| license | Apache-2.0 |
| name | service-mesh-microservices-expert |
| description | Istio, Envoy, circuit breakers, and service discovery for microservices. Activate on: service mesh, Istio, Envoy, sidecar, circuit breaker, service discovery, mTLS, traffic management. NOT for: API gateway edge routing (use api-gateway-reverse-proxy-expert), application-level observability (use observability-apm-expert). |
| allowed-tools | Read,Write,Edit,Bash(npm:*,npx:*,kubectl:*,istioctl:*) |
| category | Backend & Infrastructure |
| tags | ["service-mesh","istio","envoy","microservices","circuit-breaker"] |
| pairs-with | [{"skill":"api-gateway-reverse-proxy-expert","reason":"Gateway handles north-south; mesh handles east-west traffic"},{"skill":"observability-apm-expert","reason":"Mesh provides automatic telemetry for distributed tracing"},{"skill":"distributed-transaction-manager","reason":"Circuit breakers and retries affect transaction reliability"}] |
Service Mesh & Microservices Expert
Design and operate service meshes for secure, observable, and resilient microservice communication using Istio, Envoy, and Linkerd.
Activation Triggers
Activate on: "service mesh", "Istio", "Envoy", "sidecar proxy", "circuit breaker", "service discovery", "mTLS", "traffic management", "canary deployment", "Linkerd"
NOT for: Edge/API gateway → api-gateway-reverse-proxy-expert | Application instrumentation → observability-apm-expert | Container orchestration basics → relevant DevOps skill
Quick Start
- Evaluate need — service meshes add complexity; justified at 10+ services with cross-cutting concerns
- Choose mesh — Istio (full-featured), Linkerd (lightweight), Cilium (eBPF, no sidecar)
- Enable mTLS — zero-trust between all services, mesh handles certificate rotation
- Configure traffic policies — retries, timeouts, circuit breakers per service pair
- Deploy with canary — use mesh traffic splitting for safe rollouts (90/10, 80/20, etc.)
Core Capabilities
| Domain | Technologies |
|---|
| Meshes | Istio 1.24+, Linkerd 2.16+, Cilium Service Mesh |
| Data Plane | Envoy Proxy, Linkerd2-proxy, eBPF (Cilium) |
| Security | mTLS, SPIFFE/SPIRE, AuthorizationPolicy |
| Traffic | VirtualService, DestinationRule, traffic splitting |
| Observability | Kiali, automatic Prometheus metrics, distributed tracing |
Architecture Patterns
Sidecar Proxy Architecture (Istio)
┌────────────────── Pod ──────────────────┐
│ ┌──────────┐ ┌──────────────────┐ │
│ │ App │────→│ Envoy Sidecar │──┼──→ Other services
│ │ Container│←────│ (injected auto) │←─┼── (via their sidecars)
│ └──────────┘ └──────────────────┘ │
└─────────────────────────────────────────┘
Envoy intercepts all inbound/outbound traffic:
- mTLS encryption/decryption
- Retry, timeout, circuit breaking
- Metrics collection (RED)
- Access logging
- Traffic routing rules
Circuit Breaker + Retry Configuration
[]
