home / skills / pluginagentmarketplace / custom-plugin-devops / service-mesh

service-mesh skill

safe

This skill helps you implement and manage service meshes like Istio or Linkerd for secure, observable, and reliable microservice communication.

npx playbooks add skill pluginagentmarketplace/custom-plugin-devops --skill service-mesh

Review the files below or copy the command above to add this skill to your agents.

Files (7)

SKILL.md

841 B

---
name: service-mesh
description: Service mesh technologies including Istio, Linkerd, Consul, and Envoy for microservices communication
sasmp_version: "1.3.0"
bonded_agent: 03-containers-orchestration
bond_type: SECONDARY_BOND
---

# Service Mesh Skill

## MANDATORY
- Service mesh fundamentals and sidecar pattern
- Istio installation and configuration
- Traffic management (routing, load balancing)
- mTLS and security policies
- Observability features (tracing, metrics)

## OPTIONAL
- Linkerd lightweight mesh
- Consul Connect
- Envoy proxy configuration
- Circuit breaking and retries
- Canary deployments with mesh

## ADVANCED
- Multi-cluster mesh federation
- Custom Envoy filters
- Performance tuning
- Zero-trust security architecture
- Service mesh for VMs

## Assets
- See `assets/service-mesh-config.yaml` for Istio templates

Overview

This skill covers service mesh technologies and patterns for secure, observable, and resilient microservice communication. It focuses on Istio fundamentals, traffic management, mTLS security, and observability while also addressing smaller meshes and Envoy customization. The material is geared toward DevOps engineers building CI/CD and deployment automation for cloud-native services.

How this skill works

The skill inspects and configures control plane and sidecar proxies to manage service-to-service traffic, security, and telemetry. It provides concrete guidance for installing and configuring Istio, implementing routing rules, enabling mutual TLS, and collecting traces and metrics. Optional modules cover Linkerd, Consul Connect, Envoy proxy tuning, and advanced federation and performance topics.

When to use it

When you need uniform traffic control and policy enforcement across microservices
When securing inter-service communication with mTLS and fine-grained authorization
When you require centralized observability (traces, metrics, logs) for debugging and SLOs
When implementing canary deployments, retries, and circuit breaking at the platform layer
When running multi-cluster workloads or integrating VMs with containerized services

Best practices

Adopt the sidecar pattern gradually: start with non-critical namespaces and incrementally expand
Enforce mTLS early for north-south and east-west traffic, then roll out RBAC and policies
Use declarative traffic rules and versioned config in CI/CD to manage routing and canaries
Collect distributed traces and metrics from Envoy sidecars; centralize storage and dashboards
Benchmark and tune Envoy and control-plane components under realistic load before production

Example use cases

Deploy Istio to enable A/B testing and progressive rollouts via traffic splitting
Enable automatic mTLS and RBAC across services to meet zero-trust security requirements
Use Linkerd as a lightweight alternative for small clusters that need simple observability
Configure Envoy filters for protocol-level transformations or custom rate-limiting
Federate meshes across clusters for cross-region service discovery and failover

FAQ

Which mesh should I choose for low overhead?

Linkerd is typically the lightest option; choose it for simple observability and minimal operational complexity.

How do I secure traffic between services?

Enable mutual TLS, enforce namespace-level policies, and apply RBAC and authorization policies at the mesh control plane.

Can I use service mesh with VMs?

Yes. Most meshes support hybrid environments by running sidecar or proxy instances alongside VM workloads and integrating them into the control plane.