Skip to main content
This is the longest and most important module in the course. We’ll start with sidecars (the concept and the Sidecar CRD), review what happens by default when a sidecar is injected into a workload, then move into Istio traffic management with a focus on VirtualServices. VirtualServices are central to Istio: they control routing, retries, fault injection, mirroring, and more. Expect roughly 30–35% of the ICA exam questions to involve VirtualServices. Closely related are DestinationRules, which define subsets, load‑balancing behavior, connection‑pool settings, and circuit‑breaking policies—another high‑value topic for the exam. We’ll also cover how to expose services externally using Ingress Gateways and how to manage outbound traffic with Egress Gateways.
A slide titled "Objectives" with four numbered items. It lists learning goals about service mesh topics: sidecar resource configuration, routing with Virtual Services, subsets/load balancing using Destination Rules, and configuring Ingress/Egress Gateways.
What follows is a concise breakdown of the concrete skills and concepts you’ll gain in this module:
  • Sidecars and the Sidecar CRD: default behavior and scoped configurations
  • VirtualServices: routing rules, traffic splitting, retries, timeouts, and fault injection
  • DestinationRules: subsets, load balancing, connection pools, circuit breaking, and outlier detection
  • Gateways: exposing services via Ingress and managing outbound Egress traffic
We’ll also show how to bring external services (managed databases, external APIs) into the mesh with ServiceEntries, and compare common release strategies such as canary and blue/green. Traffic mirroring (shadowing) will be demonstrated as a safe way to validate new versions without affecting live users. Resilience and fault tolerance are covered in depth: circuit breaking, outlier detection, limiting connections/requests via DestinationRules and Envoy settings, and configuring retries and timeouts (usually set in VirtualServices) so transient failures don’t cascade. Fault injection techniques (delays and aborts) let you observe system behavior under controlled failures, while retries/timeouts and circuit breakers help harden your services.
A slide titled "Objectives" showing numbered colored markers and a vertical timeline. It lists objectives (05–08) about Istio/service-mesh topics: adding external services with ServiceEntries, release strategies like traffic mirroring/A-B testing, circuit breaking to prevent cascading failures, and focusing on fault tolerance.
We will finish with a high‑level introduction to ambient mode: how layer‑4 traffic is handled with ztunnels and how layer‑7 traffic can be supported via waypoint proxies and HTTPRoutes. Ambient mode internals and advanced HTTPRoute/EnvoyFilter topics are outside the ICA exam scope, so we’ll treat them at an overview level only.
TopicPurposeExam relevance
VirtualServiceConfigure request routing, retries, fault injection, mirroring, traffic splittingHigh (30–35% of ICA)
DestinationRuleDefine subsets, LB settings, connection pools, circuit breakingHigh
Gateway (Ingress/Egress)Expose services externally; manage outbound trafficHigh
ServiceEntryBring external services into the meshMedium
Fault injection, retries, timeoutsTest and increase resilienceHigh
Ambient mode (ztunnel/waypoint)Alternate model for L4/L7 traffic handlingLow (overview only)
This lesson targets the Istio resources and behaviors you need for the ICA certification: VirtualServices, DestinationRules, Gateways, ServiceEntry, fault injection, retries/timeouts, and circuit breaking. Ambient mode and advanced HTTPRoute/EnvoyFilter details are out‑of‑scope for the exam and will be covered only at a high level.
Links and references:

Watch Video