AgentAlley

Skills · Infrastructure & ops

Linkerd Patterns

Unverified●21/40

Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

Originally by wshobson · MIT

Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add linkerd-patterns

This command does not work yet — the CLI is still being built. Until then, use Raw in the reader below to take the file.

Who is stuck, and on what

Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

The whole source

No sign-in, no blur, nothing truncated
linkerd-patterns/SKILL.md306 lines7.7 KBRawView on GitHub
Frontmatter — 2 properties
namelinkerd-patterns
descriptionImplement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
1---
2name: linkerd-patterns
3description: Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
4---A5 — No allowed-tools declared — no way to tell what this skill may touch
5 
6# Linkerd Patterns
7 
8Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.
9 
10## When to Use This Skill
11 
12- Setting up a lightweight service mesh
13- Implementing automatic mTLS
14- Configuring traffic splits for canary deployments
15- Setting up service profiles for per-route metrics
16- Implementing retries and timeouts
17- Multi-cluster service mesh
18 
19## Core Concepts
20 
21### 1. Linkerd Architecture
22 
23```
24┌─────────────────────────────────────────────┐
25│ Control Plane │
26│ ┌─────────┐ ┌──────────┐ ┌──────────────┐ │
27│ │ destiny │ │ identity │ │ proxy-inject │ │
28│ └─────────┘ └──────────┘ └──────────────┘ │
29└─────────────────────────────────────────────┘
30 │
31┌─────────────────────────────────────────────┐
32│ Data Plane │
33│ ┌─────┐ ┌─────┐ ┌─────┐ │
34│ │proxy│────│proxy│────│proxy│ │
35│ └─────┘ └─────┘ └─────┘ │
36│ │ │ │ │
37│ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ │
38│ │ app │ │ app │ │ app │ │
39│ └─────┘ └─────┘ └─────┘ │
40└─────────────────────────────────────────────┘
41```
42 
43### 2. Key Resources
44 
45| Resource | Purpose |
46| ----------------------- | ------------------------------------ |
47| **ServiceProfile** | Per-route metrics, retries, timeouts |
48| **TrafficSplit** | Canary deployments, A/B testing |
49| **Server** | Define server-side policies |
50| **ServerAuthorization** | Access control policies |
51 
52## Templates
53 
54### Template 1: Mesh Installation
55 
56```bash
57# Install CLI
58curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | shA1 — Downloads and executes without reading firstA4 — This skill pulls in web or user content but never says to treat that content as data. A signal, not proof.
59 
60# Validate cluster
61linkerd check --pre
62 
63# Install CRDs
64linkerd install --crds | kubectl apply -f -
65 
66# Install control plane
67linkerd install | kubectl apply -f -
68 
69# Verify installation
70linkerd check
71 
72# Install viz extension (optional)
73linkerd viz install | kubectl apply -f -
74```
75 
76### Template 2: Inject Namespace
77 
78```yaml
79# Automatic injection for namespace
80apiVersion: v1
81kind: Namespace
82metadata:
83 name: my-app
84 annotations:
85 linkerd.io/inject: enabled
86---
87# Or inject specific deployment
88apiVersion: apps/v1
89kind: Deployment
90metadata:
91 name: my-app
92 annotations:
93 linkerd.io/inject: enabled
94spec:
95 template:
96 metadata:
97 annotations:
98 linkerd.io/inject: enabled
99```
100 
101### Template 3: Service Profile with Retries
102 
103```yaml
104apiVersion: linkerd.io/v1alpha2
105kind: ServiceProfile
106metadata:
107 name: my-service.my-namespace.svc.cluster.local
108 namespace: my-namespace
109spec:
110 routes:
111 - name: GET /api/users
112 condition:
113 method: GET
114 pathRegex: /api/users
115 responseClasses:
116 - condition:
117 status:
118 min: 500
119 max: 599
120 isFailure: true
121 isRetryable: true
122 - name: POST /api/users
123 condition:
124 method: POST
125 pathRegex: /api/users
126 # POST not retryable by default
127 isRetryable: false
128 - name: GET /api/users/{id}
129 condition:
130 method: GET
131 pathRegex: /api/users/[^/]+
132 timeout: 5s
133 isRetryable: true
134 retryBudget:
135 retryRatio: 0.2
136 minRetriesPerSecond: 10
137 ttl: 10s
138```
139 
140### Template 4: Traffic Split (Canary)
141 
142```yaml
143apiVersion: split.smi-spec.io/v1alpha1
144kind: TrafficSplit
145metadata:
146 name: my-service-canary
147 namespace: my-namespace
148spec:
149 service: my-service
150 backends:
151 - service: my-service-stable
152 weight: 900m # 90%
153 - service: my-service-canary
154 weight: 100m # 10%
155```
156 
157### Template 5: Server Authorization Policy
158 
159```yaml
160# Define the server
161apiVersion: policy.linkerd.io/v1beta1
162kind: Server
163metadata:
164 name: my-service-http
165 namespace: my-namespace
166spec:
167 podSelector:
168 matchLabels:
169 app: my-service
170 port: http
171 proxyProtocol: HTTP/1
172---
173# Allow traffic from specific clients
174apiVersion: policy.linkerd.io/v1beta1
175kind: ServerAuthorization
176metadata:
177 name: allow-frontend
178 namespace: my-namespace
179spec:
180 server:
181 name: my-service-http
182 client:
183 meshTLS:
184 serviceAccounts:
185 - name: frontend
186 namespace: my-namespace
187---
188# Allow unauthenticated traffic (e.g., from ingress)
189apiVersion: policy.linkerd.io/v1beta1
190kind: ServerAuthorization
191metadata:
192 name: allow-ingress
193 namespace: my-namespace
194spec:
195 server:
196 name: my-service-http
197 client:
198 unauthenticated: true
199 networks:
200 - cidr: 10.0.0.0/8
201```
202 
203### Template 6: HTTPRoute for Advanced Routing
204 
205```yaml
206apiVersion: policy.linkerd.io/v1beta2
207kind: HTTPRoute
208metadata:
209 name: my-route
210 namespace: my-namespace
211spec:
212 parentRefs:
213 - name: my-service
214 kind: Service
215 group: core
216 port: 8080
217 rules:
218 - matches:
219 - path:
220 type: PathPrefix
221 value: /api/v2
222 - headers:
223 - name: x-api-version
224 value: v2
225 backendRefs:
226 - name: my-service-v2
227 port: 8080
228 - matches:
229 - path:
230 type: PathPrefix
231 value: /api
232 backendRefs:
233 - name: my-service-v1
234 port: 8080
235```
236 
237### Template 7: Multi-cluster Setup
238 
239```bash
240# On each cluster, install with cluster credentials
241linkerd multicluster install | kubectl apply -f -
242 
243# Link clusters
244linkerd multicluster link --cluster-name west \
245 --api-server-address https://west.example.com:6443 \
246 | kubectl apply -f -
247 
248# Export a service to other clusters
249kubectl label svc/my-service mirror.linkerd.io/exported=true
250 
251# Verify cross-cluster connectivity
252linkerd multicluster check
253linkerd multicluster gateways
254```
255 
256## Monitoring Commands
257 
258```bash
259# Live traffic view
260linkerd viz top deploy/my-app
261 
262# Per-route metrics
263linkerd viz routes deploy/my-app
264 
265# Check proxy status
266linkerd viz stat deploy -n my-namespace
267 
268# View service dependencies
269linkerd viz edges deploy -n my-namespace
270 
271# Dashboard
272linkerd viz dashboard
273```
274 
275## Debugging
276 
277```bash
278# Check injection status
279linkerd check --proxy -n my-namespace
280 
281# View proxy logs
282kubectl logs deploy/my-app -c linkerd-proxy
283 
284# Debug identity/TLS
285linkerd identity -n my-namespace
286 
287# Tap traffic (live)
288linkerd viz tap deploy/my-app --to deploy/my-backend
289```
290 
291## Best Practices
292 
293### Do's
294 
295- **Enable mTLS everywhere** - It's automatic with Linkerd
296- **Use ServiceProfiles** - Get per-route metrics and retries
297- **Set retry budgets** - Prevent retry storms
298- **Monitor golden metrics** - Success rate, latency, throughput
299 
300### Don'ts
301 
302- **Don't skip check** - Always run `linkerd check` after changes
303- **Don't over-configure** - Linkerd defaults are sensible
304- **Don't ignore ServiceProfiles** - They unlock advanced features
305- **Don't forget timeouts** - Set appropriate values per route
306 

Reviews

Installed this one?Write the first review and take the Trailblazer badge.

Reviews only open after a real install, so this is empty — and we leave it empty rather than invent one.

Alternatives

Also in Infrastructure & ops
Paper Poster (HTML): measurement-gated poster generationDEFAULT poster pipeline — build an academic conference poster (ICML/NeurIPS/ICLR/CVPR/...) as a single HTML/CSS file with measurement-driven hard gates, real paper figures, a two-hue design-token system, and print-ready PDF via headless Chromium. Use when theInfrastructure & ops · MIT●····●36/40Brand Monitoring 📡Brand monitoring tool for tracking mentions across social media platforms. Monitor Reddit, Google News, YouTube, and DuckDuckGo for brand mentions. Includes sentiment analysis, trend tracking, crisis detection, and competitor comparison. No API key required foInfrastructure & ops · MIT◐····●34/40Spark Memory & Thermal OpsManage unified memory and thermals during long-running ML jobs on NVIDIA DGX Spark. Use when planning memory headroom for a training run on GB10, when a job OOMs on unified memory, or when monitoring temperature and power during multi-hour training.Infrastructure & ops · MIT◐····●32/40Secrets ManagementImplement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.Infrastructure & ops · MIT◐····●32/40