cloudthinker-ai Service Mesh Health Check
Phase 1: Control Plane Health
Verify the control plane is functioning correctly.
- Control plane pods running and healthy
- Control plane version: ___
- Certificate authority status and certificate expiry dates
- Configuration validation (no rejected or conflicting configs)
- Control plane resource utilization (CPU, memory)
- Control plane high availability: replicas running vs desired
- API server connectivity from control plane
Phase 2: Data Plane Health
Assess sidecar proxy status across workloads.
| Namespace | Total Pods | Injected (%) | Proxy Version | Proxy Health | Config Sync Status |
|---|---|---|---|---|---|
- Identify pods without sidecar injection
- Identify pods with outdated proxy versions
- Check proxy resource utilization (CPU, memory per proxy)
- Verify proxy-to-control-plane connectivity
Phase 3: Security Assessment
- mTLS mode: STRICT / PERMISSIVE / DISABLED
- Percentage of traffic encrypted with mTLS: ___%
- Authorization policies in place: Y/N
- Peer authentication policies configured: Y/N
- Certificate rotation functioning: Y/N
- External traffic ingress security: reviewed
mTLS Coverage Matrix:
| Source Namespace | Destination Namespace | mTLS Status | Policy |
|---|---|---|---|
Phase 4: Traffic Management Review
- Virtual services configured and valid
- Destination rules configured and valid
- Traffic shifting / canary configurations reviewed
- Circuit breakers configured for critical services
- Retry and timeout policies appropriate
- Rate limiting policies in place where needed
Phase 5: Observability Verification
- Distributed tracing functional (sample traces verified)
- Metrics collection active (request rate, error rate, latency)
- Access logging configured appropriately
- Dashboards present and showing data
- Alerts configured for mesh-level failures
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Summary
- Mesh type/version: ___
- Cluster: ___
- Overall health: Healthy / Degraded / Unhealthy
- mTLS coverage: ___%
- Sidecar injection rate: ___%
- Critical findings: ___
Action Items
- Remediate any control plane issues immediately
- Upgrade outdated sidecar proxies
- Enable mTLS STRICT mode for namespaces still in PERMISSIVE
- Add missing authorization policies
- Fix observability gaps
- Schedule mesh upgrade if version is behind