# Mesh Services

> Service mesh implementation and management

- Skill: `ffsshhttiikk/mesh-services` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/mesh-services`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/mesh-services/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/mesh-services

---


## What I do

- Implement service mesh architectures (Istio, Linkerd, Consul Connect)
- Configure traffic management and routing
- Implement mutual TLS between services
- Set up observability (tracing, metrics, logging)
- Manage service discovery
- Configure security policies

## When to use me

- When managing microservices communication
- When implementing zero-trust networking
- When debugging distributed systems
- When requiring traffic management (canary, blue-green)
- When implementing mTLS between services
- When building observable service networks

## Key Concepts

### Istio Architecture

```
┌─────────────────────────────────────────────────────┐
│                   Control Plane                     │
│  (Istiod - Pilot, Citadel, Galley)                  │
└──────────────────────┬──────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────┐
│                   Data Plane                         │
│  (Envoy Proxies - Sidecars)                         │
└──────────────────────┬──────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────┐
│              Service A    Service B                  │
└─────────────────────────────────────────────────────┘
```

### Virtual Service (Traffic Routing)

```yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myapp
spec:
  hosts:
    - myapp
  http:
    # Canary routing
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: myapp
            subset: v2
          weight: 100
    # Default routing
    - route:
        - destination:
            host: myapp
            subset: v1
          weight: 90
        - destination:
            host: myapp
            subset: v2
          weight: 10
    # Retry policy
    - retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: gateway-error,connect-failure,refused-stream
      route:
        - destination:
            host: myapp
```

### Destination Rule

```yaml
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: myapp
spec:
  host: myapp
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: UPGRADE
        http2MaxRequests: 1000
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: ISTIO_MUTUAL
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
```

### Peer Authentication (mTLS)

```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT
---
# Per-namespace
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: product-viewer
  namespace: production
spec:
  selector:
    matchLabels:
      app: product
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/sleep"]
      to:
        - operation:
            methods: ["GET"]
```

### Service Monitor

```yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: istio-component-monitor
  labels:
    release: prometheus
spec:
  selector:
    matchLabels:
      istio: mixer
  endpoints:
    - port: prometheus
      interval: 15s
```

### Linkerd Configuration

```yaml
apiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
  name: myapp.default.svc.cluster.local
spec:
  routes:
    - name: GET /
      condition:
        pathRegex: /
      responseClasses:
        - condition:
            status:
              min: 500
          isFailure: true
      isRetryable: true
      timeout: 10s
```

### Observability Integration

```yaml
# Jaeger tracing
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-default
spec:
  values:
    pilot:
      traceSampling: 1.0
    tracing:
    - enabled: true
      provider: jaeger
```

### Traffic Management Features

- **Canary Deployments**: Gradually shift traffic
- **A/B Testing**: Route based on headers/cookies
- **Circuit Breaking**: Prevent cascade failures
- **Rate Limiting**: Protect services
- **Fault Injection**: Test resilience
- **Mirror Traffic**: Copy requests for testing