flags and inspect the exact client or gateway proxy where a decision occurs. Then rehearse canary and in-place upgrade differences. Run precheck, preserve configuration, validate data-plane migration, keep rollback available, and remove the old revision only after no workloads depend on it.

Use short, original scenarios rather than memorized snippets. Read the goal, identify the enforcement point, inspect existing state, apply the smallest change, and verify both positive and negative behavior. Practice switching SSH targets and contexts deliberately. The goal is operational fluency under time pressure, not predicting confidential tasks.