メニュー
A service mesh is an infrastructure layer that provides transparent service-to-service communication with built-in observability, traffic management, and security features without requiring application code changes.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | service-mesh |
| category | cloud-native |
| difficulty | advanced |
| tags | ["istio","linkerd","envoy","mtls","traffic-management","observability"] |
| prerequisites | ["kubernetes","networking","security"] |
| estimated_time | 8-12 hours |
| description | A service mesh is an infrastructure layer that provides transparent service-to-service communication with built-in observability, traffic management, and security features without requiring application code changes. |
A service mesh is an infrastructure layer that provides transparent service-to-service communication with built-in observability, traffic management, and security features without requiring application code changes.
Core Components:
1. Observability
2. Traffic Management
3. Security
4. Resilience
| Feature | Istio | Linkerd |
|---|---|---|
| Proxy | Envoy (C++) | Linkerd2-proxy (Rust) |
| Resource Usage | Higher (100-200MB/pod) | Lower (10-20MB/pod) |
| Features | Comprehensive (100+ CRDs) | Focused (essential features) |
| Complexity | More complex setup | Simpler, faster setup |
| Multi-cluster | Full support | Basic support |
| Traffic Management | Advanced (mirroring, A/B) | Basic (canary, split) |
| Observability | Full stack (Kiali/Jaeger) | Built-in (Linkerd Viz) |
| Maturity | Production-ready (CNCF) | Production-ready (CNCF) |
Choose Istio when:
Choose Linkerd when:
Pre-Installation:
□ Kubernetes cluster v1.22+ running
□ CNI plugin supporting network policies
□ Prometheus and Grafana available
□ Resource capacity planned (2-4 CPU, 4-8GB RAM)
□ DNS resolution working correctly
Post-Installation:
□ mTLS enabled cluster-wide (STRICT mode)
□ Sidecar injection configured (automatic/manual)
□ Monitoring dashboards accessible
□ Health checks and readiness probes adjusted
□ Certificate rotation configured
□ Resource limits set on proxies
Traffic Management:
□ VirtualService defines routing rules
□ DestinationRule configures load balancing
□ Circuit breaking thresholds set
□ Retry policies configured
□ Timeouts appropriate for services
Security:
□ Authorization policies applied (default-deny)
□ PeerAuthentication enforces mTLS
□ Service accounts properly scoped
□ Ingress/egress gateways secured
□ Certificate validity monitored
# Install Istio (demo profile)
istioctl install --set profile=demo -y
# Enable sidecar injection
kubectl label namespace default istio-injection=enabled
# Deploy sample app
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
# Create ingress gateway
kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
# Check mesh status
istioctl proxy-status
# View metrics
kubectl -n istio-system port-forward svc/kiali 20001:20001
Canary Deployment:
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: reviews-canary
spec:
hosts:
- reviews
http:
- match:
- headers:
end-user:
exact: jason
route:
- destination:
host: reviews
subset: v2
- route:
- destination:
host: reviews
subset: v1
weight: 90
- destination:
host: reviews
subset: v2
weight: 10
Circuit Breaking:
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: reviews-circuit-breaker
spec:
host: reviews
trafficPolicy:
connectionPool:
tcp:
maxConnections: 100
http:
http1MaxPendingRequests: 10
maxRequestsPerConnection: 2
outlierDetection:
consecutiveErrors: 5
interval: 30s
baseEjectionTime: 30s
maxEjectionPercent: 50
Zero Trust Security:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: deny-all
namespace: default
spec:
{} # Empty spec denies all traffic
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: allow-frontend-to-backend
spec:
selector:
matchLabels:
app: backend
action: ALLOW
rules:
- from:
- source:
principals: ["cluster.local/ns/default/sa/frontend"]
to:
- operation:
methods: ["GET", "POST"]
📚 Full Examples: See REFERENCE.md for complete code samples, detailed configurations, and production-ready implementations.
Implementation Guide
The control plane manages and configures the data plane proxies:
Core Functions:
Istiod Components:
See REFERENCE.md for complete implementation.
Sidecar Pattern:
See REFERENCE.md for complete implementation.
Envoy Capabilities:
See REFERENCE.md for complete implementation.
1. IstioOperator (Recommended):
See REFERENCE.md for complete implementation.
2. Helm Installation:
See REFERENCE.md for complete implementation.
3. Production Profile:
See REFERENCE.md for complete implementation.
Automatic Injection (Namespace-level):
# Label namespace for injection
kubectl label namespace production istio-injection=enabled
# Verify
kubectl get namespace -L istio-injection
Manual Injection (Pod-level):
# Inject sidecar into existing deployment
kubectl get deployment myapp -o yaml | \
istioctl kube-inject -f - | \
kubectl apply -f -
Selective Injection (Pod annotation):
apiVersion: v1
kind: Pod
metadata:
name: myapp
annotations:
sidecar.istio.io/inject: "true" # Explicit injection
spec:
containers:
- name: app
image: myapp:v1
See REFERENCE.md for complete implementation.
Gradual Rollout Strategy:
See REFERENCE.md for complete implementation.
Progressive Rollout Script:
See REFERENCE.md for complete implementation.
Zero-Downtime Cutover:
See REFERENCE.md for complete implementation.
Cutover Process:
See REFERENCE.md for complete implementation.
User Cohort Routing:
See REFERENCE.md for complete implementation.
Shadow Testing:
See REFERENCE.md for complete implementation.
Use Cases:
Installation:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/kiali.yaml
# Access dashboard
istioctl dashboard kiali
Key Features:
Kiali Configuration:
See REFERENCE.md for complete implementation.
Installation:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/jaeger.yaml
# Access UI
istioctl dashboard jaeger
Enable Tracing in Mesh:
See REFERENCE.md for complete implementation.
Application Instrumentation:
See REFERENCE.md for complete implementation.
Prometheus Installation:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/prometheus.yaml
Key Metrics:
See REFERENCE.md for complete implementation.
Grafana Dashboards:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/grafana.yaml
istioctl dashboard grafana
Custom Dashboard (JSON):
See REFERENCE.md for complete implementation.
Enable Strict mTLS (Cluster-wide):
See REFERENCE.md for complete implementation.
Per-Namespace mTLS:
See REFERENCE.md for complete implementation.
Per-Port mTLS:
See REFERENCE.md for complete implementation.
Default Deny:
See REFERENCE.md for complete implementation.
Allow Specific Services:
See REFERENCE.md for complete implementation.
JWT Authentication:
See REFERENCE.md for complete implementation.
RBAC with Custom Claims:
See REFERENCE.md for complete implementation.
Configuration:
See REFERENCE.md for complete implementation.
Testing Circuit Breaker:
See REFERENCE.md for complete implementation.
Retry Configuration:
See REFERENCE.md for complete implementation.
Timeout Configuration:
See REFERENCE.md for complete implementation.
Fault Injection (Chaos Testing):
See REFERENCE.md for complete implementation.
Local Rate Limiting (Envoy):
See REFERENCE.md for complete implementation.
Primary-Remote Model:
See REFERENCE.md for complete implementation.
See REFERENCE.md for complete implementation.
Cross-Cluster Service Discovery:
See REFERENCE.md for complete implementation.
Sidecar Resource Limits:
See REFERENCE.md for complete implementation.
Sidecar Scoping:
See REFERENCE.md for complete implementation.
Reduce Metrics Cardinality:
See REFERENCE.md for complete implementation.
Sampling Configuration:
See REFERENCE.md for complete implementation.
See REFERENCE.md for complete implementation.
// TODO: Add advanced example for service-mesh
// This example shows production-ready patterns
// TODO: Add integration example showing how service-mesh
// works with other systems and services
See examples/service-mesh/ for complete working examples.
This skill integrates with:
Problem: Not testing edge cases and error conditions leads to production bugs
Solution: Implement comprehensive test coverage including:
Prevention: Enforce minimum code coverage (80%+) in CI/CD pipeline
Problem: Hardcoding values makes applications inflexible and environment-dependent
Solution: Use environment variables and configuration management:
Prevention: Use tools like dotenv, config validators, and secret scanners
Problem: Security vulnerabilities from not following established security patterns
Solution: Follow security guidelines:
Prevention: Use security linters, SAST tools, and regular dependency updates
Best Practices:
Use this agent when you need to analyze and provide architectural guidance for your codebase. This includes reviewing project structure, identifying architectural patterns, suggesting improvements, and providing recommendations for code organization. For example: <example>Context: The user wants to understand the overall architecture of their Azure analyzer project and get recommendations for improvements.<user>Architect my code</user><assistant>I'll use the code-architect agent to analyze your project architecture and provide detailed guidance.</assistant></example>
Use this agent when you need to test and review code that has been recently written. For example, after a developer finishes implementing a feature or fixing a bug, call this agent to run comprehensive tests and review the code quality. Example: <example>Context: The user has just written a new function that processes user authentication. user: "Here's the authentication function I just wrote:" + function code + assistant: "Let me use the code-tester-reviewer agent to test and review this authentication code." </example>
Use when a user asks to search, install, list, or remove skills with the Context7 ctx7 skills CLI (including npx ctx7) and needs correct subcommands or client flags.
Guide for performing Chromium version upgrades in the Electron project. Use when working on the roller/chromium/main branch to fix patch conflicts during `e sync --3`. Covers the patch application workflow, conflict resolution, analyzing upstream Chromium changes, and proper commit formatting for patch fixes.
Use this agent when you need to build, review, or architect full-stack applications. This includes tasks like creating frontend components with React/Vue, building backend APIs with Node.js/Python, designing database schemas, implementing authentication/authorization, setting up deployment pipelines, and reviewing code for security, performance, and maintainability. Example: User says 'Build a REST API with user authentication and a React dashboard' - this agent would handle the complete stack development from database to frontend. Example: User says 'Review this Node.js endpoint for security issues' - this agent would analyze the code for vulnerabilities, injection attacks, and best practices.
Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos).