implementing-service-mesh

Name: implementing-service-mesh
Author: ancoleman

41installs59forks

How to install implementing-service-mesh?

ancoleman/ai-design-components/implementing-service-mesh

$npx -y skills add ancoleman/ai-design-components --skill implementing-service-mesh

Installs into the current project.

Summary

Implement production-ready service mesh deployments with Istio, Linkerd, or Cilium. Configure mTLS, authorization policies, traffic routing, and progressive delivery patterns for secure, observable microservices. Use when setting up service-to-service communication, implementing

Files · 1

View on GitHub

SKILL.md

1	# Service Mesh Implementation
2
3	## Purpose
4
5	Configure and deploy service mesh infrastructure for Kubernetes environments. Enable secure service-to-service communication with mutual TLS, implement traffic management policies, configure authorization controls, and set up progressive delivery strategies. Abstracts network complexity while providing observability, security, and resilience for microservices.
6
7	## When to Use
8
9	Invoke this skill when:
10
11	- "Set up service mesh with mTLS"
12	- "Configure Istio traffic routing"
13	- "Implement canary deployments"
14	- "Secure microservices communication"
15	- "Add authorization policies to services"
16	- "Traffic splitting between versions"
17	- "Multi-cluster service mesh setup"
18	- "Configure ambient mode vs sidecar"
19	- "Set up circuit breaker configuration"
20	- "Enable distributed tracing"
21
22	## Service Mesh Selection
23
24	Choose based on requirements and constraints.
25
26	Istio Ambient (Recommended for most):
27	- 8% latency overhead with mTLS (vs 166% sidecar mode)
28	- Enterprise features, multi-cloud, advanced L7 routing
29	- Sidecar-less L4 (ztunnel) + optional L7 (waypoint)
30
31	Linkerd (Simplicity priority):
32	- 33% latency overhead (lowest sidecar)
33	- Rust-based micro-proxy, automatic mTLS
34	- Best for small-medium teams, easy adoption
35
36	Cilium (eBPF-native):
37	- 99% latency overhead, kernel-level enforcement
38	- Advanced networking, sidecar-less by design
39	- Best for eBPF infrastructure, future-proof
40
41	For detailed comparison matrix and architecture trade-offs, see `references/decision-tree.md`.
42
43	## Core Concepts
44
45	### Data Plane Architectures
46
47	Sidecar: Proxy per pod, fine-grained L7 control, higher overhead
48	Sidecar-less: Shared node proxies (Istio Ambient) or eBPF (Cilium), lower overhead
49
50	Istio Ambient Components:
51	- ztunnel: Per-node L4 proxy for mTLS
52	- waypoint: Optional per-namespace L7 proxy for HTTP routing
53
54	### Traffic Management
55
56	Routing: Path, header, weight-based traffic distribution
57	Resilience: Retries, timeouts, circuit breakers, fault injection
58	Load Balancing: Round robin, least connections, consistent hash
59
60	### Security Model
61
62	mTLS: Automatic encryption, certificate rotation, zero app changes
63	Modes: STRICT (reject plaintext), PERMISSIVE (accept both)
64	Authorization: Default-deny, identity-based (not IP), L7 policies
65
66	## Istio Configuration
67
68	Istio uses Custom Resource Definitions for traffic management and security.
69
70	### VirtualService (Routing)
71
72	```yaml
73	apiVersion: networking.istio.io/v1
74	kind: VirtualService
75	metadata:
76	name: backend-canary
77	spec:
78	hosts:
79	- backend
80	http:
81	- route:
82	- destination:
83	host: backend
84	subset: v1
85	weight: 90
86	- destination:
87	host: backend
88	subset: v2
89	weight: 10
90	```
91
92	### DestinationRule (Traffic Policy)
93
94	```yaml
95	apiVersion: networking.istio.io/v1
96	kind: DestinationRule
97	metadata:
98	name: backend-circuit-breaker
99	spec:
100	host: backend
101	trafficPolicy:
102	connectionPool:
103	tcp:
104	maxConnections: 100
105	http:
106	http1MaxPendingRequests: 10
107	outlierDetection:
108	consecutiveErrors: 5
109	interval: 30s
110	baseEjectionTime: 30s
111	```
112
113	### PeerAuthentication (mTLS)
114
115	```yaml
116	apiVersion: security.istio.io/v1
117	kind: PeerAuthentication
118	metadata:
119	name: default
120	namespace: istio-system
121	spec:
122	mtls:
123	mode: STRICT
124	```
125
126	### AuthorizationPolicy (Access Control)
127
128	```yaml
129	apiVersion: security.istio.io/v1
130	kind: AuthorizationPolicy
131	metadata:
132	name: allow-frontend
133	namespace: production
134	spec:
135	selector:
136	matchLabels:
137	app: backend
138	action: ALLOW
139	rules:
140	- from:
141	- source:
142	principals:
143	- cluster.local/ns/production/sa/frontend
144	to:
145	- operation:
146	methods: ["GET", "POST"]
147	paths: ["/api/*"]
148	```
149
150	For advanced patterns (fault injection, mirroring, gateways), see `references/istio-patterns.md`.
151
152	## Linkerd Configuration
153
154	Linkerd emphasizes simplicity with automatic mTLS.
155
156	### HTTPRoute (Traffic Splitting)
157
158	```yaml
159	apiVersion: policy.linkerd.io/v1beta2
160	kind: HTTPRoute
161	metadata:
162	name: backend-canary
163	spec:
164	parentRefs:
165	- name: backend
166	kind: Service
167	rules:
168	- backendRefs:
169	- name: backend-v1
170	port: 8080
171	weight: 90
172	- name: backend-v2
173	port: 8080
174	weight: 10
175	```
176
177	### ServiceProfile (Retries/Timeouts)
178
179	```yaml
180	apiVersion: linkerd.io/v1alpha2
181	kind: ServiceProfile
182	metadata:
183	name: backend.production.svc.cluster.local
184	spec:
185	routes:
186	- name: GET /api/data
187	condition:
188	method: GET
189	pathRegex: /api/data
190	timeout: 3s
191	retryBudget:
192	retryRatio: 0.2
193	minRetriesPerSecond: 10
194	```
195
196	### Authoriz

People who liked this also viewed

6 picks

Type

implementing-service-mesh

41installs59forks

View on GitHub

How to install implementing-service-mesh?

ancoleman/ai-design-components/implementing-service-mesh

$npx -y skills add ancoleman/ai-design-components --skill implementing-service-mesh

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Service Mesh Implementation
2
3	## Purpose
4
5	Configure and deploy service mesh infrastructure for Kubernetes environments. Enable secure service-to-service communication with mutual TLS, implement traffic management policies, configure authorization controls, and set up progressive delivery strategies. Abstracts network complexity while providing observability, security, and resilience for microservices.
6
7	## When to Use
8
9	Invoke this skill when:
10
11	- "Set up service mesh with mTLS"
12	- "Configure Istio traffic routing"
13	- "Implement canary deployments"
14	- "Secure microservices communication"
15	- "Add authorization policies to services"
16	- "Traffic splitting between versions"
17	- "Multi-cluster service mesh setup"
18	- "Configure ambient mode vs sidecar"
19	- "Set up circuit breaker configuration"
20	- "Enable distributed tracing"
21
22	## Service Mesh Selection
23
24	Choose based on requirements and constraints.
25
26	Istio Ambient (Recommended for most):
27	- 8% latency overhead with mTLS (vs 166% sidecar mode)
28	- Enterprise features, multi-cloud, advanced L7 routing
29	- Sidecar-less L4 (ztunnel) + optional L7 (waypoint)
30
31	Linkerd (Simplicity priority):
32	- 33% latency overhead (lowest sidecar)
33	- Rust-based micro-proxy, automatic mTLS
34	- Best for small-medium teams, easy adoption
35
36	Cilium (eBPF-native):
37	- 99% latency overhead, kernel-level enforcement
38	- Advanced networking, sidecar-less by design
39	- Best for eBPF infrastructure, future-proof
40
41	For detailed comparison matrix and architecture trade-offs, see `references/decision-tree.md`.
42
43	## Core Concepts
44
45	### Data Plane Architectures
46
47	Sidecar: Proxy per pod, fine-grained L7 control, higher overhead
48	Sidecar-less: Shared node proxies (Istio Ambient) or eBPF (Cilium), lower overhead
49
50	Istio Ambient Components:
51	- ztunnel: Per-node L4 proxy for mTLS
52	- waypoint: Optional per-namespace L7 proxy for HTTP routing
53
54	### Traffic Management
55
56	Routing: Path, header, weight-based traffic distribution
57	Resilience: Retries, timeouts, circuit breakers, fault injection
58	Load Balancing: Round robin, least connections, consistent hash
59
60	### Security Model
61
62	mTLS: Automatic encryption, certificate rotation, zero app changes
63	Modes: STRICT (reject plaintext), PERMISSIVE (accept both)
64	Authorization: Default-deny, identity-based (not IP), L7 policies
65
66	## Istio Configuration
67
68	Istio uses Custom Resource Definitions for traffic management and security.
69
70	### VirtualService (Routing)
71
72	```yaml
73	apiVersion: networking.istio.io/v1
74	kind: VirtualService
75	metadata:
76	name: backend-canary
77	spec:
78	hosts:
79	- backend
80	http:
81	- route:
82	- destination:
83	host: backend
84	subset: v1
85	weight: 90
86	- destination:
87	host: backend
88	subset: v2
89	weight: 10
90	```
91
92	### DestinationRule (Traffic Policy)
93
94	```yaml
95	apiVersion: networking.istio.io/v1
96	kind: DestinationRule
97	metadata:
98	name: backend-circuit-breaker
99	spec:
100	host: backend
101	trafficPolicy:
102	connectionPool:
103	tcp:
104	maxConnections: 100
105	http:
106	http1MaxPendingRequests: 10
107	outlierDetection:
108	consecutiveErrors: 5
109	interval: 30s
110	baseEjectionTime: 30s
111	```
112
113	### PeerAuthentication (mTLS)
114
115	```yaml
116	apiVersion: security.istio.io/v1
117	kind: PeerAuthentication
118	metadata:
119	name: default
120	namespace: istio-system
121	spec:
122	mtls:
123	mode: STRICT
124	```
125
126	### AuthorizationPolicy (Access Control)
127
128	```yaml
129	apiVersion: security.istio.io/v1
130	kind: AuthorizationPolicy
131	metadata:
132	name: allow-frontend
133	namespace: production
134	spec:
135	selector:
136	matchLabels:
137	app: backend
138	action: ALLOW
139	rules:
140	- from:
141	- source:
142	principals:
143	- cluster.local/ns/production/sa/frontend
144	to:
145	- operation:
146	methods: ["GET", "POST"]
147	paths: ["/api/*"]
148	```
149
150	For advanced patterns (fault injection, mirroring, gateways), see `references/istio-patterns.md`.
151
152	## Linkerd Configuration
153
154	Linkerd emphasizes simplicity with automatic mTLS.
155
156	### HTTPRoute (Traffic Splitting)
157
158	```yaml
159	apiVersion: policy.linkerd.io/v1beta2
160	kind: HTTPRoute
161	metadata:
162	name: backend-canary
163	spec:
164	parentRefs:
165	- name: backend
166	kind: Service
167	rules:
168	- backendRefs:
169	- name: backend-v1
170	port: 8080
171	weight: 90
172	- name: backend-v2
173	port: 8080
174	weight: 10
175	```
176
177	### ServiceProfile (Retries/Timeouts)
178
179	```yaml
180	apiVersion: linkerd.io/v1alpha2
181	kind: ServiceProfile
182	metadata:
183	name: backend.production.svc.cluster.local
184	spec:
185	routes:
186	- name: GET /api/data
187	condition:
188	method: GET
189	pathRegex: /api/data
190	timeout: 3s
191	retryBudget:
192	retryRatio: 0.2
193	minRetriesPerSecond: 10
194	```
195
196	### Authoriz

People who liked this also viewed

6 picks

Type