<< All versions
Skill v1.0.1
currentAutomated scan100/100rmyndharis/antigravity-skills/linkerd-patterns
2 files
──Details
PublishedMay 27, 2026 at 09:34 AM
Content Hashsha256:f68a11a546522ecd...
Git SHA4f9110cbfca4
Bump Typepatch
──Files
Files (1 file, 8.2 KB)
SKILL.md8.2 KBactive
SKILL.md · 323 lines · 8.2 KB
version: "1.0.1" name: linkerd-patterns description: Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
Linkerd Patterns
Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.
Do not use this skill when
- The task is unrelated to linkerd patterns
- You need a different domain or tool outside this scope
Instructions
- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open
resources/implementation-playbook.md.
Use this skill when
- Setting up a lightweight service mesh
- Implementing automatic mTLS
- Configuring traffic splits for canary deployments
- Setting up service profiles for per-route metrics
- Implementing retries and timeouts
- Multi-cluster service mesh
Core Concepts
1. Linkerd Architecture
┌─────────────────────────────────────────────┐│ Control Plane ││ ┌─────────┐ ┌──────────┐ ┌──────────────┐ ││ │ destiny │ │ identity │ │ proxy-inject │ ││ └─────────┘ └──────────┘ └──────────────┘ │└─────────────────────────────────────────────┘│┌─────────────────────────────────────────────┐│ Data Plane ││ ┌─────┐ ┌─────┐ ┌─────┐ ││ │proxy│────│proxy│────│proxy│ ││ └─────┘ └─────┘ └─────┘ ││ │ │ │ ││ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ ││ │ app │ │ app │ │ app │ ││ └─────┘ └─────┘ └─────┘ │└─────────────────────────────────────────────┘
2. Key Resources
| Resource | Purpose | |
|---|---|---|
| ServiceProfile | Per-route metrics, retries, timeouts | |
| TrafficSplit | Canary deployments, A/B testing | |
| Server | Define server-side policies | |
| ServerAuthorization | Access control policies |
Templates
Template 1: Mesh Installation
bash
# Install CLIcurl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh# Validate clusterlinkerd check --pre# Install CRDslinkerd install --crds | kubectl apply -f -# Install control planelinkerd install | kubectl apply -f -# Verify installationlinkerd check# Install viz extension (optional)linkerd viz install | kubectl apply -f -
Template 2: Inject Namespace
yaml
# Automatic injection for namespaceapiVersion: v1kind: Namespacemetadata:name: my-appannotations:linkerd.io/inject: enabled---# Or inject specific deploymentapiVersion: apps/v1kind: Deploymentmetadata:name: my-appannotations:linkerd.io/inject: enabledspec:template:metadata:annotations:linkerd.io/inject: enabled
Template 3: Service Profile with Retries
yaml
apiVersion: linkerd.io/v1alpha2kind: ServiceProfilemetadata:name: my-service.my-namespace.svc.cluster.localnamespace: my-namespacespec:routes:- name: GET /api/userscondition:method: GETpathRegex: /api/usersresponseClasses:- condition:status:min: 500max: 599isFailure: trueisRetryable: true- name: POST /api/userscondition:method: POSTpathRegex: /api/users# POST not retryable by defaultisRetryable: false- name: GET /api/users/{id}condition:method: GETpathRegex: /api/users/[^/]+timeout: 5sisRetryable: trueretryBudget:retryRatio: 0.2minRetriesPerSecond: 10ttl: 10s
Template 4: Traffic Split (Canary)
yaml
apiVersion: split.smi-spec.io/v1alpha1kind: TrafficSplitmetadata:name: my-service-canarynamespace: my-namespacespec:service: my-servicebackends:- service: my-service-stableweight: 900m # 90%- service: my-service-canaryweight: 100m # 10%
Template 5: Server Authorization Policy
yaml
# Define the serverapiVersion: policy.linkerd.io/v1beta1kind: Servermetadata:name: my-service-httpnamespace: my-namespacespec:podSelector:matchLabels:app: my-serviceport: httpproxyProtocol: HTTP/1---# Allow traffic from specific clientsapiVersion: policy.linkerd.io/v1beta1kind: ServerAuthorizationmetadata:name: allow-frontendnamespace: my-namespacespec:server:name: my-service-httpclient:meshTLS:serviceAccounts:- name: frontendnamespace: my-namespace---# Allow unauthenticated traffic (e.g., from ingress)apiVersion: policy.linkerd.io/v1beta1kind: ServerAuthorizationmetadata:name: allow-ingressnamespace: my-namespacespec:server:name: my-service-httpclient:unauthenticated: truenetworks:- cidr: 10.0.0.0/8
Template 6: HTTPRoute for Advanced Routing
yaml
apiVersion: policy.linkerd.io/v1beta2kind: HTTPRoutemetadata:name: my-routenamespace: my-namespacespec:parentRefs:- name: my-servicekind: Servicegroup: coreport: 8080rules:- matches:- path:type: PathPrefixvalue: /api/v2- headers:- name: x-api-versionvalue: v2backendRefs:- name: my-service-v2port: 8080- matches:- path:type: PathPrefixvalue: /apibackendRefs:- name: my-service-v1port: 8080
Template 7: Multi-cluster Setup
bash
# On each cluster, install with cluster credentialslinkerd multicluster install | kubectl apply -f -# Link clusterslinkerd multicluster link --cluster-name west \--api-server-address https://west.example.com:6443 \| kubectl apply -f -# Export a service to other clusterskubectl label svc/my-service mirror.linkerd.io/exported=true# Verify cross-cluster connectivitylinkerd multicluster checklinkerd multicluster gateways
Monitoring Commands
bash
# Live traffic viewlinkerd viz top deploy/my-app# Per-route metricslinkerd viz routes deploy/my-app# Check proxy statuslinkerd viz stat deploy -n my-namespace# View service dependencieslinkerd viz edges deploy -n my-namespace# Dashboardlinkerd viz dashboard
Debugging
bash
# Check injection statuslinkerd check --proxy -n my-namespace# View proxy logskubectl logs deploy/my-app -c linkerd-proxy# Debug identity/TLSlinkerd identity -n my-namespace# Tap traffic (live)linkerd viz tap deploy/my-app --to deploy/my-backend
Best Practices
Do's
- Enable mTLS everywhere - It's automatic with Linkerd
- Use ServiceProfiles - Get per-route metrics and retries
- Set retry budgets - Prevent retry storms
- Monitor golden metrics - Success rate, latency, throughput
Don'ts
- Don't skip check - Always run
linkerd checkafter changes - Don't over-configure - Linkerd defaults are sensible
- Don't ignore ServiceProfiles - They unlock advanced features
- Don't forget timeouts - Set appropriate values per route