linkerd-patterns

Name: linkerd-patterns
Author: wshobson

7.8kinstalls4.1kforks

How to install linkerd-patterns?

wshobson/agents/linkerd-patterns

$npx -y skills add wshobson/agents --skill linkerd-patterns

Installs into the current project.

Summary

Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

Files · 1

View on GitHub

SKILL.md

1	# Linkerd Patterns
2
3	Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.
4
5	## When to Use This Skill
6
7	- Setting up a lightweight service mesh
8	- Implementing automatic mTLS
9	- Configuring traffic splits for canary deployments
10	- Setting up service profiles for per-route metrics
11	- Implementing retries and timeouts
12	- Multi-cluster service mesh
13
14	## Core Concepts
15
16	### 1. Linkerd Architecture
17
18	```
19	┌─────────────────────────────────────────────┐
20	│ Control Plane │
21	│ ┌─────────┐ ┌──────────┐ ┌──────────────┐ │
22	│ │ destiny │ │ identity │ │ proxy-inject │ │
23	│ └─────────┘ └──────────┘ └──────────────┘ │
24	└─────────────────────────────────────────────┘
25	│
26	┌─────────────────────────────────────────────┐
27	│ Data Plane │
28	│ ┌─────┐ ┌─────┐ ┌─────┐ │
29	│ │proxy│────│proxy│────│proxy│ │
30	│ └─────┘ └─────┘ └─────┘ │
31	│ │ │ │ │
32	│ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ │
33	│ │ app │ │ app │ │ app │ │
34	│ └─────┘ └─────┘ └─────┘ │
35	└─────────────────────────────────────────────┘
36	```
37
38	### 2. Key Resources
39
40	\| Resource \| Purpose \|
41	\| ----------------------- \| ------------------------------------ \|
42	\| ServiceProfile \| Per-route metrics, retries, timeouts \|
43	\| TrafficSplit \| Canary deployments, A/B testing \|
44	\| Server \| Define server-side policies \|
45	\| ServerAuthorization \| Access control policies \|
46
47	## Templates
48
49	### Template 1: Mesh Installation
50
51	```bash
52	# Install CLI
53	curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install \| sh
54
55	# Validate cluster
56	linkerd check --pre
57
58	# Install CRDs
59	linkerd install --crds \| kubectl apply -f -
60
61	# Install control plane
62	linkerd install \| kubectl apply -f -
63
64	# Verify installation
65	linkerd check
66
67	# Install viz extension (optional)
68	linkerd viz install \| kubectl apply -f -
69	```
70
71	### Template 2: Inject Namespace
72
73	```yaml
74	# Automatic injection for namespace
75	apiVersion: v1
76	kind: Namespace
77	metadata:
78	name: my-app
79	annotations:
80	linkerd.io/inject: enabled
81	---
82	# Or inject specific deployment
83	apiVersion: apps/v1
84	kind: Deployment
85	metadata:
86	name: my-app
87	annotations:
88	linkerd.io/inject: enabled
89	spec:
90	template:
91	metadata:
92	annotations:
93	linkerd.io/inject: enabled
94	```
95
96	### Template 3: Service Profile with Retries
97
98	```yaml
99	apiVersion: linkerd.io/v1alpha2
100	kind: ServiceProfile
101	metadata:
102	name: my-service.my-namespace.svc.cluster.local
103	namespace: my-namespace
104	spec:
105	routes:
106	- name: GET /api/users
107	condition:
108	method: GET
109	pathRegex: /api/users
110	responseClasses:
111	- condition:
112	status:
113	min: 500
114	max: 599
115	isFailure: true
116	isRetryable: true
117	- name: POST /api/users
118	condition:
119	method: POST
120	pathRegex: /api/users
121	# POST not retryable by default
122	isRetryable: false
123	- name: GET /api/users/{id}
124	condition:
125	method: GET
126	pathRegex: /api/users/[^/]+
127	timeout: 5s
128	isRetryable: true
129	retryBudget:
130	retryRatio: 0.2
131	minRetriesPerSecond: 10
132	ttl: 10s
133	```
134
135	### Template 4: Traffic Split (Canary)
136
137	```yaml
138	apiVersion: split.smi-spec.io/v1alpha1
139	kind: TrafficSplit
140	metadata:
141	name: my-service-canary
142	namespace: my-namespace
143	spec:
144	service: my-service
145	backends:
146	- service: my-service-stable
147	weight: 900m # 90%
148	- service: my-service-canary
149	weight: 100m # 10%
150	```
151
152	### Template 5: Server Authorization Policy
153
154	```yaml
155	# Define the server
156	apiVersion: policy.linkerd.io/v1beta1
157	kind: Server
158	metadata:
159	name: my-service-http
160	namespace: my-namespace
161	spec:
162	podSelector:
163	matchLabels:
164	app: my-service
165	port: http
166	proxyProtocol: HTTP/1
167	---
168	# Allow traffic from specific clients
169	apiVersion: policy.linkerd.io/v1beta1
170	kind: ServerAuthorization
171	metadata:
172	name: allow-frontend
173	namespace: my-namespace
174	spec:
175	server:
176	name: my-service-http
177	client:
178	meshTLS:
179	serviceAccounts:
180	- name: frontend
181	namespace: my-namespace
182	---
183	# Allow unauthenticated traffic (e.g., from ingress)
184	apiVersion: policy.linkerd.io/v1beta1
185	kind: ServerAuthorization
186	metadata:
187	name: allow-ingress
188	namespace: my-namespace
189	spec:
190	server:
191	name: my-service-http
192	client:
193	unauthenticated: true
194	networks:
195	- cidr: 10.0.0.0/8
196	```
197
198	### Template 6: HTTPRoute for Advanced Routing
199
200	```yaml
201	apiVersion: policy.linkerd.io/v1beta2
202	kind: HTTPRoute
203	metadata:
204	name: my-route
205	namespace: my-namespace

People who liked this also viewed

6 picks

Type

linkerd-patterns

7.8kinstalls4.1kforks

View on GitHub

How to install linkerd-patterns?

wshobson/agents/linkerd-patterns

$npx -y skills add wshobson/agents --skill linkerd-patterns

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Linkerd Patterns
2
3	Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.
4
5	## When to Use This Skill
6
7	- Setting up a lightweight service mesh
8	- Implementing automatic mTLS
9	- Configuring traffic splits for canary deployments
10	- Setting up service profiles for per-route metrics
11	- Implementing retries and timeouts
12	- Multi-cluster service mesh
13
14	## Core Concepts
15
16	### 1. Linkerd Architecture
17
18	```
19	┌─────────────────────────────────────────────┐
20	│ Control Plane │
21	│ ┌─────────┐ ┌──────────┐ ┌──────────────┐ │
22	│ │ destiny │ │ identity │ │ proxy-inject │ │
23	│ └─────────┘ └──────────┘ └──────────────┘ │
24	└─────────────────────────────────────────────┘
25	│
26	┌─────────────────────────────────────────────┐
27	│ Data Plane │
28	│ ┌─────┐ ┌─────┐ ┌─────┐ │
29	│ │proxy│────│proxy│────│proxy│ │
30	│ └─────┘ └─────┘ └─────┘ │
31	│ │ │ │ │
32	│ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ │
33	│ │ app │ │ app │ │ app │ │
34	│ └─────┘ └─────┘ └─────┘ │
35	└─────────────────────────────────────────────┘
36	```
37
38	### 2. Key Resources
39
40	\| Resource \| Purpose \|
41	\| ----------------------- \| ------------------------------------ \|
42	\| ServiceProfile \| Per-route metrics, retries, timeouts \|
43	\| TrafficSplit \| Canary deployments, A/B testing \|
44	\| Server \| Define server-side policies \|
45	\| ServerAuthorization \| Access control policies \|
46
47	## Templates
48
49	### Template 1: Mesh Installation
50
51	```bash
52	# Install CLI
53	curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install \| sh
54
55	# Validate cluster
56	linkerd check --pre
57
58	# Install CRDs
59	linkerd install --crds \| kubectl apply -f -
60
61	# Install control plane
62	linkerd install \| kubectl apply -f -
63
64	# Verify installation
65	linkerd check
66
67	# Install viz extension (optional)
68	linkerd viz install \| kubectl apply -f -
69	```
70
71	### Template 2: Inject Namespace
72
73	```yaml
74	# Automatic injection for namespace
75	apiVersion: v1
76	kind: Namespace
77	metadata:
78	name: my-app
79	annotations:
80	linkerd.io/inject: enabled
81	---
82	# Or inject specific deployment
83	apiVersion: apps/v1
84	kind: Deployment
85	metadata:
86	name: my-app
87	annotations:
88	linkerd.io/inject: enabled
89	spec:
90	template:
91	metadata:
92	annotations:
93	linkerd.io/inject: enabled
94	```
95
96	### Template 3: Service Profile with Retries
97
98	```yaml
99	apiVersion: linkerd.io/v1alpha2
100	kind: ServiceProfile
101	metadata:
102	name: my-service.my-namespace.svc.cluster.local
103	namespace: my-namespace
104	spec:
105	routes:
106	- name: GET /api/users
107	condition:
108	method: GET
109	pathRegex: /api/users
110	responseClasses:
111	- condition:
112	status:
113	min: 500
114	max: 599
115	isFailure: true
116	isRetryable: true
117	- name: POST /api/users
118	condition:
119	method: POST
120	pathRegex: /api/users
121	# POST not retryable by default
122	isRetryable: false
123	- name: GET /api/users/{id}
124	condition:
125	method: GET
126	pathRegex: /api/users/[^/]+
127	timeout: 5s
128	isRetryable: true
129	retryBudget:
130	retryRatio: 0.2
131	minRetriesPerSecond: 10
132	ttl: 10s
133	```
134
135	### Template 4: Traffic Split (Canary)
136
137	```yaml
138	apiVersion: split.smi-spec.io/v1alpha1
139	kind: TrafficSplit
140	metadata:
141	name: my-service-canary
142	namespace: my-namespace
143	spec:
144	service: my-service
145	backends:
146	- service: my-service-stable
147	weight: 900m # 90%
148	- service: my-service-canary
149	weight: 100m # 10%
150	```
151
152	### Template 5: Server Authorization Policy
153
154	```yaml
155	# Define the server
156	apiVersion: policy.linkerd.io/v1beta1
157	kind: Server
158	metadata:
159	name: my-service-http
160	namespace: my-namespace
161	spec:
162	podSelector:
163	matchLabels:
164	app: my-service
165	port: http
166	proxyProtocol: HTTP/1
167	---
168	# Allow traffic from specific clients
169	apiVersion: policy.linkerd.io/v1beta1
170	kind: ServerAuthorization
171	metadata:
172	name: allow-frontend
173	namespace: my-namespace
174	spec:
175	server:
176	name: my-service-http
177	client:
178	meshTLS:
179	serviceAccounts:
180	- name: frontend
181	namespace: my-namespace
182	---
183	# Allow unauthenticated traffic (e.g., from ingress)
184	apiVersion: policy.linkerd.io/v1beta1
185	kind: ServerAuthorization
186	metadata:
187	name: allow-ingress
188	namespace: my-namespace
189	spec:
190	server:
191	name: my-service-http
192	client:
193	unauthenticated: true
194	networks:
195	- cidr: 10.0.0.0/8
196	```
197
198	### Template 6: HTTPRoute for Advanced Routing
199
200	```yaml
201	apiVersion: policy.linkerd.io/v1beta2
202	kind: HTTPRoute
203	metadata:
204	name: my-route
205	namespace: my-namespace

People who liked this also viewed

6 picks

Type