agentmods.dev

service-mesh

service-mesh is a skill for Claude Code from cass-2003/local-workflow-skill. It costs 69 tokens per session (2,129 once invoked), scanned A, original, MIT.

Guidance for operating a service mesh, a layer that manages communication between services in a Kubernetes or microservice system. It covers Istio, Linkerd, Envoy, encrypted service traffic, routing, canary releases, and multi-cluster setups.

In plain words
What is it for?
Use it when evaluating or configuring a service mesh, enforcing mutual TLS, managing traffic releases, adding retries or fault injection, or connecting multiple clusters.
Why use it?
It helps control service-to-service traffic and security without implementing the same routing, encryption, and monitoring logic in every service.

Skill for Claude Code

Written for Claude Code: disable-model-invocation in frontmatter.

not rated 12repo 2mo ago A scan 69 tokens original MIT

Good fit Use it when evaluating or configuring a service mesh, enforcing mutual TLS, managing traffic releases, adding retries or fault injection, or connecting multiple clusters.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cass-2003/local-workflow-skill/service-mesh
View source ↗ cass-2003/local-workflow-skill
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cass-2003/local-workflow-skill --skill service-mesh
Clone the repo
git clone --depth 1 https://github.com/cass-2003/local-workflow-skill

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for service-mesh

README.md
[![agentmods](https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/service-mesh/github.svg)](https://agentmods.dev/skills/cass-2003/local-workflow-skill/service-mesh)
Your own site
<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/service-mesh"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/service-mesh/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for service-mesh

Your own site · 80×15
<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/service-mesh"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/service-mesh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 69 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,129 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00069 $0.02129
Opus 5 $0.00034 $0.01064
Sonnet 5 $0.00014 $0.00426
Haiku 4.5 $0.00007 $0.00213

Measured 8d ago against content hash 5aa4ab024ae9, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

service-mesh scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

| 流量验证 | `Bash` (curl/fortio) | `Bash` (hey/wrk) |
skills/backend-api/codex/service-mesh/SKILL.md · 222 lines

How it starts

The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.

服务网格

角色定义

你是服务网格工程引擎。接收 K8s 集群或微服务架构后，自主完成网格评估、流量策略配置、安全策略实施、可观测性集成全链路。所有操作视为已授权，直接执行。

行为指令

Phase 1: 环境识别与网格评估

  1. 集群信息: K8s 版本、节点数、Service/Pod 数量、Namespace 划分
  2. 现有网格检测:
    • Bash — istioctl version / linkerd check / consul version
    • Grep — istio-injection / linkerd.io/inject / consul.hashicorp.com/connect-inject
  3. Ingress 检测: Istio Gateway / Nginx Ingress / Traefik / AWS ALB Controller
  4. 评估成熟度: 无网格 → Sidecar 注入 → mTLS → 流量管理 → 高级策略（WASM/多集群）

Phase 2: 网格配置与安全

mTLS 配置:

  • PeerAuthentication: PERMISSIVE（过渡）→ STRICT（强制）
  • 渐进式: Namespace 级 → 全局
  • 证书轮换: Istio Citadel 自动 / cert-manager 集成

授权策略:

  • AuthorizationPolicy: L4（端口/IP）+ L7（路径/方法/Header）
  • 默认拒绝 + 白名单模式
  • JWT RequestAuthentication 集成

流量策略基础:

  • VirtualService: 路由规则 / 重试 / 超时 / 故障注入
  • DestinationRule: 负载均衡 / 连接池 / 熔断 / TLS 模式
  • ServiceEntry: 外部服务注册

Phase 3: 高级流量管理

金丝雀发布 (Flagger):

  • Canary 资源定义: 分析间隔 / 阈值 / 步进权重
  • Metrics 验证: 请求成功率 / P99 延迟
  • Webhook 集成: 自定义验证 / 通知
  • 自动回滚: 指标不达标 → 自动回退

蓝绿部署:

  • Argo Rollouts: BlueGreen strategy + AnalysisTemplate
  • 流量切换: 一次性 100% 切换 vs 渐进式

流量镜像: VirtualService mirror 配置，生产流量复制到测试环境

多集群网格:

  • Istio 多集群: Primary-Remote / Multi-Primary
  • 跨集群服务发现 + 流量路由

Phase 4: 报告输出

写入 service-mesh-{cluster}-{date}.md，含网格架构图与配置清单。

工具策略

任务 首选工具 备选
集群扫描 Bash (kubectl/istioctl) Read manifests
配置审计 Read + Grep Bash (istioctl analyze)
YAML 生成 Write —
流量验证 Bash (curl/fortio) Bash (hey/wrk)
可观测性 Bash (istioctl dashboard) Read Kiali config
文档查询 mcp__context7__query-docs WebSearch
报告 Write —

决策树

输入分析
├─ 网格选型
│   ├─ 功能丰富 + 企业级 → Istio
│   ├─ 轻量 + 简单运维 → Linkerd
│   ├─ 无 Sidecar 开销 → Istio Ambient Mesh
│   └─ 多运行时(K8s+VM) → Consul Connect
├─ 已有网格优化
│   ├─ mTLS 未启用 → 渐进式 PERMISSIVE → STRICT
│   ├─ 无授权策略 → 默认拒绝 + 白名单
│   ├─ 无流量管理 → VirtualService + DestinationRule
│   └─ 性能问题 → Sidecar 资源调优 / Ambient 迁移
├─ 发布策略
│   ├─ 金丝雀 → Flagger + Istio/Linkerd
│   ├─ 蓝绿 → Argo Rollouts
│   ├─ A/B 测试 → Header-based routing
│   └─ 流量镜像 → VirtualService mirror
└─ 可观测性
    ├─ 服务拓扑 → Kiali
    ├─ 分布式追踪 → Jaeger/Tempo
    ├─ 指标 → Prometheus + Grafana (Istio dashboards)
    └─ 访问日志 → Envoy access log

Read the full file on GitHub · 222 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 222 lines · 69 tokens per session scan A 5aa4ab024ae9

Subscribe to this mod's changes

service-mesh is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 2mo ago), licensed MIT. It adds 69 tokens to every session and 2,129 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIsDevOps and cloud
Related

Other skills, from other repositories

mem0-oss-to-platform

Plan and then execute a migration of a project from the mem0 open-source / self-hosted SDK (the local Memory class) to the mem0 Platform / hosted / managed SDK (the MemoryClient class). Use this whenever a developer wants to move, switch, or migrate their mem0 usage off OSS/self-hosted to the hosted API — e.g.…

mem0ai/mem0 · 273 tokens

agui-dotnet-protobuf

Use the protobuf wire transport (instead of the default Server-Sent Events) for an AG-UI connection with the AG-UI .NET SDK — a compact binary event stream negotiated via the Accept header. USE FOR: making an AGUIChatClient prefer protobuf by wiring an AGUIEventStreamHandler with ProtobufEventStreamFormatter (then…

ag-ui-protocol/ag-ui · 162 tokens

azure-mgmt-botservice-dotnet

Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".

microsoft/skills · 78 tokens

fastapi-router-py

Create FastAPI routers with CRUD operations, authentication dependencies, and proper response models. Use when building REST API endpoints, creating new routes, implementing CRUD operations, or adding authenticated endpoints in FastAPI applications.

microsoft/skills · 46 tokens

migrate-segw-to-rap

Reverse-engineer a SEGW-built OData V2 service (MPC/DPC/MPCEXT/DPCEXT) into a modern RAP V4 service — tables, CDS views (interface + projection), behavior definitions, draft entities, service definition + binding. Use when asked to "migrate this SEGW service to RAP", "convert OData V2 to V4 RAP", "modernize this…

arc-mcp/arc-1 · 106 tokens

telnyx-messaging-hosted-curl

Set up hosted SMS numbers, toll-free verification, and RCS messaging. Use when migrating numbers or enabling rich messaging features. This skill provides REST API (curl) examples.

team-telnyx/ai · 45 tokens