service-mesh

# Skill: Service Mesh > **Expertise:** Istio and Linkerd installation, mTLS enforcement, traffic shifting, circuit breakers, retry policies, observability. ## When to load When implementing service-to-service mTLS, traffic shifting for canary deploys, circuit breakers, or setting up mesh-level observability. ## Linkerd (lightweight — recommended for bare-metal K8s) ```bash # Install Linkerd CLI curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh # Pre-flight check linkerd check --pre # Install Linkerd (cert-manager manages control plane certs) linkerd install --crds | kubectl apply -f - linkerd install \ --set identity.externalCA=true \ --set identity.issuer.scheme=kubernetes.io/tls \ | kubectl apply -f - # Install observability extension (Prometheus + Grafana) linkerd viz install | kubectl apply -f - # Verify linkerd check ``` ## Linkerd: Inject Sidecar ```yaml # Namespace-level injection (all pods in namespace get sidecar) metadata: annotations: linkerd.io/inject: enabled # Per-deployment injection spec: template: metadata: annotations: linkerd.io/inject: enabled # Skip injection for a specific pod (e.g., database, cronjob) metadata: annotations: linkerd.io/inject: disabled ``` ## Linkerd: Traffic Policies ```yaml # Retry policy (retry on 5xx up to 3 times) apiVersion: policy.linkerd.io/v1beta3 kind: HTTPRoute metadata: name: order-service-retries namespace: production spec: parentRefs: - n...