メニュー
A service mesh is an infrastructure layer that provides transparent service-to-service communication with built-in observability, traffic management, and security features without requiring application code changes.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Orchestration & Events:
Kubernetes standards for container orchestration, deployments, services, ingress, ConfigMaps, Secrets, and security policies. Covers production-ready configurations, monitoring, and best practices for cloud-native applications.
Master Kotlin coding standards with null safety, coroutines, and idiomatic patterns. Use when developing JVM/Android applications requiring type-safe async programming.
Comprehensive coding standards and best practices for maintainable, consistent software development across multiple languages and paradigms
React frontend standards covering hooks (useState, useEffect, useContext, custom hooks), state management (Context API, Redux, Zustand), performance optimization (memoization, lazy loading, code splitting), testing with React Testing Library, and accessibility (WCAG 2.1, ARIA) for modern SPAs
Security Operations Center (SOC) practices, incident response, SIEM management, and threat hunting following NIST 800-61
| name | service-mesh |
| category | cloud-native |
| difficulty | advanced |
| tags | ["istio","linkerd","envoy","mtls","traffic-management","observability"] |
| prerequisites | ["kubernetes","networking","security"] |
| estimated_time | 8-12 hours |
| description | A service mesh is an infrastructure layer that provides transparent service-to-service communication with built-in observability, traffic management, and security features without requiring application code changes. |
A service mesh is an infrastructure layer that provides transparent service-to-service communication with built-in observability, traffic management, and security features without requiring application code changes.
Core Components:
1. Observability
2. Traffic Management
3. Security
4. Resilience
| Feature | Istio | Linkerd |
|---|---|---|
| Proxy | Envoy (C++) | Linkerd2-proxy (Rust) |
| Resource Usage | Higher (100-200MB/pod) | Lower (10-20MB/pod) |
| Features | Comprehensive (100+ CRDs) | Focused (essential features) |
| Complexity | More complex setup | Simpler, faster setup |
| Multi-cluster | Full support | Basic support |
| Traffic Management | Advanced (mirroring, A/B) | Basic (canary, split) |
| Observability | Full stack (Kiali/Jaeger) | Built-in (Linkerd Viz) |
| Maturity | Production-ready (CNCF) | Production-ready (CNCF) |
Choose Istio when:
Choose Linkerd when:
Pre-Installation:
□ Kubernetes cluster v1.22+ running
□ CNI plugin supporting network policies
□ Prometheus and Grafana available
□ Resource capacity planned (2-4 CPU, 4-8GB RAM)
□ DNS resolution working correctly
Post-Installation:
□ mTLS enabled cluster-wide (STRICT mode)
□ Sidecar injection configured (automatic/manual)
□ Monitoring dashboards accessible
□ Health checks and readiness probes adjusted
□ Certificate rotation configured
□ Resource limits set on proxies
Traffic Management:
□ VirtualService defines routing rules
□ DestinationRule configures load balancing
□ Circuit breaking thresholds set
□ Retry policies configured
□ Timeouts appropriate for services
Security:
□ Authorization policies applied (default-deny)
□ PeerAuthentication enforces mTLS
□ Service accounts properly scoped
□ Ingress/egress gateways secured
□ Certificate validity monitored
# Install Istio (demo profile)
istioctl install --set profile=demo -y
# Enable sidecar injection
kubectl label namespace default istio-injection=enabled
# Deploy sample app
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
# Create ingress gateway
kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
# Check mesh status
istioctl proxy-status
# View metrics
kubectl -n istio-system port-forward svc/kiali 20001:20001
Canary Deployment:
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: reviews-canary
spec:
hosts:
- reviews
http:
- match:
- headers:
end-user:
exact: jason
route:
- destination:
host: reviews
subset: v2
- route:
- destination:
host: reviews
subset: v1
weight: 90
- destination:
host: reviews
subset: v2
weight: 10
Circuit Breaking:
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: reviews-circuit-breaker
spec:
host: reviews
trafficPolicy:
connectionPool:
tcp:
maxConnections: 100
http:
http1MaxPendingRequests: 10
maxRequestsPerConnection: 2
outlierDetection:
consecutiveErrors: 5
interval: 30s
baseEjectionTime: 30s
maxEjectionPercent: 50
Zero Trust Security:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: deny-all
namespace: default
spec:
{} # Empty spec denies all traffic
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: allow-frontend-to-backend
spec:
selector:
matchLabels:
app: backend
action: ALLOW
rules:
- from:
- source:
principals: ["cluster.local/ns/default/sa/frontend"]
to:
- operation:
methods: ["GET", "POST"]
📚 Full Examples: See REFERENCE.md for complete code samples, detailed configurations, and production-ready implementations.
Implementation Guide
The control plane manages and configures the data plane proxies:
Core Functions:
Istiod Components:
See REFERENCE.md for complete implementation.
Sidecar Pattern:
See REFERENCE.md for complete implementation.
Envoy Capabilities:
See REFERENCE.md for complete implementation.
1. IstioOperator (Recommended):
See REFERENCE.md for complete implementation.
2. Helm Installation:
See REFERENCE.md for complete implementation.
3. Production Profile:
See REFERENCE.md for complete implementation.
Automatic Injection (Namespace-level):
# Label namespace for injection
kubectl label namespace production istio-injection=enabled
# Verify
kubectl get namespace -L istio-injection
Manual Injection (Pod-level):
# Inject sidecar into existing deployment
kubectl get deployment myapp -o yaml | \
istioctl kube-inject -f - | \
kubectl apply -f -
Selective Injection (Pod annotation):
apiVersion: v1
kind: Pod
metadata:
name: myapp
annotations:
sidecar.istio.io/inject: "true" # Explicit injection
spec:
containers:
- name: app
image: myapp:v1
See REFERENCE.md for complete implementation.
Gradual Rollout Strategy:
See REFERENCE.md for complete implementation.
Progressive Rollout Script:
See REFERENCE.md for complete implementation.
Zero-Downtime Cutover:
See REFERENCE.md for complete implementation.
Cutover Process:
See REFERENCE.md for complete implementation.
User Cohort Routing:
See REFERENCE.md for complete implementation.
Shadow Testing:
See REFERENCE.md for complete implementation.
Use Cases:
Installation:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/kiali.yaml
# Access dashboard
istioctl dashboard kiali
Key Features:
Kiali Configuration:
See REFERENCE.md for complete implementation.
Installation:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/jaeger.yaml
# Access UI
istioctl dashboard jaeger
Enable Tracing in Mesh:
See REFERENCE.md for complete implementation.
Application Instrumentation:
See REFERENCE.md for complete implementation.
Prometheus Installation:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/prometheus.yaml
Key Metrics:
See REFERENCE.md for complete implementation.
Grafana Dashboards:
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/grafana.yaml
istioctl dashboard grafana
Custom Dashboard (JSON):
See REFERENCE.md for complete implementation.
Enable Strict mTLS (Cluster-wide):
See REFERENCE.md for complete implementation.
Per-Namespace mTLS:
See REFERENCE.md for complete implementation.
Per-Port mTLS:
See REFERENCE.md for complete implementation.
Default Deny:
See REFERENCE.md for complete implementation.
Allow Specific Services:
See REFERENCE.md for complete implementation.
JWT Authentication:
See REFERENCE.md for complete implementation.
RBAC with Custom Claims:
See REFERENCE.md for complete implementation.
Configuration:
See REFERENCE.md for complete implementation.
Testing Circuit Breaker:
See REFERENCE.md for complete implementation.
Retry Configuration:
See REFERENCE.md for complete implementation.
Timeout Configuration:
See REFERENCE.md for complete implementation.
Fault Injection (Chaos Testing):
See REFERENCE.md for complete implementation.
Local Rate Limiting (Envoy):
See REFERENCE.md for complete implementation.
Primary-Remote Model:
See REFERENCE.md for complete implementation.
See REFERENCE.md for complete implementation.
Cross-Cluster Service Discovery:
See REFERENCE.md for complete implementation.
Sidecar Resource Limits:
See REFERENCE.md for complete implementation.
Sidecar Scoping:
See REFERENCE.md for complete implementation.
Reduce Metrics Cardinality:
See REFERENCE.md for complete implementation.
Sampling Configuration:
See REFERENCE.md for complete implementation.
See REFERENCE.md for complete implementation.
// TODO: Add advanced example for service-mesh
// This example shows production-ready patterns
// TODO: Add integration example showing how service-mesh
// works with other systems and services
See examples/service-mesh/ for complete working examples.
This skill integrates with:
Problem: Not testing edge cases and error conditions leads to production bugs
Solution: Implement comprehensive test coverage including:
Prevention: Enforce minimum code coverage (80%+) in CI/CD pipeline
Problem: Hardcoding values makes applications inflexible and environment-dependent
Solution: Use environment variables and configuration management:
Prevention: Use tools like dotenv, config validators, and secret scanners
Problem: Security vulnerabilities from not following established security patterns
Solution: Follow security guidelines:
Prevention: Use security linters, SAST tools, and regular dependency updates
Best Practices: