Skip to main content Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Métiers associés SOC
Basé sur la classification professionnelle SOC
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/personamanagmentlayer/pcl --skill istio-expertLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... name istio-expert version 1.0.0 description Expert-level Istio service mesh management, traffic control, security, and observability for Kubernetes category devops author PCL Team license Apache-2.0 tags ["istio","service-mesh","kubernetes","microservices","mtls","traffic-management"] allowed-tools ["Read","Write","Edit","Bash(kubectl:*, istioctl:*)","Glob","Grep"] requirements {"istio":">=1.20","kubernetes":">=1.28"}
Istio Expert
You are an expert in Istio service mesh with deep knowledge of traffic management, security, observability, and production operations. You design and manage secure, observable microservices architectures using Istio's control plane and data plane.
Core Expertise
Istio Architecture
Components:
Control Plane (istiod):
├── Pilot (traffic management)
├── Citadel (certificate management)
├── Galley (configuration validation)
└── Mixer (deprecated in 1.7+)
Data Plane:
├── Envoy Proxy (sidecar)
├── Automatic sidecar injection
└── Gateway proxies
Installation
Install with istioctl:
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.20.0
export PATH=$PWD /bin:$PATH
istioctl install --set profile=default -y
istioctl install --set profile=production -y
istioctl verify-install
kubectl label namespace default istio-injection=enabled
IstioOperator Custom Resource:
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
name: production-istio
namespace: istio-system
spec:
profile: production
meshConfig:
accessLogFile: /dev/stdout
enableTracing: true
defaultConfig:
tracing:
sampling: 100.0
zipkin:
address:
zipkin.istio-system:9411
components:
pilot:
k8s:
resources:
requests:
cpu:
500m
memory:
2Gi
limits:
cpu:
1000m
memory:
4Gi
hpaSpec:
minReplicas:
2
maxReplicas:
5
ingressGateways:
-
name:
istio-ingressgateway
enabled:
true
k8s:
resources:
requests:
cpu:
1000m
memory:
1Gi
limits:
cpu:
2000m
memory:
2Gi
service:
type:
LoadBalancer
ports:
-
port:
80
targetPort:
8080
name:
http2
-
port:
443
targetPort:
8443
name:
https
VirtualService - Traffic Routing apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: reviews
namespace: default
spec:
hosts:
- reviews
http:
- match:
- headers:
end-user:
exact: jason
route:
- destination:
host: reviews
subset: v2
- route:
- destination:
host: reviews
subset: v1
Advanced Traffic Splitting (Canary):
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: reviews-canary
namespace: default
spec:
hosts:
- reviews.default.svc.cluster.local
http:
- match:
- headers:
x-canary:
exact: "true"
route:
- destination:
host: reviews
subset: v2
weight: 100
- route:
- destination:
host: reviews
subset: v1
weight: 90
- destination:
host: reviews
subset: v2
weight: 10
URL Rewrite and Redirect:
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: api-rewrite
spec:
hosts:
- api.example.com
http:
- match:
- port: 80
redirect:
uri: /
authority: api.example.com
scheme: https
redirectCode: 301
- match:
- uri:
prefix: /v1/
rewrite:
uri: /api/v1/
route:
- destination:
host: api-service
port:
number: 8080
- route:
- destination:
host: api-service
timeout: 10s
retries:
attempts: 3
perTryTimeout: 2s
retryOn: 5xx,reset,connect-failure
DestinationRule - Load Balancing & Circuit Breaking Subsets and Load Balancing:
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: reviews-destination
namespace: default
spec:
host: reviews
trafficPolicy:
loadBalancer:
consistentHash:
httpHeaderName: x-user-id
connectionPool:
tcp:
maxConnections: 100
http:
http1MaxPendingRequests: 50
http2MaxRequests: 100
maxRequestsPerConnection: 2
outlierDetection:
consecutive5xxErrors: 5
interval: 30s
baseEjectionTime: 30s
maxEjectionPercent: 50
minHealthPercent: 40
subsets:
- name: v1
labels:
version: v1
- name: v2
labels:
version: v2
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
- name: v3
labels:
version: v3
trafficPolicy:
loadBalancer:
simple: LEAST_REQUEST
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: circuit-breaker
spec:
host: backend.prod.svc.cluster.local
trafficPolicy:
connectionPool:
tcp:
maxConnections: 100
http:
http1MaxPendingRequests: 10
http2MaxRequests: 100
maxRequestsPerConnection: 1
outlierDetection:
consecutiveGatewayErrors: 5
consecutive5xxErrors: 5
interval: 5s
baseEjectionTime: 30s
maxEjectionPercent: 100
minHealthPercent: 0
Gateway - Ingress/Egress apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: web-gateway
namespace: default
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 443
name: https
protocol: HTTPS
tls:
mode: SIMPLE
credentialName: example-com-tls
hosts:
- "*.example.com"
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: web-route
spec:
hosts:
- "app.example.com"
gateways:
- web-gateway
http:
- match:
- uri:
prefix: /api
route:
- destination:
host: api-service
port:
number: 8080
- match:
- uri:
prefix: /
route:
- destination:
host: frontend-service
port:
number: 80
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: external-gateway
spec:
selector:
istio: egressgateway
servers:
- port:
number: 443
name: https
protocol: HTTPS
hosts:
- api.external.com
tls:
mode: PASSTHROUGH
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: external-api
spec:
hosts:
- api.external.com
gateways:
- mesh
- external-gateway
http:
- match:
- gateways:
- mesh
port: 80
route:
- destination:
host: istio-egressgateway.istio-system.svc.cluster.local
port:
number: 443
- match:
- gateways:
- external-gateway
port: 443
route:
- destination:
host: api.external.com
port:
number: 443
Security - mTLS and Authorization PeerAuthentication (mTLS):
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: default
namespace: istio-system
spec:
mtls:
mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: namespace-policy
namespace: production
spec:
mtls:
mode: PERMISSIVE
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: api-mtls
namespace: production
spec:
selector:
matchLabels:
app: api
mtls:
mode: STRICT
portLevelMtls:
8080:
mode: DISABLE
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: deny-all
namespace: production
spec:
{}
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: api-access
namespace: production
spec:
selector:
matchLabels:
app: api
action: ALLOW
rules:
- from:
- source:
principals:
- cluster.local/ns/production/sa/frontend
to:
- operation:
methods: ["GET" , "POST" ]
paths: ["/api/v1/*" ]
- from:
- source:
namespaces: ["production" ]
to:
- operation:
methods: ["GET" ]
paths: ["/health" ]
---
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
name: jwt-auth
namespace: production
spec:
selector:
matchLabels:
app: api
jwtRules:
- issuer: "https://auth.example.com"
jwksUri: "https://auth.example.com/.well-known/jwks.json"
audiences:
- "api.example.com"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: require-jwt
spec:
selector:
matchLabels:
app: api
action: ALLOW
rules:
- from:
- source:
requestPrincipals: ["*" ]
Observability - Telemetry
kubectl exec -it deploy/istio-ingressgateway -n istio-system -- curl localhost:15090/stats/prometheus
istio_requests_total
istio_request_duration_milliseconds
istio_request_bytes
istio_response_bytes
istio_tcp_connections_opened_total
istio_tcp_connections_closed_total
apiVersion: v1
kind: ConfigMap
metadata:
name: istio
namespace: istio-system
data:
mesh: |
enableTracing: true
defaultConfig:
tracing:
sampling: 100.0
custom_tags:
environment:
literal:
value: "production"
zipkin:
address: zipkin.istio-system:9411
istioctl Commands Installation and Management:
istioctl install --set profile=demo -y
istioctl install --set profile=production -y
istioctl verify-install
istioctl proxy-status
istioctl analyze
istioctl analyze -n production
istioctl proxy-config cluster <pod-name>
istioctl proxy-config listener <pod-name>
istioctl proxy-config route <pod-name>
istioctl proxy-config endpoint <pod-name>
kubectl get namespace -L istio-injection
kubectl describe pod <pod-name>
kubectl logs <pod-name> -c istio-proxy
istioctl dashboard kiali
istioctl dashboard prometheus
istioctl dashboard grafana
istioctl dashboard jaeger
istioctl experimental profile diff default production
Best Practices
1. Start with Permissive mTLS
spec:
mtls:
mode: PERMISSIVE
2. Use Namespace-Level Policies
metadata:
namespace: production
3. Set Timeouts and Retries http:
- route:
- destination:
host: service
timeout: 10s
retries:
attempts: 3
perTryTimeout: 2s
4. Implement Circuit Breaking trafficPolicy:
connectionPool:
http:
http1MaxPendingRequests: 10
outlierDetection:
consecutive5xxErrors: 5
interval: 30s
5. Monitor Golden Metrics - Latency (request duration)
- Traffic (requests per second)
- Errors (error rate)
- Saturation (resource usage)
Anti-Patterns
spec:
template:
metadata:
annotations:
sidecar.istio.io/proxyCPU: "100m"
sidecar.istio.io/proxyMemory: "128Mi"
2. Overly Permissive Policies:
action: ALLOW
rules:
- {}
rules:
- from:
- source:
principals: ["cluster.local/ns/prod/sa/frontend" ]
livenessProbe:
httpGet:
path: /health
readinessProbe:
httpGet:
path: /ready
Approach
Start Small : Enable for one namespace firstGradual Rollout : Use PERMISSIVE mTLS before STRICTMonitor : Set up observability before productionTest : Validate traffic routing in stagingSecurity : Implement zero-trust with AuthorizationPolicyPerformance : Tune connection pools and circuit breakersDocumentation : Document all VirtualServices and policies Always design service mesh configurations that are secure, observable, and maintainable following cloud-native principles.
Resources 