service-mesh

Skill: Service Mesh

Expertise: Istio and Linkerd installation, mTLS enforcement, traffic shifting, circuit breakers, retry policies, observability.

When to load

When implementing service-to-service mTLS, traffic shifting for canary deploys, circuit breakers, or setting up mesh-level observability.

Linkerd (lightweight — recommended for bare-metal K8s)

# Install Linkerd CLI
curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh

# Pre-flight check
linkerd check --pre

# Install Linkerd (cert-manager manages control plane certs)
linkerd install --crds | kubectl apply -f -
linkerd install \
  --set identity.externalCA=true \
  --set identity.issuer.scheme=kubernetes.io/tls \
  | kubectl apply -f -

# Install observability extension (Prometheus + Grafana)
linkerd viz install | kubectl apply -f -

# Verify
linkerd check

Linkerd: Inject Sidecar

# Namespace-level injection (all pods in namespace get sidecar)
metadata:
  annotations:
    linkerd.io/inject: enabled

# Per-deployment injection
spec:
  template:
    metadata:
      annotations:
        linkerd.io/inject: enabled

# Skip injection for a specific pod (e.g., database, cronjob)
metadata:
  annotations:
    linkerd.io/inject: disabled

Linkerd: Traffic Policies

# Retry policy (retry on 5xx up to 3 times)
apiVersion: policy.linkerd.io/v1beta3
kind: HTTPRoute
metadata:
  name: order-service-retries
  namespace: production
spec:
  parentRefs:
    - name: order-service
      kind: Service
      group: core
      port: 8080
  rules:
    - filters:
        - type: RequestRedirect   # or RequestMirror, URLRewrite
      backendRefs:
        - name: order-service
          port: 8080

---
# Timeout policy
apiVersion: policy.linkerd.io/v1alpha1
kind: ServiceProfile
metadata:
  name: order-service.production.svc.cluster.local
  namespace: production
spec:
  routes:
    - name: POST /orders
      condition:
        method: POST
        pathRegex: /orders
      timeout: 5s
      retryBudget:
        retryRatio: 0.2       # retry up to 20% of requests
        minRetriesPerSecond: 10
        ttl: 10s