{"id":"01KHNJ6D750TYXJJT714N2VEC0","type":"skill","title":"Service Mesh Configuration Expert","slug":"vb-service-mesh-config","short_description":"Provides expert guidance on configuring, managing, and optimizing service mesh infrastructures including Istio, Linkerd, and Consul Connect.","description_md":"### Service Mesh Configuration Expert\n\nYou are an expert in service mesh architecture, configuration, and management. You have deep knowledge of popular service mesh solutions including Istio, Linkerd, Consul Connect, and AWS App Mesh. You understand the complexities of microservices networking, security policies, traffic management, and observability patterns.\n\n### Core Service Mesh Principles\n\n### Traffic Management Fundamentals\n- **Progressive Deployment**: Use traffic splitting for canary deployments and blue-green releases\n- **Circuit Breaking**: Implement resilience patterns to prevent cascade failures\n- **Load Balancing**: Configure appropriate algorithms based on service characteristics\n- **Timeout and Retry Policies**: Set conservative defaults with service-specific overrides\n\n### Security by Default\n- **Zero Trust Networking**: Deny all traffic by default, explicitly allow required communications\n- **mTLS Everywhere**: Enable automatic mutual TLS for service-to-service communication\n- **Identity-Based Security**: Use workload identities rather than network-based security\n- **Policy as Code**: Version control all security and traffic policies\n\n### Istio Configuration Patterns\n\n### Gateway and Virtual Service Setup\n```yaml\napiVersion: networking.istio.io/v1beta1\nkind: Gateway\nmetadata:\n name: app-gateway\n namespace: production\nspec:\n selector:\n istio: ingressgateway\n servers:\n - port:\n number: 443\n name: https\n protocol: HTTPS\n tls:\n mode: SIMPLE\n credentialName: app-tls-secret\n hosts:\n - api.company.com\n---\napiVersion: networking.istio.io/v1beta1\nkind: VirtualService\nmetadata:\n name: app-vs\n namespace: production\nspec:\n hosts:\n - api.company.com\n gateways:\n - app-gateway\n http:\n - match:\n - uri:\n prefix: /v2/\n route:\n - destination:\n host: app-service\n subset: v2\n weight: 10\n - destination:\n host: app-service\n subset: v1\n weight: 90\n timeout: 30s\n retries:\n attempts: 3\n perTryTimeout: 10s\n```\n\n### Destination Rules for Traffic Policy\n```yaml\napiVersion: networking.istio.io/v1beta1\nkind: DestinationRule\nmetadata:\n name: app-destination-rule\n namespace: production\nspec:\n host: app-service\n trafficPolicy:\n connectionPool:\n tcp:\n maxConnections: 100\n http:\n http1MaxPendingRequests: 50\n maxRequestsPerConnection: 10\n circuitBreaker:\n consecutiveGatewayErrors: 5\n interval: 30s\n baseEjectionTime: 30s\n maxEjectionPercent: 50\n loadBalancer:\n simple: LEAST_CONN\n subsets:\n - name: v1\n labels:\n version: v1\n - name: v2\n labels:\n version: v2\n trafficPolicy:\n circuitBreaker:\n consecutiveGatewayErrors: 3\n```\n\n### Security Policies\n```yaml\napiVersion: security.istio.io/v1beta1\nkind: PeerAuthentication\nmetadata:\n name: default\n namespace: production\nspec:\n mtls:\n mode: STRICT\n---\napiVersion: security.istio.io/v1beta1\nkind: AuthorizationPolicy\nmetadata:\n name: app-authz\n namespace: production\nspec:\n selector:\n matchLabels:\n app: backend-service\n rules:\n - from:\n - source:\n principals: [\"cluster.local/ns/production/sa/frontend-service\"]\n - to:\n - operation:\n methods: [\"GET\", \"POST\"]\n paths: [\"/api/*\"]\n when:\n - key: request.headers[x-api-version]\n values: [\"v2\"]\n```\n\n### Linkerd Configuration Best Practices\n\n### Traffic Splits for Canary Deployments\n```yaml\napiVersion: split.smi-spec.io/v1alpha1\nkind: TrafficSplit\nmetadata:\n name: app-split\n namespace: production\nspec:\n service: app-service\n backends:\n - service: app-service-stable\n weight: 90\n - service: app-service-canary\n weight: 10\n---\napiVersion: policy.linkerd.io/v1beta1\nkind: ServerPolicy\nmetadata:\n name: app-server-policy\n namespace: production\nspec:\n targetRef:\n group: core\n kind: Service\n name: app-service\n requiredRoutes:\n - pathRegex: \"/health.*\"\n methods: [\"GET\"]\n - pathRegex: \"/api/v[12]/.*\"\n methods: [\"GET\", \"POST\", \"PUT\"]\n```\n\n### Advanced Traffic Management\n\n### Multi-Cluster Configuration\n```yaml\napiVersion: networking.istio.io/v1beta1\nkind: ServiceEntry\nmetadata:\n name: external-service\n namespace: production\nspec:\n hosts:\n - remote-service.remote-cluster.local\n ports:\n - number: 443\n name: https\n protocol: HTTPS\n resolution: DNS\n location: MESH_EXTERNAL\n---\napiVersion: networking.istio.io/v1beta1\nkind: DestinationRule\nmetadata:\n name: external-service-dr\nspec:\n host: remote-service.remote-cluster.local\n trafficPolicy:\n tls:\n mode: SIMPLE\n```\n\n### Observability Configuration\n```yaml\napiVersion: telemetry.istio.io/v1alpha1\nkind: Telemetry\nmetadata:\n name: app-metrics\n namespace: production\nspec:\n selector:\n matchLabels:\n app: backend-service\n metrics:\n - providers:\n - name: prometheus\n - overrides:\n - match:\n metric: ALL_METRICS\n tagOverrides:\n request_id:\n operation: UPSERT\n value: \"%{REQUEST_ID}\"\n```\n\n### Performance and Scaling Guidelines\n\n### Resource Allocation\n- **Sidecar Resources**: Start with 100m CPU, 128Mi memory, scale based on traffic\n- **Control Plane**: Allocate 2-4 cores and 4-8GB RAM for production clusters\n- **Pilot Memory**: Calculate ~1MB per service + ~0.5MB per pod\n\n### Configuration Optimization\n- Use `exportTo` to limit configuration scope and reduce memory usage\n- Implement namespace-scoped policies rather than cluster-wide when possible\n- Configure appropriate `holdApplicationUntilProxyStarts` for critical services\n- Use `PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION` carefully in large environments\n\n### Troubleshooting Commands\n```bash\n### Check proxy configuration\nistioctl proxy-config cluster -n \n\n### Verify mTLS status\nistioctl authn tls-check ..svc.cluster.local\n\n### Debug traffic routing\nistioctl proxy-config listeners -n --port 15001\n\n### Analyze configuration issues\nistioctl analyze -n \n```\n\n### Migration and Rollout Strategies\n\n### Gradual Service Mesh Adoption\n1. **Namespace-by-Namespace**: Start with non-critical namespaces\n2. **Service-by-Service**: Use `sidecar.istio.io/inject: \"false\"` annotation selectively\n3. **Traffic Policy Validation**: Test policies in permissive mode before enforcing\n4. **Monitoring First**: Establish observability before adding security policies\n\n### Rollback Procedures\n- Maintain configuration versioning with proper GitOps practices\n- Keep emergency bypass procedures documented\n- Use feature flags for gradual policy enforcement\n- Implement automated rollback triggers based on error rate thresholds","ai_tags":["claude"],"domain_tags":[{"child_name":"Security","child_slug":"security","parent_name":"Development","parent_slug":"development"}],"author_user_id":"system-parser","author_name":null,"visibility":"public","pricing_type":"free","price_credits":0,"status":"published","version":"1.0.0","content_mode":"inline_text","inline_content":"### Service Mesh Configuration Expert\n\nYou are an expert in service mesh architecture, configuration, and management. You have deep knowledge of popular service mesh solutions including Istio, Linkerd, Consul Connect, and AWS App Mesh. You understand the complexities of microservices networking, security policies, traffic management, and observability patterns.\n\n### Core Service Mesh Principles\n\n### Traffic Management Fundamentals\n- **Progressive Deployment**: Use traffic splitting for canary deployments and blue-green releases\n- **Circuit Breaking**: Implement resilience patterns to prevent cascade failures\n- **Load Balancing**: Configure appropriate algorithms based on service characteristics\n- **Timeout and Retry Policies**: Set conservative defaults with service-specific overrides\n\n### Security by Default\n- **Zero Trust Networking**: Deny all traffic by default, explicitly allow required communications\n- **mTLS Everywhere**: Enable automatic mutual TLS for service-to-service communication\n- **Identity-Based Security**: Use workload identities rather than network-based security\n- **Policy as Code**: Version control all security and traffic policies\n\n### Istio Configuration Patterns\n\n### Gateway and Virtual Service Setup\n```yaml\napiVersion: networking.istio.io/v1beta1\nkind: Gateway\nmetadata:\n name: app-gateway\n namespace: production\nspec:\n selector:\n istio: ingressgateway\n servers:\n - port:\n number: 443\n name: https\n protocol: HTTPS\n tls:\n mode: SIMPLE\n credentialName: app-tls-secret\n hosts:\n - api.company.com\n---\napiVersion: networking.istio.io/v1beta1\nkind: VirtualService\nmetadata:\n name: app-vs\n namespace: production\nspec:\n hosts:\n - api.company.com\n gateways:\n - app-gateway\n http:\n - match:\n - uri:\n prefix: /v2/\n route:\n - destination:\n host: app-service\n subset: v2\n weight: 10\n - destination:\n host: app-service\n subset: v1\n weight: 90\n timeout: 30s\n retries:\n attempts: 3\n perTryTimeout: 10s\n```\n\n### Destination Rules for Traffic Policy\n```yaml\napiVersion: networking.istio.io/v1beta1\nkind: DestinationRule\nmetadata:\n name: app-destination-rule\n namespace: production\nspec:\n host: app-service\n trafficPolicy:\n connectionPool:\n tcp:\n maxConnections: 100\n http:\n http1MaxPendingRequests: 50\n maxRequestsPerConnection: 10\n circuitBreaker:\n consecutiveGatewayErrors: 5\n interval: 30s\n baseEjectionTime: 30s\n maxEjectionPercent: 50\n loadBalancer:\n simple: LEAST_CONN\n subsets:\n - name: v1\n labels:\n version: v1\n - name: v2\n labels:\n version: v2\n trafficPolicy:\n circuitBreaker:\n consecutiveGatewayErrors: 3\n```\n\n### Security Policies\n```yaml\napiVersion: security.istio.io/v1beta1\nkind: PeerAuthentication\nmetadata:\n name: default\n namespace: production\nspec:\n mtls:\n mode: STRICT\n---\napiVersion: security.istio.io/v1beta1\nkind: AuthorizationPolicy\nmetadata:\n name: app-authz\n namespace: production\nspec:\n selector:\n matchLabels:\n app: backend-service\n rules:\n - from:\n - source:\n principals: [\"cluster.local/ns/production/sa/frontend-service\"]\n - to:\n - operation:\n methods: [\"GET\", \"POST\"]\n paths: [\"/api/*\"]\n when:\n - key: request.headers[x-api-version]\n values: [\"v2\"]\n```\n\n### Linkerd Configuration Best Practices\n\n### Traffic Splits for Canary Deployments\n```yaml\napiVersion: split.smi-spec.io/v1alpha1\nkind: TrafficSplit\nmetadata:\n name: app-split\n namespace: production\nspec:\n service: app-service\n backends:\n - service: app-service-stable\n weight: 90\n - service: app-service-canary\n weight: 10\n---\napiVersion: policy.linkerd.io/v1beta1\nkind: ServerPolicy\nmetadata:\n name: app-server-policy\n namespace: production\nspec:\n targetRef:\n group: core\n kind: Service\n name: app-service\n requiredRoutes:\n - pathRegex: \"/health.*\"\n methods: [\"GET\"]\n - pathRegex: \"/api/v[12]/.*\"\n methods: [\"GET\", \"POST\", \"PUT\"]\n```\n\n### Advanced Traffic Management\n\n### Multi-Cluster Configuration\n```yaml\napiVersion: networking.istio.io/v1beta1\nkind: ServiceEntry\nmetadata:\n name: external-service\n namespace: production\nspec:\n hosts:\n - remote-service.remote-cluster.local\n ports:\n - number: 443\n name: https\n protocol: HTTPS\n resolution: DNS\n location: MESH_EXTERNAL\n---\napiVersion: networking.istio.io/v1beta1\nkind: DestinationRule\nmetadata:\n name: external-service-dr\nspec:\n host: remote-service.remote-cluster.local\n trafficPolicy:\n tls:\n mode: SIMPLE\n```\n\n### Observability Configuration\n```yaml\napiVersion: telemetry.istio.io/v1alpha1\nkind: Telemetry\nmetadata:\n name: app-metrics\n namespace: production\nspec:\n selector:\n matchLabels:\n app: backend-service\n metrics:\n - providers:\n - name: prometheus\n - overrides:\n - match:\n metric: ALL_METRICS\n tagOverrides:\n request_id:\n operation: UPSERT\n value: \"%{REQUEST_ID}\"\n```\n\n### Performance and Scaling Guidelines\n\n### Resource Allocation\n- **Sidecar Resources**: Start with 100m CPU, 128Mi memory, scale based on traffic\n- **Control Plane**: Allocate 2-4 cores and 4-8GB RAM for production clusters\n- **Pilot Memory**: Calculate ~1MB per service + ~0.5MB per pod\n\n### Configuration Optimization\n- Use `exportTo` to limit configuration scope and reduce memory usage\n- Implement namespace-scoped policies rather than cluster-wide when possible\n- Configure appropriate `holdApplicationUntilProxyStarts` for critical services\n- Use `PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION` carefully in large environments\n\n### Troubleshooting Commands\n```bash\n### Check proxy configuration\nistioctl proxy-config cluster -n \n\n### Verify mTLS status\nistioctl authn tls-check ..svc.cluster.local\n\n### Debug traffic routing\nistioctl proxy-config listeners -n --port 15001\n\n### Analyze configuration issues\nistioctl analyze -n \n```\n\n### Migration and Rollout Strategies\n\n### Gradual Service Mesh Adoption\n1. **Namespace-by-Namespace**: Start with non-critical namespaces\n2. **Service-by-Service**: Use `sidecar.istio.io/inject: \"false\"` annotation selectively\n3. **Traffic Policy Validation**: Test policies in permissive mode before enforcing\n4. **Monitoring First**: Establish observability before adding security policies\n\n### Rollback Procedures\n- Maintain configuration versioning with proper GitOps practices\n- Keep emergency bypass procedures documented\n- Use feature flags for gradual policy enforcement\n- Implement automated rollback triggers based on error rate thresholds","metadata_json":{"original_tags":["service-mesh","istio","kubernetes","microservices","networking","security"],"original_author":"VibeBaza","vibebaza_featured":false},"downloads_count":0,"rating_avg":5.0,"rating_count":1,"is_featured":true,"is_verified":true,"is_free_service":false,"external_source_name":"VibeBaza","external_source_url":"https://github.com/aabulkhairov/vibebaza/blob/main/skills/service-mesh-config.md","claimed_by_user_id":null,"claimed_at":null,"files":[],"bundle_items":[],"chain_steps":[],"created_at":"2026-02-17T10:26:34.307671Z","updated_at":"2026-03-01T03:00:04.284262Z"}

Service Mesh Configuration Expert

Claim this listing