用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/pluginagentmarketplace/custom-plugin-kubernetes --skill service-mesh命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | service-mesh |
| description | Service mesh implementation with Istio, Linkerd for traffic management |
| sasmp_version | 1.3.0 |
| eqhm_enabled | true |
| bonded_agent | 08-service-mesh-expert |
| bond_type | PRIMARY_BOND |
| capabilities | ["Istio configuration","Linkerd setup","Traffic management","mTLS","Circuit breaking","Canary deployments","Observability","Authorization policies"] |
| input_schema | {"type":"object","properties":{"action":{"type":"string","enum":["configure","route","secure","observe","debug"]},"mesh":{"type":"string","enum":["istio","linkerd"]},"traffic_policy":{"type":"string"}}} |
| output_schema | {"type":"object","properties":{"mesh_status":{"type":"string"},"traffic_flow":{"type":"object"},"metrics":{"type":"array"}}} |
Production-grade service mesh implementation covering Istio and Linkerd for traffic management, security, and observability. This skill provides deep expertise in implementing zero-trust networking, progressive delivery, and distributed system resilience.
Installation
# Install Istio with production profile
istioctl install --set profile=default \
--set meshConfig.enableAutoMtls=true \
--set meshConfig.accessLogFile=/dev/stdout
# Enable namespace injection
kubectl label namespace production istio-injection=enabled
Traffic Management
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: api-server
spec:
hosts:
- api-server
http:
- match:
- headers:
x-canary:
exact: "true"
route:
- destination:
host: api-server
subset: canary
- route:
- destination:
host: api-server
subset: stable
weight: 90
Strict mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: default
namespace: production
spec:
mtls:
mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: api-server-authz
namespace: production
spec:
selector:
matchLabels:
app: api-server
action: ALLOW
rules:
- from:
- source:
principals: ["cluster.local/ns/production/sa/frontend"]
to:
- operation:
methods: ["GET", "POST"]
paths: ["/api/*"]
Resilience Configuration
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: api-server-resilience
spec:
host: api-server
trafficPolicy:
connectionPool:
tcp:
maxConnections: 100
connectTimeout: 5s
http:
http1MaxPendingRequests: 100
http2MaxRequests: 1000
maxRequestsPerConnection: 100
maxRetries: 3
outlierDetection:
consecutive5xxErrors: 5
interval: 10s
baseEjectionTime: 30s
maxEjectionPercent: 50
minHealthPercent: 30
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: api-server-retry
spec:
hosts:
- api-server
http:
- route:
- destination:
host: api-server
timeout: 10s
retries:
attempts: 3
perTryTimeout: 3s
retryOn: 5xx,reset,connect-failure
Installation
# Install Linkerd
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -
# Enable namespace
kubectl annotate namespace production linkerd.io/inject=enabled
Service Profile
apiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
name: api-server.production.svc.cluster.local
namespace: production
spec:
routes:
- name: GET /api/users
condition:
method: GET
pathRegex: /api/users/.*
responseClasses:
- condition:
status:
min: 500
max: 599
isFailure: true
timeout: 5s
retries:
maxRetries: 3
budget:
retryratio: 0.2
minRetriesPerSecond: 10
ttl: 10s
Kiali Dashboard
apiVersion: v1
kind: ConfigMap
metadata:
name: kiali
namespace: istio-system
data:
config.yaml: |
auth:
strategy: anonymous
server:
port: 20001
external_services:
prometheus:
url: http://prometheus:9090
grafana:
url: http://grafana:3000
jaeger:
url: http://jaeger:16686
Distributed Tracing
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
name: tracing
namespace: istio-system
spec:
tracing:
- providers:
- name: jaeger
randomSamplingPercentage: 10
Service Mesh Issue?
│
├── Traffic not routing
│ ├── Check VirtualService
│ ├── Verify sidecar injection
│ └── Check DestinationRule subsets
│
├── mTLS errors
│ ├── Check PeerAuthentication
│ ├── Verify certificates
│ └── Check service accounts
│
└── High latency
├── Check circuit breaker
├── Review timeout settings
└── Check sidecar resources
# Istio debugging
istioctl analyze
istioctl proxy-status
istioctl proxy-config routes <pod>
# Check mTLS
istioctl authn tls-check <pod>
# Linkerd debugging
linkerd check
linkerd viz stat deploy
linkerd viz tap deploy/api-server
| Challenge | Solution |
|---|---|
| Sidecar injection | Check namespace labels |
| mTLS failures | Verify PeerAuthentication |
| Routing errors | Check VirtualService |
| Performance | Tune sidecar resources |
| Metric | Target |
|---|---|
| mTLS coverage | 100% |
| Request success | >99.9% |
| P99 overhead | <5ms |
| Tracing coverage | >90% |