Install Istio
Install Istio with istioctl or Helm in sidecar or ambient mode, customize it, and upgrade by canary or in place.
Partners and press
Overview
A service mesh hides a lot of network. This exam tests whether you can see it.
An Associate exam the Linux Foundation calls pre-professional, for engineers, CI/CD practitioners and anyone interested in Istio. Traffic management carries 35%, from routing to fault injection, and securing workloads takes 25% with mTLS, JWT and policy. It mixes performance-based tasks with multiple-choice questions, and exams from 12 August 2025 follow the revised domains.
11Modules
120Minutes
2Years valid
7Roles
What it tests
Learn all the way down.
Learn all the way down.
Perform when it matters.
Steer the traffic
Configure ingress, egress, routing, destination rules and traffic shifting, and use retries, timeouts and fault injection.
Secure the workloads
Configure authorization, authentication with mTLS and JWT, and TLS for traffic at the edge.
Troubleshoot the mesh
Diagnose configuration problems and faults in the control plane and the data plane.
Course outline
A service mesh you can install,
A service mesh you can install,
steer, secure and debug.
We design this course ourselves. Linux Foundation runs the exam and issues the credential, and LUNARTECH is independent of Linux Foundation.
A mesh moves networking concerns out of application code. You see the problems it addresses, how the control plane configures proxies in the data plane, and where Istio sits among alternatives.
- Service-to-service problems a mesh solves
- Control plane and data plane
- istiod and Envoy proxies
- Sidecars and the ambient alternative
- What a mesh costs: latency, resources and complexity
- When not to use a mesh
You build A short decision memo on whether a sample application should adopt a mesh, with costs and gains.
Install and verify a mesh on a cluster. You compare istioctl and Helm, choose a profile, enable injection for a namespace, deploy a sample application and confirm that traffic flows through the proxies.
- Preparing a cluster and checking prerequisites
- Installing with istioctl and profiles
- Installing with Helm charts
- Enabling sidecar injection by namespace
- Deploying a sample application
- Verifying the installation
You build Istio installed by two different methods, and a sample application running with sidecars.
Istio can place a proxy beside each workload or share one per node. You compare the two data plane modes, learn what ztunnel and waypoint proxies do, and decide which fits a workload.
- The sidecar model and its trade-offs
- Ambient mode: ztunnel and layer 4 security
- Waypoint proxies and layer 7 features
- Adding workloads to the mesh in each mode
- Mixing modes in one cluster
- Choosing a mode for a workload
You build The same application run in sidecar and ambient modes, with a comparison of resources and features.
A mesh must be tuned and kept current. You change mesh-wide settings, customize an installation, and upgrade by canary revision or in place, with a way back if something breaks.
- Mesh configuration and installation overrides
- Customizing proxies and the control plane
- Revisions and revision tags
- Canary upgrade of the control plane
- In-place upgrade and rollback
- Upgrading the data plane
You build A canary upgrade of the control plane that moves one namespace at a time, with a tested rollback.
Traffic enters through gateways and is steered by routing rules. You expose a service with a Gateway and a VirtualService, define subsets with DestinationRules, and meet the Kubernetes Gateway API as an alternative.
- Ingress gateways
- The Gateway resource and hosts
- VirtualServices: matching and routing
- DestinationRules and subsets
- Routing by header, path and weight
- The Kubernetes Gateway API in Istio
You build An application exposed through a gateway with path- and header-based routing to two versions.
Releases and integrations both depend on controlling where traffic goes. You shift traffic gradually between versions, mirror traffic for testing, and control calls to services outside the mesh.
- Weighted routing for canary releases
- Mirroring traffic to a test version
- ServiceEntry for external services
- Egress gateways
- Outbound traffic policy
- Observing the traffic split in metrics
You build A canary release that moves traffic from one version to another, with an egress rule for one external API.
Networks fail, and a mesh can help applications cope. You set timeouts and retries, limit connections and eject unhealthy endpoints, and inject delays and errors to prove the system holds up.
- Timeouts and where they apply
- Retries, per-try timeouts and retry conditions
- Connection pool limits and circuit breaking
- Outlier detection and ejecting bad endpoints
- Fault injection: delays and aborts
- Testing resilience safely
You build A resilience policy for a dependent service, proven by injected delays and errors.
Identity is the base of mesh security. You see how workloads receive certificates, enforce mutual TLS with PeerAuthentication, and validate end-user tokens with RequestAuthentication.
- Workload identity and certificates from istiod
- PeerAuthentication: permissive and strict
- Migrating a mesh to strict mTLS
- RequestAuthentication and JWT validation
- Verifying that mTLS is really in use
- Certificate rotation in outline
You build A namespace moved from permissive to strict mTLS, with JWT validation on one service.
Knowing who is calling is only half the job. You write authorization policies that allow, deny and require conditions, start from default deny, and terminate and originate TLS at the gateway.
- AuthorizationPolicy: allow, deny and custom actions
- Sources, operations and conditions
- Default deny and building up from it
- Policies using JWT claims
- TLS and mutual TLS at the ingress gateway
- Managing gateway certificates
You build A default-deny policy set with specific allows, and an ingress gateway serving HTTPS with a managed certificate.
When traffic misbehaves, the fault lies in configuration, the control plane or the proxies. You use istioctl to analyze configuration and inspect proxy state, and read logs from both planes.
- istioctl analyze and validation
- Proxy status and proxy configuration
- Reading Envoy access logs
- Control plane logs and health
- Common faults: port names, injection, host mismatch
- A method for isolating where a request fails
You build A troubleshooting log for several planted faults, each traced to its cause and fixed.
Run a small application on Istio from install to release. You expose it, shift traffic to a new version, add resilience and security, and then diagnose faults that were planted in the configuration.
- Installing and onboarding the application
- Exposing it and routing traffic
- Releasing a new version gradually
- Adding resilience and zero-trust policy
- Diagnosing planted faults
You build A secured, observable application on Istio with a canary release and a troubleshooting write-up.
Issued by
Certifying body · Independent of LUNARTECH
Linux Foundation
The Linux Foundation is a nonprofit that hosts open source projects, including Linux and Kubernetes. It runs the certification program itself, with online, proctored exams. Every certification in this list is valid for two years. LUNARTECH is independent of the Linux Foundation.
How you get there
Top-tier roles go to people who can do the work.
Top-tier roles go to people who can do the work.
Here’s how you get there.
Know where you start.
The Linux Foundation lists no prerequisites for this exam.
Work through the course.
Eleven modules, designed by LUNARTECH, at your own pace.
Sit it with Linux Foundation.
Linux Foundation runs the exam and issues the credential, so you register and book directly with them.
Support
Support at every stage.
Support at every stage.
You won’t be working through this alone.
Before you start
Try it first.
A 3-day free trial opens a selection of the content. Your card is only charged once it ends.
While you learn
Mentors within reach.
Stuck on a concept? Reach out to a mentor whenever you need help.
While you learn
One-on-one sessions.
On the yearly plan, one-on-one sessions give you dedicated support.
Any time
A team behind you.
Write to info@lunartech.ai at any point, from your trial onwards. If your employer is funding you, we’ll set it up with them directly.
All the way through
A schedule that fits around your life.
Your own paceFrom anywhereAt any hour
After the last lesson
Stay in the network.
Your alumni network stays with you: ongoing support, opportunities and industry insight.
Career support
Career support, past the last lesson. Coaching, a sharper resume, real interview preparation and the people to know.
Career direction
Tailored coaching helps you decide where to aim and how to get there.
Strong portfolio
Hands-on projects become work you can show, not just claim.
Resume and profile
Personalized refinement, so what you send says what you can actually do.
Interview preparation
Preparation for the questions that decide it, so you walk in ready.
Network and search
Connections with industry leaders, and an alumni network that stays with you.
Reviews
Real stories from the community.
LUNARTECH Academy has been the most empowering learning experience of my life, giving me a clear, structured path from the absolute basics to building real-world AI systems with confidence.
Your page is fantastic. As a bachelor’s student in Data Science now accepted for a master’s at UConn, your work has been a real source of motivation.
The programme’s clear, bite-sized content and practical projects dramatically improved my speed from fuzzy idea to MVP and my ability to communicate AI value. I followed the system, and it works.
I really appreciate your teaching style and the way you break down complex topics. It has been incredibly helpful.
After years working mainly with R for econometrics, I found your Python machine learning course a refreshing and engaging way to learn Python.
As a Data Science graduate, I want to thank you for the effort you put into making videos to support growing data scientists.
I’ve been following your work since taking your machine learning course, and I’m impressed by your practical approach to applying AI.
Why choose us
Built around how you actually learn.
One standard behind every course, from the first lesson to long after the last.
Hands-on practice
Apply every idea to real problems, so it becomes something you have used, not only seen.
Industry-aligned curriculum
We keep courses current with the tools, techniques and skills the field asks for.
Flexible learning
Study at your own pace, from anywhere, at any hour.
Certificate of completion
Finish the course and earn a certificate that shows what you have learned.
Focus on your success
Personalized learning plans and support structures carry you through the hard parts.
Lifetime alumni network
Stay connected after you finish, with ongoing support, opportunities and industry insight.
Your certificate
It doesn’t raise its voice. Neither will you.
Finish a LUNARTECH course and its certificate is issued in your name, under our signature. Linux Foundation’s credential comes from Linux Foundation, when you pass its exam.
Certificate of completion
Your Name
ICA course
LUNARTECH RISE Academy
Pricing
This course comes with the membership.
This course comes with the membership.
So does everything else.
One membership opens every course, certification, workshop and masterclass in the Academy. Every plan starts with a 3-day free trial. You register and book the exam directly with Linux Foundation.
3 days free, then $29.97 a month. Your card is only charged once the trial ends.
Included in every plan
- Every course in the Academy
- Every certification course
- Workshops and masterclasses
- A certificate of completion
- A 3-day free trial
- Learning at your own pace
- The lifetime alumni network
- Upgrades at any time
In practice
Seven roles.
Seven roles.
One credential across them all.
No single job owns it. Here’s where each role leans hardest, and where its work ends up.
- 01Installation
- 02Traffic
- 03Security
- 04Troubleshooting
-
A mesh puts retries and mTLS in one place. You still debug it when it misbehaves.
Installation, Traffic, Troubleshooting
Microservice platforms, Platform teams
-
mTLS between services is a policy decision. Istio makes it enforceable.
Security, Troubleshooting
Regulated industries, Large Kubernetes estates
-
Retries and timeouts can turn a blip into an outage. Traffic and troubleshooting tasks teach the limits.
Traffic, Troubleshooting
Microservice platforms, Large Kubernetes estates
-
Shifting traffic to a new version should be a config change. Traffic management is 35% of the exam.
Installation, Traffic
Platform teams, Microservice platforms
-
A mesh adds a proxy hop to every call. You need to trace it like any other path.
Traffic, Troubleshooting
Large Kubernetes estates, Platform teams
-
Mesh or no mesh is an architecture decision. Traffic and security features set the benefit.
Traffic, Security
Regulated industries, Microservice platforms
-
Fault injection shows how your service copes with failure. Istio lets you test it without touching the code.
Traffic
Microservice platforms, Platform teams
- Microservice platforms
- Platform teams
- Regulated industries
- Large Kubernetes estates
Cloud & Platform Engineer
A mesh puts retries and mTLS in one place. You still debug it when it misbehaves.
Over 10,000 students trust LUNARTECH
LUNARTECH gives you the skills
to learn, build, create and lead.
Engineers
Understand systems all the way down. Build the ones others rely on.
Scientists
Understand what the data says. Build models that hold up.
Researchers
Understand the papers. Build on them, and take the work further.
The field
Anyone can use AI.
Anyone can use AI.
Few can engineer it. This is where that starts.
+340%growth in open roles requiring AI skills
Roles and pay
~35,000 open roles right now
Open roles: Built In, Greenhouse, LinkedIn.
Typical salaries: Glassdoor, Levels.fyi, Payscale, Indeed, Ravio, JobRise, U.S. BLS. Military: 2026 U.S. basic pay, drone officers with aviation incentive pay.
Updated November 2026.
FAQ
Frequently asked questions.
Need help? These answers cover most of what people ask before they start.
No. Linux Foundation issues it. LUNARTECH is independent of Linux Foundation, and its names and marks belong to it. When you finish a course of ours, you earn a LUNARTECH certificate of completion for that course.
No. We design this course ourselves, around what the exam covers. Linux Foundation has no part in it, and you still register and book the exam directly with Linux Foundation.
120 minutes, online, proctored.
The Linux Foundation lists no prerequisites for this exam.
2 years.
We last reviewed it on 5 November 2026, from Linux Foundation’s own pages. Details change, so check the official page before you book.
Our 3-day free trial gives you access to a selection of content in the bootcamps, courses and materials, so you can experience the value of our content first-hand. This includes comprehensive learning materials and interactive sessions. You won’t be charged during this period, though we require your credit card details at the start to ensure a seamless transition should you choose to continue.
Yes, entering your credit card details is a necessary step to begin your free trial. The process is entirely secure, and we ask for it to provide a seamless transition to a paid subscription if you decide to continue beyond the trial. You will only be charged after the trial period ends, with full access to our content based on the plan you choose.
After your 3-day free trial you gain access to the full breadth of our content, depending on the subscription plan you choose. We offer free trials for our monthly, bi-annual and annual plans, and each plan provides a different scope of access and benefits.
If your employer has agreed to fund your learning, in part or in full, please contact us at info@lunartech.ai. We’ll work with you and your employer to set up everything needed for your subscription.
Yes. Our support remains strong both during your free trial and after you subscribe. Reach the team at info@lunartech.ai with any question, whether you’re onboarding, navigating your trial, or need help as a member. Subscribers to the yearly plan also receive dedicated support in one-on-one sessions.
You can upgrade your plan at any time during your subscription. Downgrading is not available for bi-annual or annual plans, but you can cancel and then choose a new plan that suits you better. For bi-annual and annual plans we also offer payment in instalments; please reach out to learn more.
The course
Build the skills behind ICA.
Show you can install, route, secure and debug an Istio service mesh. Start with a free trial, or enroll in a plan and work through the course at your own pace. Linux Foundation runs the exam and issues the credential.
LUNARTECH is independent of the vendors and certifying bodies listed here. Their names, exam titles and marks belong to them, exams are run by them, and credentials are issued by them. Reviewed 5 November 2026. Catalogues change often, so confirm the details on the official page before you book.
