The Cloud Panda

Kubernetes · course, labs and mock exams

ICA course and practice labs

Istio Certified Associate: 4 modules of lessons and demos, 51 tasks from 34 lab templates on real kubeadm clusters, and 8 timed mock exams.

Labs store Istio objects and read them with kubectl. They do not install Istio or a mesh controller.

  • Beginner
  • 5.5 hours
  • Certificate of completion
  • Pass mark 66%
Sign up freeSee the curriculum
Modules
4
Lessons
12
Demos
4
Labs
34
Tasks
51
Mock exams
8

The Linux Foundation · 120 minute exam

What you'll learn

Every domain of the exam, weighted like the exam

All 4 domains in the public curriculum. 4 of them already have labs.

What's included

A full course, not just a question bank

  • 12 lessons

    Short lessons for the exam competencies, with commands to copy and links to the official docs.

  • 4 demos

    Walk through a task step by step before you try it yourself.

  • 34 hands-on labs

    51 tasks with their variants, on a kubeadm cluster, graded check by check.

  • 4 module quizzes

    24 original questions, with an explanation for every answer.

  • 8 mock exams

    4 full mocks and 4 domain mocks. Pass mark 66%.

  • Certificate of completion

    From The Cloud Panda when you finish the course. It is a course certificate, not one from The Linux Foundation.

Curriculum

4 modules

12 lessons and 4 demos: 3 h 24 min of reading and demos, about 5.5 hours with the practice. The lessons open with a free account.

01Install and upgrade3 lessons · 1 demo · 51 min · 4 labs · quiz

The objects an Istio install leaves behind, sidecar versus ambient, mesh config, and a revision label for a canary upgrade. Domain: Installation, Upgrade & Configuration.

  1. lessonistioctl and Helm leave the same contract12 min
  2. lessonSidecar or ambient, per namespace12 min
  3. lessonMesh config and a canary revision13 min
  4. demoDemo: edit mesh config, then move a namespace14 min
02Traffic management3 lessons · 1 demo · 52 min · 7 labs · quiz

Gateway API ingress, ServiceEntry egress, VirtualService routes, DestinationRule subsets, weights, retries and a fault. Domain: Traffic Management.

  1. lessonIngress, egress and a route13 min
  2. lessonSubsets and weights12 min
  3. lessonAn outside host, retries and a fault13 min
  4. demoDemo: shift the canary, then abort14 min
03Securing workloads3 lessons · 1 demo · 51 min · 3 labs · quiz

An AuthorizationPolicy that denies by default, strict mTLS with a JWT issuer, and TLS termination on a Gateway listener. Domain: Securing Workloads.

  1. lessonDeny by default, then allow one call12 min
  2. lessonStrict mTLS and a JWT13 min
  3. lessonTLS at the edge12 min
  4. demoDemo: strict mTLS, then the HTTPS listener14 min
04Troubleshooting3 lessons · 1 demo · 50 min · 3 labs · quiz

A bad host and a subset that matches nothing, an istiod Service with no endpoints, and a pod that opted out of injection. Domain: Troubleshooting.

  1. lessonA host typo and a subset with no pods12 min
  2. lessonNo endpoints means no discovery12 min
  3. lessonInjection off, and a port named tcp12 min
  4. demoDemo: fix the host, then the selector14 min

How a lab works

The same loop as a hands-on exam

A task, a live cluster, and checks that read the cluster.

  1. We set the scene

    A setup script puts a live environment into a real state, often a broken one: a broken workload, a missing permission, a Service with no endpoints. You get the task and a terminal.

  2. You fix it

    With the real tools and the official documentation, exactly as you will in the exam. Nothing is simulated and there are no multiple-choice shortcuts.

  3. Checks grade it

    Each lab runs checks against the live environment and shows which passed. There is no answer text to match: if a check fails, you know exactly what is left.

Lab library

Every lab, by exam domain

51 hands-on tasks across 4 domains, about 7 hours of practice.

Traffic Management 35% of the exam · 14 labs

Configuring Ingress and Egress Traffic

  • TM1Gateway API ingress and a ServiceEntry8 min
  • TM8Redirect HTTP to HTTPS and register an outside host (2 variants)10 min

Configuring Routing within a Service Mesh

  • TM2Route /api and / inside the mesh6 min
  • TM9Route a header to subset v2 (2 variants)8 min

Defining Traffic Policies with Destination Rules

  • TM3Subsets v1 and v26 min
  • TM10Hash requests on a header (2 variants)8 min

Configuring Traffic Shifting

  • TM4Send all traffic to the canary6 min
  • TM11Mirror live traffic at a percentage (2 variants)8 min

Connecting In-Mesh Workloads to External Workloads and Services

  • TM5A ServiceEntry with an endpoint6 min
  • TM12Register an outside host by DNS (2 variants)8 min

Using Resilience Features (circuit breaking, failover, outlier detection, timeouts, retries)

  • TM6Retries, a timeout and outlier detection8 min
  • TM13Fail over from one region to another (2 variants)10 min

Using Fault Injection

  • TM7Abort 100% of calls with 5036 min
  • TM14Delay a percentage of calls (2 variants)8 min

Securing Workloads 25% of the exam · 6 labs

Configuring Authorization

  • SW1Deny by default, allow the frontend8 min
  • SW4Deny POST /admin and allow a GET (2 variants)10 min

Configuring Authentication (mTLS, JWT)

  • SW2Strict mTLS and a JWT issuer8 min
  • SW5Strict mTLS with one permissive port and a JWT (2 variants)10 min

Securing Edge Traffic with TLS

  • SW3Terminate TLS on a Gateway listener8 min
  • SW6Pass TLS through an edge listener (2 variants)10 min

Installation, Upgrade & Configuration 20% of the exam · 8 labs

Installing Istio with istioctl or Helm

  • IN1Record a demo-profile install8 min
  • IN5Record a profile install (2 variants)8 min

Installing Istio in Sidecar or Ambient Mode

  • IN2Choose sidecar or ambient per namespace6 min
  • IN6Point a namespace at a waypoint (2 variants)8 min

Customizing your Istio Installation

  • IN3Lock egress to the registry6 min
  • IN7Set proxy resources and tracing (2 variants)8 min

Upgrading Istio (Canary, In-Place)

  • IN4Move a namespace to the new revision6 min
  • IN8Replace the revision in place (2 variants)8 min

Troubleshooting 20% of the exam · 6 labs

Troubleshooting Configuration

  • TS1Fix a host typo and a subset label6 min
  • TS4Fix a host and weights that do not add up (2 variants)8 min

Troubleshooting the Mesh Control Plane

  • TS2Give istiod a ready endpoint8 min
  • TS5Point discovery at this namespace (2 variants)8 min

Troubleshooting the Mesh Data Plane

  • TS3Turn injection on and name the port6 min
  • TS6Stop a sidecar from seeing the whole mesh (2 variants)10 min

Mock exams

8 timed mock exams

Pass mark 66%. A task appears in only one mock.

MockKindTasksTime
ICA Domain Mock: Installation, Upgrade & ConfigurationOne domain4120 min
ICA Domain Mock: Traffic ManagementOne domain7120 min
ICA Domain Mock: TroubleshootingOne domain3120 min
ICA Domain Mock: Securing WorkloadsOne domain3120 min
ICA Full Mock 01Full exam17120 min
ICA Full Mock 02Full exam5120 min
ICA Full Mock 03Full exam5120 min
ICA Full Mock 04Full exam5120 min

Start the ICA course

A free account opens the lessons. The free starter labs on the CKA stay the CKA labs.

Sign up freeAll Kubernetes certifications