Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Expert guide for operating service meshes including Istio and Linkerd. Covers traffic management, mutual TLS, observability, canary deployments, circuit breaking, fault injection, and production mesh operations in Kubernetes environments.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
371 lines · 1,231 words
You are an expert in deploying and operating service meshes in Kubernetes environments. You guide teams through mesh selection, traffic management, mutual TLS, observability, deployment strategies, and operational best practices for Istio, Linkerd, and related technologies.
Start simple, add incrementally - Begin with mTLS and observability. Add traffic management as needed.
Expert guide for operating service meshes including Istio and Linkerd. Covers traffic management, mutual TLS, observability, canary deployments, circuit breaking, fault injection, and production mesh operations in Kubernetes environments.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Service Mesh Operator skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an expert in deploying and operating service meshes in Kubernetes environments. You guide teams through mesh selection, traffic management, mutual TLS, observability, deployment strategies, and operational best practices for Istio, Linkerd, and related technologies.
What it covers
Core Principles
Mesh Selection
Istio Installation
Traffic Management
Mutual TLS
Authorization Policies
Canary Deployments with Flagger
Observability
Debugging
Linkerd Quick Start
Production Checklist
When to Use
Output Format
Example
Edge Cases
Mesh is infrastructure - Routing rules in mesh config, business rules in application code.
FEATURE ISTIO LINKERD CONSUL CONNECT
---------------------------------------------------------------------------
Complexity High Low Medium
Data plane Envoy linkerd2-proxy Envoy/built-in
Memory per pod ~100MB ~20MB ~60MB
mTLS Auto Auto Auto
Traffic mgmt Advanced Basic Medium
Learning curve Steep Gentle Moderate
Best for Complex traffic Simplicity-first HashiCorp stackCHOOSE ISTIO: Complex routing (canary, mirroring, fault injection), multi-cluster
CHOOSE LINKERD: Simplicity, low overhead, primary goal is mTLS + observability
NO MESH: <10 services, no regulatory mTLS requirementistioctl install --set profile=default \
--set meshConfig.accessLogFile=/dev/stdout \
--set meshConfig.defaultConfig.holdApplicationUntilProxyStarts=true
kubectl label namespace default istio-injection=enabled
istioctl analyzeapiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
name: user-service
spec:
hosts: [user-service]
http:
- match:
- headers:
x-canary: { exact: "true" }
route:
- destination: { host: user-service, subset: canary }
- route:
- destination: { host: user-service, subset: stable }
weight: 90
- destination: { host: user-service, subset: canary }
weight: 10
retries:
attempts: 3
perTryTimeout: 2s
retryOn: 5xx,reset,connect-failure
timeout: 10sapiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
name: user-service
spec:
host: user-service
trafficPolicy:
connectionPool:
tcp: { maxConnections: 100, connectTimeout: 5s }
http: { h2UpgradePolicy: DEFAULT, http1MaxPendingRequests: 100, http2MaxRequests: 1000 }
outlierDetection:
consecutive5xxErrors: 5
interval: 10s
baseEjectionTime: 30s
maxEjectionPercent: 50
loadBalancer:
simple: LEAST_REQUEST
subsets:
- name: stable
labels: { version: v1 }
- name: canary
labels: { version: v2 }apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
name: api-gateway
spec:
selector: { istio: ingressgateway }
servers:
- port: { number: 443, name: https, protocol: HTTPS }
tls: { mode: SIMPLE, credentialName: api-tls-cert }
hosts: [api.example.com]
- port: { number: 80, name: http, protocol: HTTP }
hosts: [api.example.com]
tls: { httpsRedirect: true }apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
name: default
namespace: istio-system
spec:
mtls: { mode: STRICT }apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
name: legacy
namespace: legacy-apps
spec:
mtls: { mode: PERMISSIVE }# Deny all by default
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: deny-all
namespace: production
spec: {}
---
# Allow specific service-to-service calls
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-order-to-user
namespace: production
spec:
selector:
matchLabels: { app: user-service }
action: ALLOW
rules:
- from:
- source:
principals: ["cluster.local/ns/production/sa/order-service"]
to:
- operation:
methods: ["GET"]
paths: ["/api/v1/users/*"]apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
name: user-service
spec:
targetRef:
apiVersion: apps/v1
kind: Deployment
name: user-service
service: { port: 8080 }
analysis:
interval: 1m
threshold: 5 # Max failed checks before rollback
maxWeight: 50
stepWeight: 10 # Increase canary 10% per step
metrics:
- name: request-success-rate
thresholdRange: { min: 99 }
interval: 1m
- name: request-duration
thresholdRange: { max: 500 }
interval: 1m# Success rate
sum(rate(istio_requests_total{destination_service="user-service",response_code!~"5.."}[5m]))
/ sum(rate(istio_requests_total{destination_service="user-service"}[5m]))
# P99 latency
histogram_quantile(0.99,
sum(rate(istio_request_duration_milliseconds_bucket{destination_service="user-service"}[5m]))
by (le))
# Error rate by source
sum(rate(istio_requests_total{destination_service="user-service",response_code=~"5.."}[5m]))
by (source_workload)Applications MUST forward these headers for distributed tracing:
x-request-id, x-b3-traceid, x-b3-spanid, x-b3-parentspanid
x-b3-sampled, traceparent, tracestateistioctl proxy-status # All proxy status
istioctl proxy-config routes deploy/user-service -n prod # Envoy routes
istioctl proxy-config clusters deploy/user-service # Envoy clusters
istioctl analyze -n production # Config issues
istioctl dashboard kiali # Mesh visualization
istioctl dashboard grafana # Metricslinkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -
linkerd check
kubectl annotate namespace production linkerd.io/inject=enabled
linkerd viz install | kubectl apply -f -
linkerd viz dashboardapiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
name: user-service.production.svc.cluster.local
spec:
routes:
- name: GET /api/v1/users/{id}
condition:
method: GET
pathRegex: /api/v1/users/[^/]+
isRetryable: true
retryBudget:
retryRatio: 0.2
minRetriesPerSecond: 10
ttl: 10sINSTALLATION:
[ ] Resource limits on sidecar proxies
[ ] Injection enabled per namespace (not globally)
[ ] holdApplicationUntilProxyStarts enabled
[ ] Control plane HA (min 2 replicas)
[ ] outboundTrafficPolicy: REGISTRY_ONLY
SECURITY:
[ ] Mesh-wide strict mTLS
[ ] Deny-by-default authorization policies
[ ] Service accounts per workload
[ ] Ingress TLS with valid certificates
[ ] Certificate rotation configured
TRAFFIC:
[ ] Retry policies with budgets
[ ] Circuit breakers on inter-service calls
[ ] Timeouts on all VirtualServices
[ ] Canary deployment pipeline tested
OBSERVABILITY:
[ ] Access logging (structured JSON)
[ ] Prometheus scraping mesh metrics
[ ] Grafana dashboards (latency, traffic, errors, saturation)
[ ] Distributed tracing with appropriate sampling
[ ] Applications propagate trace headers
[ ] Kiali or equivalent mesh visualizationUse this skill when:
Designing or implementing service mesh operator solutions
Reviewing or improving existing service mesh operator approaches
Making architectural or implementation decisions about service mesh operator
Learning service mesh operator patterns and best practices
Troubleshooting service mesh operator-related issues
Do NOT use this skill when:
The question is about a fundamentally different technology domain
A more specific sibling skill covers the exact topic needed
The user needs a complete hands-on tutorial rather than expert guidance
# Service Mesh Operator Analysis
## Context Assessment
[Situation summary and constraints]
## Recommended Approach
[Primary recommendation with rationale]
## Implementation Steps
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
## Trade-offs and Considerations
- [Key trade-off 1]
- [Key trade-off 2]
## Next Steps
- [Immediate action item]
- [Follow-up action item]Input: "Help me implement service mesh operator for a medium-scale production application"
Output: A structured analysis covering current state assessment, recommended service mesh operator approach with specific patterns, implementation roadmap with milestones, and risk mitigation strategies tailored to the application scale and constraints.
Legacy system integration: When service mesh operator must coexist with legacy approaches, provide a gradual migration path rather than a complete rewrite
Scale mismatch: When the solution complexity exceeds the project scale, recommend a simpler approach and note when to revisit
Team skill gaps: When the team lacks experience with the recommended approach, include learning resources and simpler alternatives
Conflicting requirements: When constraints conflict (e.g., performance vs. maintainability), explicitly state the trade-off and recommend based on stated priorities
SKILL.md
371 lines · 1,231 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Service Mesh Operator bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for