[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H5AB85VYTS6HC70M7VCVZ":3,"skill-same:01M71H5AB85VYTS6HC70M7VCVZ":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M71H5AB85VYTS6HC70M7VCVZ","implementing-service-mesh",null,"Implement production-ready service mesh deployments with Istio, Linkerd, or Cilium. Configure mTLS, authorization policies, traffic routing, and progressive delivery patterns for secure, observable microservices. Use when setting up service-to-service communication, implementing zero-trust security, or enabling canary deployments.","JSGforever\u002Fskillguard","JSGforever","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F85541948?v=4","01M71FQD3E132VMR5F4TAYX3YS","01M71FQD4DYW0XJ4XQ4YQH75Y9",2,"GPL-3.0","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"implementing service mesh","implementing","service mesh","service","mesh","canary","setting","patterns","security","secure","mtls","delivery","communication","zero-trust","configure","when","traffic","production-ready","up","ready","2026-11-10 10:12:30",false,"---\nname: implementing-service-mesh\ndescription: Implement production-ready service mesh deployments with Istio, Linkerd, or Cilium. Configure mTLS, authorization policies, traffic routing, and progressive delivery patterns for secure, observable microservices. Use when setting up service-to-service communication, implementing zero-trust security, or enabling canary deployments.\n---\n\n# Service Mesh Implementation\n\n## Purpose\n\nConfigure and deploy service mesh infrastructure for Kubernetes environments. Enable secure service-to-service communication with mutual TLS, implement traffic management policies, configure authorization controls, and set up progressive delivery strategies. Abstracts network complexity while providing observability, security, and resilience for microservices.\n\n## When to Use\n\nInvoke this skill when:\n\n- \"Set up service mesh with mTLS\"\n- \"Configure Istio traffic routing\"\n- \"Implement canary deployments\"\n- \"Secure microservices communication\"\n- \"Add authorization policies to services\"\n- \"Traffic splitting between versions\"\n- \"Multi-cluster service mesh setup\"\n- \"Configure ambient mode vs sidecar\"\n- \"Set up circuit breaker configuration\"\n- \"Enable distributed tracing\"\n\n## Service Mesh Selection\n\nChoose based on requirements and constraints.\n\n**Istio Ambient (Recommended for most):**\n- 8% latency overhead with mTLS (vs 166% sidecar mode)\n- Enterprise features, multi-cloud, advanced L7 routing\n- Sidecar-less L4 (ztunnel) + optional L7 (waypoint)\n\n**Linkerd (Simplicity priority):**\n- 33% latency overhead (lowest sidecar)\n- Rust-based micro-proxy, automatic mTLS\n- Best for small-medium teams, easy adoption\n\n**Cilium (eBPF-native):**\n- 99% latency overhead, kernel-level enforcement\n- Advanced networking, sidecar-less by design\n- Best for eBPF infrastructure, future-proof\n\nFor detailed comparison matrix and architecture trade-offs, see `references\u002Fdecision-tree.md`.\n\n## Core Concepts\n\n### Data Plane Architectures\n\n**Sidecar:** Proxy per pod, fine-grained L7 control, higher overhead\n**Sidecar-less:** Shared node proxies (Istio Ambient) or eBPF (Cilium), lower overhead\n\n**Istio Ambient Components:**\n- ztunnel: Per-node L4 proxy for mTLS\n- waypoint: Optional per-namespace L7 proxy for HTTP routing\n\n### Traffic Management\n\n**Routing:** Path, header, weight-based traffic distribution\n**Resilience:** Retries, timeouts, circuit breakers, fault injection\n**Load Balancing:** Round robin, least connections, consistent hash\n\n### Security Model\n\n**mTLS:** Automatic encryption, certificate rotation, zero app changes\n**Modes:** STRICT (reject plaintext), PERMISSIVE (accept both)\n**Authorization:** Default-deny, identity-based (not IP), L7 policies\n\n## Istio Configuration\n\nIstio uses Custom Resource Definitions for traffic management and security.\n\n### VirtualService (Routing)\n\n```yaml\napiVersion: networking.istio.io\u002Fv1\nkind: VirtualService\nmetadata:\n  name: backend-canary\nspec:\n  hosts:\n  - backend\n  http:\n  - route:\n    - destination:\n        host: backend\n        subset: v1\n      weight: 90\n    - destination:\n        host: backend\n        subset: v2\n      weight: 10\n```\n\n### DestinationRule (Traffic Policy)\n\n```yaml\napiVersion: networking.istio.io\u002Fv1\nkind: DestinationRule\nmetadata:\n  name: backend-circuit-breaker\nspec:\n  host: backend\n  trafficPolicy:\n    connectionPool:\n      tcp:\n        maxConnections: 100\n      http:\n        http1MaxPendingRequests: 10\n    outlierDetection:\n      consecutiveErrors: 5\n      interval: 30s\n      baseEjectionTime: 30s\n```\n\n### PeerAuthentication (mTLS)\n\n```yaml\napiVersion: security.istio.io\u002Fv1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: istio-system\nspec:\n  mtls:\n    mode: STRICT\n```\n\n### AuthorizationPolicy (Access Control)\n\n```yaml\napiVersion: security.istio.io\u002Fv1\nkind: AuthorizationPolicy\nmetadata:\n  name: allow-frontend\n  namespace: production\nspec:\n  selector:\n    matchLabels:\n      app: backend\n  action: ALLOW\n  rules:\n  - from:\n    - source:\n        principals:\n        - cluster.local\u002Fns\u002Fproduction\u002Fsa\u002Ffrontend\n    to:\n    - operation:\n        methods: [\"GET\", \"POST\"]\n        paths: [\"\u002Fapi\u002F*\"]\n```\n\nFor advanced patterns (fault injection, mirroring, gateways), see `references\u002Fistio-patterns.md`.\n\n## Linkerd Configuration\n\nLinkerd emphasizes simplicity with automatic mTLS.\n\n### HTTPRoute (Traffic Splitting)\n\n```yaml\napiVersion: policy.linkerd.io\u002Fv1beta2\nkind: HTTPRoute\nmetadata:\n  name: backend-canary\nspec:\n  parentRefs:\n  - name: backend\n    kind: Service\n  rules:\n  - backendRefs:\n    - name: backend-v1\n      port: 8080\n      weight: 90\n    - name: backend-v2\n      port: 8080\n      weight: 10\n```\n\n### ServiceProfile (Retries\u002FTimeouts)\n\n```yaml\napiVersion: linkerd.io\u002Fv1alpha2\nkind: ServiceProfile\nmetadata:\n  name: backend.production.svc.cluster.local\nspec:\n  routes:\n  - name: GET \u002Fapi\u002Fdata\n    condition:\n      method: GET\n      pathRegex: \u002Fapi\u002Fdata\n    timeout: 3s\n    retryBudget:\n      retryRatio: 0.2\n      minRetriesPerSecond: 10\n```\n\n### AuthorizationPolicy\n\n```yaml\napiVersion: policy.linkerd.io\u002Fv1alpha1\nkind: AuthorizationPolicy\nmetadata:\n  name: allow-frontend\nspec:\n  targetRef:\n    kind: Server\n    name: backend-api\n  requiredAuthenticationRefs:\n  - name: frontend-identity\n    kind: MeshTLSAuthentication\n```\n\nFor complete patterns and mTLS verification, see `references\u002Flinkerd-patterns.md`.\n\n## Cilium Configuration\n\nCilium uses eBPF for kernel-level enforcement.\n\n### CiliumNetworkPolicy (L3\u002FL4\u002FL7)\n\n```yaml\napiVersion: cilium.io\u002Fv2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: backend-access\nspec:\n  endpointSelector:\n    matchLabels:\n      app: backend\n  ingress:\n  - fromEndpoints:\n    - matchLabels:\n        app: frontend\n    toPorts:\n    - ports:\n      - port: \"8080\"\n      rules:\n        http:\n        - method: GET\n          path: \"\u002Fapi\u002F.*\"\n```\n\n### DNS-Based Egress\n\n```yaml\napiVersion: cilium.io\u002Fv2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: external-api-access\nspec:\n  endpointSelector:\n    matchLabels:\n      app: backend\n  egress:\n  - toFQDNs:\n    - matchName: \"api.github.com\"\n    toPorts:\n    - ports:\n      - port: \"443\"\n```\n\nFor mTLS with SPIRE and eBPF patterns, see `references\u002Fcilium-patterns.md`.\n\n## Security Implementation\n\n### Zero-Trust Architecture\n\n1. Enable strict mTLS (encrypt all traffic)\n2. Default-deny authorization policies\n3. Explicit allow rules (least privilege)\n4. Identity-based access control\n5. Audit logging\n\n**Example (Istio):**\n\n```yaml\n# Strict mTLS\napiVersion: security.istio.io\u002Fv1\nkind: PeerAuthentication\nmetadata:\n  name: strict-mtls\n  namespace: production\nspec:\n  mtls:\n    mode: STRICT\n---\n# Deny all by default\napiVersion: security.istio.io\u002Fv1\nkind: AuthorizationPolicy\nmetadata:\n  name: deny-all\n  namespace: production\nspec: {}\n```\n\n### Certificate Management\n\n- Automatic rotation (24h TTL default)\n- Zero-downtime updates\n- External CA integration (cert-manager)\n- SPIFFE\u002FSPIRE for workload identity\n\nFor JWT authentication and external authorization (OPA), see `references\u002Fsecurity-patterns.md`.\n\n## Progressive Delivery\n\n### Canary Deployment\n\nGradually shift traffic with monitoring.\n\n**Stages:**\n1. Deploy v2 with 0% traffic\n2. Route 10% to v2, monitor metrics\n3. Increase: 25% → 50% → 75% → 100%\n4. Cleanup v1 deployment\n\n**Monitor:** Error rate, latency (P95\u002FP99), throughput\n\n### Blue\u002FGreen Deployment\n\nInstant cutover with quick rollback.\n\n**Process:**\n1. Deploy green alongside blue\n2. Test green with header routing\n3. Instant cutover to green\n4. Rollback to blue if needed\n\n### Automated Rollback (Flagger)\n\n```yaml\napiVersion: flagger.app\u002Fv1beta1\nkind: Canary\nmetadata:\n  name: backend\nspec:\n  targetRef:\n    kind: Deployment\n    name: backend\n  service:\n    port: 8080\n  analysis:\n    interval: 1m\n    threshold: 5\n    maxWeight: 50\n    stepWeight: 10\n    metrics:\n    - name: request-success-rate\n      thresholdRange:\n        min: 99\n```\n\nFor A\u002FB testing and detailed patterns, see `references\u002Fprogressive-delivery.md`.\n\n## Multi-Cluster Mesh\n\nExtend mesh across Kubernetes clusters.\n\n**Use Cases:** HA, geo-distribution, compliance, DR\n\n**Istio Multi-Primary:**\n\n```bash\n# Install on cluster 1\nistioctl install --set values.global.meshID=mesh1 \\\n  --set values.global.multiCluster.clusterName=cluster1\n\n# Exchange secrets for service discovery\nistioctl x create-remote-secret --context=cluster2 | \\\n  kubectl apply -f - --context=cluster1\n```\n\n**Linkerd Multi-Cluster:**\n\n```bash\n# Link clusters\nlinkerd multicluster link --cluster-name cluster2 | \\\n  kubectl apply -f -\n\n# Export service\nkubectl label svc\u002Fbackend mirror.linkerd.io\u002Fexported=true\n```\n\nFor complete setup and cross-cluster patterns, see `references\u002Fmulti-cluster.md`.\n\n## Installation\n\n### Istio Ambient Mode\n\n```bash\ncurl -L https:\u002F\u002Fistio.io\u002FdownloadIstio | sh -\nistioctl install --set profile=ambient -y\nkubectl label namespace production istio.io\u002Fdataplane-mode=ambient\n```\n\n### Linkerd\n\n```bash\ncurl -sL https:\u002F\u002Frun.linkerd.io\u002Finstall-edge | sh\nlinkerd install --crds | kubectl apply -f -\nlinkerd install | kubectl apply -f -\nkubectl annotate namespace production linkerd.io\u002Finject=enabled\n```\n\n### Cilium\n\n```bash\nhelm install cilium cilium\u002Fcilium \\\n  --namespace kube-system \\\n  --set meshMode=enabled \\\n  --set authentication.mutual.spire.enabled=true\n```\n\n## Troubleshooting\n\n### mTLS Issues\n\n```bash\n# Istio: Check mTLS status\nistioctl authn tls-check frontend.production.svc.cluster.local\n\n# Linkerd: Check edges\nlinkerd edges deployment\u002Ffrontend -n production\n\n# Cilium: Check auth\ncilium bpf auth list\n```\n\n### Traffic Routing Issues\n\n```bash\n# Istio: Analyze config\nistioctl analyze -n production\n\n# Linkerd: Tap traffic\nlinkerd tap deployment\u002Fbackend -n production\n\n# Cilium: Observe flows\nhubble observe --namespace production\n```\n\nFor complete debugging guide and solutions, see `references\u002Ftroubleshooting.md`.\n\n## Integration with Other Skills\n\n**kubernetes-operations:** Cluster setup, namespaces, RBAC\n**security-hardening:** Container security, secret management\n**infrastructure-as-code:** Terraform\u002FHelm for mesh deployment\n**building-ci-pipelines:** Automated canary, integration tests\n**performance-engineering:** Latency benchmarking, optimization\n\n## Reference Files\n\n- `references\u002Fdecision-tree.md` - Service mesh selection and comparison\n- `references\u002Fistio-patterns.md` - Istio configuration examples\n- `references\u002Flinkerd-patterns.md` - Linkerd patterns and best practices\n- `references\u002Fcilium-patterns.md` - Cilium eBPF policies and mTLS\n- `references\u002Fsecurity-patterns.md` - Zero-trust and authorization\n- `references\u002Fprogressive-delivery.md` - Canary, blue\u002Fgreen, A\u002FB testing\n- `references\u002Fmulti-cluster.md` - Multi-cluster setup and federation\n- `references\u002Ftroubleshooting.md` - Common issues and debugging\n","# Service Mesh Implementation\n\n## Purpose\n\nConfigure and deploy service mesh infrastructure for Kubernetes environments. Enable secure service-to-service communication with mutual TLS, implement traffic management policies, configure authorization controls, and set up progressive delivery strategies. Abstracts network complexity while providing observability, security, and resilience for microservices.\n\n## When to Use\n\nInvoke this skill when:\n\n- \"Set up service mesh with mTLS\"\n- \"Configure Istio traffic routing\"\n- \"Implement canary deployments\"\n- \"Secure microservices communication\"\n- \"Add authorization policies to services\"\n- \"Traffic splitting between versions\"\n- \"Multi-cluster service mesh setup\"\n- \"Configure ambient mode vs sidecar\"\n- \"Set up circuit breaker configuration\"\n- \"Enable distributed tracing\"\n\n## Service Mesh Selection\n\nChoose based on requirements and constraints.\n\n**Istio Ambient (Recommended for most):**\n- 8% latency overhead with mTLS (vs 166% sidecar mode)\n- Enterprise features, multi-cloud, advanced L7 routing\n- Sidecar-less L4 (ztunnel) + optional L7 (waypoint)\n\n**Linkerd (Simplicity priority):**\n- 33% latency overhead (lowest sidecar)\n- Rust-based micro-proxy, automatic mTLS\n- Best for small-medium teams, easy adoption\n\n**Cilium (eBPF-native):**\n- 99% latency overhead, kernel-level enforcement\n- Advanced networking, sidecar-less by design\n- Best for eBPF infrastructure, future-proof\n\nFor detailed comparison matrix and architecture trade-offs, see `references\u002Fdecision-tree.md`.\n\n## Core Concepts\n\n### Data Plane Architectures\n\n**Sidecar:** Proxy per pod, fine-grained L7 control, higher overhead\n**Sidecar-less:** Shared node proxies (Istio Ambient) or eBPF (Cilium), lower overhead\n\n**Istio Ambient Components:**\n- ztunnel: Per-node L4 proxy for mTLS\n- waypoint: Optional per-namespace L7 proxy for HTTP routing\n\n### Traffic Management\n\n**Routing:** Path, header, weight-based traffic distribution\n**Resilience:** Retries, timeouts, circuit breakers, fault injection\n**Load Balancing:** Round robin, least connections, consistent hash\n\n### Security Model\n\n**mTLS:** Automatic encryption, certificate rotation, zero app changes\n**Modes:** STRICT (reject plaintext), PERMISSIVE (accept both)\n**Authorization:** Default-deny, identity-based (not IP), L7 policies\n\n## Istio Configuration\n\nIstio uses Custom Resource Definitions for traffic management and security.\n\n### VirtualService (Routing)\n\n```yaml\napiVersion: networking.istio.io\u002Fv1\nkind: VirtualService\nmetadata:\n  name: backend-canary\nspec:\n  hosts:\n  - backend\n  http:\n  - route:\n    - destination:\n        host: backend\n        subset: v1\n      weight: 90\n    - destination:\n        host: backend\n        subset: v2\n      weight: 10\n```\n\n### DestinationRule (Traffic Policy)\n\n```yaml\napiVersion: networking.istio.io\u002Fv1\nkind: DestinationRule\nmetadata:\n  name: backend-circuit-breaker\nspec:\n  host: backend\n  trafficPolicy:\n    connectionPool:\n      tcp:\n        maxConnections: 100\n      http:\n        http1MaxPendingRequests: 10\n    outlierDetection:\n      consecutiveErrors: 5\n      interval: 30s\n      baseEjectionTime: 30s\n```\n\n### PeerAuthentication (mTLS)\n\n```yaml\napiVersion: security.istio.io\u002Fv1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: istio-system\nspec:\n  mtls:\n    mode: STRICT\n```\n\n### AuthorizationPolicy (Access Control)\n\n```yaml\napiVersion: security.istio.io\u002Fv1\nkind: AuthorizationPolicy\nmetadata:\n  name: allow-frontend\n  namespace: production\nspec:\n  selector:\n    matchLabels:\n      app: backend\n  action: ALLOW\n  rules:\n  - from:\n    - source:\n        principals:\n        - cluster.local\u002Fns\u002Fproduction\u002Fsa\u002Ffrontend\n    to:\n    - operation:\n        methods: [\"GET\", \"POST\"]\n        paths: [\"\u002Fapi\u002F*\"]\n```\n\nFor advanced patterns (fault injection, mirroring, gateways), see `references\u002Fistio-patterns.md`.\n\n## Linkerd Configuration\n\nLinkerd emphasizes simplicity with automatic mTLS.\n\n### HTTPRoute (Traffic Splitting)\n\n```yaml\napiVersion: policy.linkerd.io\u002Fv1beta2\nkind: HTTPRoute\nmetadata:\n  name: backend-canary\nspec:\n  parentRefs:\n  - name: backend\n    kind: Service\n  rules:\n  - backendRefs:\n    - name: backend-v1\n      port: 8080\n      weight: 90\n    - name: backend-v2\n      port: 8080\n      weight: 10\n```\n\n### ServiceProfile (Retries\u002FTimeouts)\n\n```yaml\napiVersion: linkerd.io\u002Fv1alpha2\nkind: ServiceProfile\nmetadata:\n  name: backend.production.svc.cluster.local\nspec:\n  routes:\n  - name: GET \u002Fapi\u002Fdata\n    condition:\n      method: GET\n      pathRegex: \u002Fapi\u002Fdata\n    timeout: 3s\n    retryBudget:\n      retryRatio: 0.2\n      minRetriesPerSecond: 10\n```\n\n### AuthorizationPolicy\n\n```yaml\napiVersion: policy.linkerd.io\u002Fv1alpha1\nkind: AuthorizationPolicy\nmetadata:\n  name: allow-frontend\nspec:\n  targetRef:\n    kind: Server\n    name: backend-api\n  requiredAuthenticationRefs:\n  - name: frontend-identity\n    kind: MeshTLSAuthentication\n```\n\nFor complete patterns and mTLS verification, see `references\u002Flinkerd-patterns.md`.\n\n## Cilium Configuration\n\nCilium uses eBPF for kernel-level enforcement.\n\n### CiliumNetworkPolicy (L3\u002FL4\u002FL7)\n\n```yaml\napiVersion: cilium.io\u002Fv2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: backend-access\nspec:\n  endpointSelector:\n    matchLabels:\n      app: backend\n  ingress:\n  - fromEndpoints:\n    - matchLabels:\n        app: frontend\n    toPorts:\n    - ports:\n      - port: \"8080\"\n      rules:\n        http:\n        - method: GET\n          path: \"\u002Fapi\u002F.*\"\n```\n\n### DNS-Based Egress\n\n```yaml\napiVersion: cilium.io\u002Fv2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: external-api-access\nspec:\n  endpointSelector:\n    matchLabels:\n      app: backend\n  egress:\n  - toFQDNs:\n    - matchName: \"api.github.com\"\n    toPorts:\n    - ports:\n      - port: \"443\"\n```\n\nFor mTLS with SPIRE and eBPF patterns, see `references\u002Fcilium-patterns.md`.\n\n## Security Implementation\n\n### Zero-Trust Architecture\n\n1. Enable strict mTLS (encrypt all traffic)\n2. Default-deny authorization policies\n3. Explicit allow rules (least privilege)\n4. Identity-based access control\n5. Audit logging\n\n**Example (Istio):**\n\n```yaml\n# Strict mTLS\napiVersion: security.istio.io\u002Fv1\nkind: PeerAuthentication\nmetadata:\n  name: strict-mtls\n  namespace: production\nspec:\n  mtls:\n    mode: STRICT\n---\n# Deny all by default\napiVersion: security.istio.io\u002Fv1\nkind: AuthorizationPolicy\nmetadata:\n  name: deny-all\n  namespace: production\nspec: {}\n```\n\n### Certificate Management\n\n- Automatic rotation (24h TTL default)\n- Zero-downtime updates\n- External CA integration (cert-manager)\n- SPIFFE\u002FSPIRE for workload identity\n\nFor JWT authentication and external authorization (OPA), see `references\u002Fsecurity-patterns.md`.\n\n## Progressive Delivery\n\n### Canary Deployment\n\nGradually shift traffic with monitoring.\n\n**Stages:**\n1. Deploy v2 with 0% traffic\n2. Route 10% to v2, monitor metrics\n3. Increase: 25% → 50% → 75% → 100%\n4. Cleanup v1 deployment\n\n**Monitor:** Error rate, latency (P95\u002FP99), throughput\n\n### Blue\u002FGreen Deployment\n\nInstant cutover with quick rollback.\n\n**Process:**\n1. Deploy green alongside blue\n2. Test green with header routing\n3. Instant cutover to green\n4. Rollback to blue if needed\n\n### Automated Rollback (Flagger)\n\n```yaml\napiVersion: flagger.app\u002Fv1beta1\nkind: Canary\nmetadata:\n  name: backend\nspec:\n  targetRef:\n    kind: Deployment\n    name: backend\n  service:\n    port: 8080\n  analysis:\n    interval: 1m\n    threshold: 5\n    maxWeight: 50\n    stepWeight: 10\n    metrics:\n    - name: request-success-rate\n      thresholdRange:\n        min: 99\n```\n\nFor A\u002FB testing and detailed patterns, see `references\u002Fprogressive-delivery.md`.\n\n## Multi-Cluster Mesh\n\nExtend mesh across Kubernetes clusters.\n\n**Use Cases:** HA, geo-distribution, compliance, DR\n\n**Istio Multi-Primary:**\n\n```bash\n# Install on cluster 1\nistioctl install --set values.global.meshID=mesh1 \\\n  --set values.global.multiCluster.clusterName=cluster1\n\n# Exchange secrets for service discovery\nistioctl x create-remote-secret --context=cluster2 | \\\n  kubectl apply -f - --context=cluster1\n```\n\n**Linkerd Multi-Cluster:**\n\n```bash\n# Link clusters\nlinkerd multicluster link --cluster-name cluster2 | \\\n  kubectl apply -f -\n\n# Export service\nkubectl label svc\u002Fbackend mirror.linkerd.io\u002Fexported=true\n```\n\nFor complete setup and cross-cluster patterns, see `references\u002Fmulti-cluster.md`.\n\n## Installation\n\n### Istio Ambient Mode\n\n```bash\ncurl -L https:\u002F\u002Fistio.io\u002FdownloadIstio | sh -\nistioctl install --set profile=ambient -y\nkubectl label namespace production istio.io\u002Fdataplane-mode=ambient\n```\n\n### Linkerd\n\n```bash\ncurl -sL https:\u002F\u002Frun.linkerd.io\u002Finstall-edge | sh\nlinkerd install --crds | kubectl apply -f -\nlinkerd install | kubectl apply -f -\nkubectl annotate namespace production linkerd.io\u002Finject=enabled\n```\n\n### Cilium\n\n```bash\nhelm install cilium cilium\u002Fcilium \\\n  --namespace kube-system \\\n  --set meshMode=enabled \\\n  --set authentication.mutual.spire.enabled=true\n```\n\n## Troubleshooting\n\n### mTLS Issues\n\n```bash\n# Istio: Check mTLS status\nistioctl authn tls-check frontend.production.svc.cluster.local\n\n# Linkerd: Check edges\nlinkerd edges deployment\u002Ffrontend -n production\n\n# Cilium: Check auth\ncilium bpf auth list\n```\n\n### Traffic Routing Issues\n\n```bash\n# Istio: Analyze config\nistioctl analyze -n production\n\n# Linkerd: Tap traffic\nlinkerd tap deployment\u002Fbackend -n production\n\n# Cilium: Observe flows\nhubble observe --namespace production\n```\n\nFor complete debugging guide and solutions, see `references\u002Ftroubleshooting.md`.\n\n## Integration with Other Skills\n\n**kubernetes-operations:** Cluster setup, namespaces, RBAC\n**security-hardening:** Container security, secret management\n**infrastructure-as-code:** Terraform\u002FHelm for mesh deployment\n**building-ci-pipelines:** Automated canary, integration tests\n**performance-engineering:** Latency benchmarking, optimization\n\n## Reference Files\n\n- `references\u002Fdecision-tree.md` - Service mesh selection and comparison\n- `references\u002Fistio-patterns.md` - Istio configuration examples\n- `references\u002Flinkerd-patterns.md` - Linkerd patterns and best practices\n- `references\u002Fcilium-patterns.md` - Cilium eBPF policies and mTLS\n- `references\u002Fsecurity-patterns.md` - Zero-trust and authorization\n- `references\u002Fprogressive-delivery.md` - Canary, blue\u002Fgreen, A\u002FB testing\n- `references\u002Fmulti-cluster.md` - Multi-cluster setup and federation\n- `references\u002Ftroubleshooting.md` - Common issues and debugging\n",{"name":5,"description":7},"main","f2ec4b3b9133d34eeaf9b38e4b0a97e8e5705a7f","benchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh",0,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard","https:\u002F\u002Fgithub.com\u002FJSGforever","2026-08-29 18:27:56",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add JSGforever\u002Fskillguard --skill implementing-service-mesh",{"tool":56,"command":57},"bunx","bunx skills add JSGforever\u002Fskillguard --skill implementing-service-mesh",{"tool":59,"command":60},"pnpm","pnpm dlx skills add JSGforever\u002Fskillguard --skill implementing-service-mesh","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002FSKILL.md",true,[64,70,74,78,82,86,90,94,98,102,106,110,114],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"examples\u002Fcilium\u002Fnetwork-policy.yaml","REFERENCE","参考文档",3185,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Fexamples\u002Fcilium\u002Fnetwork-policy.yaml",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"examples\u002Fistio\u002Fcanary-deployment.yaml",2457,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Fexamples\u002Fistio\u002Fcanary-deployment.yaml",{"path":75,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":76,"sourceHtmlUrl":77},"examples\u002Fistio\u002Fmtls-authorization.yaml",1602,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Fexamples\u002Fistio\u002Fmtls-authorization.yaml",{"path":79,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":80,"sourceHtmlUrl":81},"examples\u002Flinkerd\u002Ftraffic-split.yaml",2467,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Fexamples\u002Flinkerd\u002Ftraffic-split.yaml",{"path":83,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":84,"sourceHtmlUrl":85},"outputs.yaml",19711,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Foutputs.yaml",{"path":87,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fcilium-patterns.md",14671,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Fcilium-patterns.md",{"path":91,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fdecision-tree.md",10158,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Fdecision-tree.md",{"path":95,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fistio-patterns.md",15216,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Fistio-patterns.md",{"path":99,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Flinkerd-patterns.md",13597,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Flinkerd-patterns.md",{"path":103,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fmulti-cluster.md",13333,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Fmulti-cluster.md",{"path":107,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fprogressive-delivery.md",15194,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Fprogressive-delivery.md",{"path":111,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fsecurity-patterns.md",14352,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Fsecurity-patterns.md",{"path":115,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Ftroubleshooting.md",15366,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__ancoleman--implementing-service-mesh\u002Freferences\u002Ftroubleshooting.md",[119,150,166,193,215,236],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":130,"publishedAt":38},"01M71HY2SNXBA9Q00WZDTZQ31Z","skillguard-codex-scanner","Hybrid deterministic+LLM agent-skill security scanner. Use when asked to \"scan a skill\", \"audit a skill\", \"check skill safety\", \"validate SKILL.md\", \"is this skill safe to install\", or assess prompt injection, malicious scripts, excessive permissions, secret exposure, supply chain risk, or structural attacks in an agent skill. Produces a security-review report plus a machine-parseable verdict block.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fsrc\u002Fskillguard\u002Fstatic_scanner\u002Fskillguard-codex-scanner\u002FSKILL.md",[125],{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[131,132,133,134,135,136,137,138,139,140,141,142,33,143,144,145,146,147,148,149],"scanner","skillguard codex scanner","skillguard","codex","chain","skill security","security-review","review report","structural","secret","prompt injection","security scanner","review","malicious","permissions","exposure","audit","scripts","safe",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":154,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":162,"publishedAt":38},"01M71HY0SPKTT3S27BC2HPAC5M","data-exfiltrator","Analyzes data files","MIT","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Fsmoke-one-skill\u002Fasset1__cisco-ai-defense--data-exfiltrator\u002FSKILL.md",[157],{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[163,164,165],"data","data exfiltrator","files",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":38},"01M71HXVS9EMN44BGDW215FZ72","real-time-collaboration-engine","Build real-time collaborative editing with WebSockets, OT\u002FCRDT conflict resolution, and presence awareness. Implements cursor tracking, optimistic updates, and offline sync. Use for collaborative editors, whiteboards, video editing. Activate on \"real-time collaboration\", \"WebSocket sync\", \"multiplayer editing\", \"CRDT\", \"presence awareness\". NOT for simple chat, request-response APIs, or single-user apps.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--real-time-collaboration-engine\u002FSKILL.md",[],[173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],"time","real time collaboration engine","real time collaboration","collaboration","engine","real time","Video","reliability","video editing","performance","conflict resolution","presence","access","apps","updates","Bash","activate","optimizer","react","streaming",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":202,"publishedAt":38},"01M71HXP6CTY4KFN0QVMMN0V7J","react-performance-optimizer","Optimize React apps for 60fps performance. Implements memoization, virtualization, code splitting, bundle optimization. Use for slow renders, large lists, bundle bloat. Activate on \"React performance\", \"slow render\", \"useMemo\", \"bundle size\", \"virtualization\". NOT for backend optimization, non-React frameworks, or premature optimization.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--react-performance-optimizer\u002FSKILL.md",[199],{"categoryNo":200,"categoryName":201,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000009","前端开发",[182,203,190,191,204,205,206,207,208,209,173,210,211,186,188,212,189,192,213,214],"react performance optimizer","react performance","performance optimizer","app","nextjs","expert","re","render","2025","code","router","strategies",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":222,"publishedAt":38},"01M71HXH7QXSQB4QTDZ7SP7YXQ","llm-streaming-response-handler","Build production LLM streaming UIs with Server-Sent Events, real-time token display, cancellation, error recovery. Handles OpenAI\u002FAnthropic\u002FClaude streaming APIs. Use for chatbots, AI assistants, real-time text generation. Activate on \"LLM streaming\", \"SSE\", \"token stream\", \"chat UI\", \"real-time AI\". NOT for batch processing, non-streaming APIs, or WebSocket bidirectional chat.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--llm-streaming-response-handler\u002FSKILL.md",[221],{"categoryNo":200,"categoryName":201,"taxonomyType":128,"taxonomyTypeDesc":129},[223,192,224,225,226,227,182,173,228,229,230,188,189,190,231,191,232,233,234,235],"llm streaming response handler","handler","error","processing","retry","chat ui","error recovery","critical","batch","display","text","server","read",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":249,"publishedAt":38},"01M71HXCB0E1YRKYW1Y8T0Y106","github-actions-pipeline-builder","Build production CI\u002FCD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning. Use for automated testing, deployments, release workflows. Activate on \"GitHub Actions\", \"CI\u002FCD\", \"workflow\", \"deployment pipeline\", \"automated testing\". NOT for Jenkins\u002FCircleCI, manual deployments, or non-GitHub repositories.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--github-actions-pipeline-builder\u002FSKILL.md",[242,245,248],{"categoryNo":243,"categoryName":244,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":246,"categoryName":247,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[250,251,252,253,254,255,256,180,208,257,258,259,189,214,260,235,261,262,263,264],"github actions pipeline builder","actions","github actions","pipeline builder","github","builder","pipeline","testing","ci","workflows","run","release","write","edit","git"]