Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
Add this skill
npx mdskills install sickn33/linkerd-patternsComprehensive templates and patterns with clear architecture diagrams and debugging tools
1---2name: linkerd-patterns3description: Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.4---56# Linkerd Patterns78Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.910## Do not use this skill when1112- The task is unrelated to linkerd patterns13- You need a different domain or tool outside this scope1415## Instructions1617- Clarify goals, constraints, and required inputs.18- Apply relevant best practices and validate outcomes.19- Provide actionable steps and verification.20- If detailed examples are required, open `resources/implementation-playbook.md`.2122## Use this skill when2324- Setting up a lightweight service mesh25- Implementing automatic mTLS26- Configuring traffic splits for canary deployments27- Setting up service profiles for per-route metrics28- Implementing retries and timeouts29- Multi-cluster service mesh3031## Core Concepts3233### 1. Linkerd Architecture3435```36┌─────────────────────────────────────────────┐37│ Control Plane │38│ ┌─────────┐ ┌──────────┐ ┌──────────────┐ │39│ │ destiny │ │ identity │ │ proxy-inject │ │40│ └─────────┘ └──────────┘ └──────────────┘ │41└─────────────────────────────────────────────┘42 │43┌─────────────────────────────────────────────┐44│ Data Plane │45│ ┌─────┐ ┌─────┐ ┌─────┐ │46│ │proxy│────│proxy│────│proxy│ │47│ └─────┘ └─────┘ └─────┘ │48│ │ │ │ │49│ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ │50│ │ app │ │ app │ │ app │ │51│ └─────┘ └─────┘ └─────┘ │52└─────────────────────────────────────────────┘53```5455### 2. Key Resources5657| Resource | Purpose |58|----------|---------|59| **ServiceProfile** | Per-route metrics, retries, timeouts |60| **TrafficSplit** | Canary deployments, A/B testing |61| **Server** | Define server-side policies |62| **ServerAuthorization** | Access control policies |6364## Templates6566### Template 1: Mesh Installation6768```bash69# Install CLI70curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh7172# Validate cluster73linkerd check --pre7475# Install CRDs76linkerd install --crds | kubectl apply -f -7778# Install control plane79linkerd install | kubectl apply -f -8081# Verify installation82linkerd check8384# Install viz extension (optional)85linkerd viz install | kubectl apply -f -86```8788### Template 2: Inject Namespace8990```yaml91# Automatic injection for namespace92apiVersion: v193kind: Namespace94metadata:95 name: my-app96 annotations:97 linkerd.io/inject: enabled98---99# Or inject specific deployment100apiVersion: apps/v1101kind: Deployment102metadata:103 name: my-app104 annotations:105 linkerd.io/inject: enabled106spec:107 template:108 metadata:109 annotations:110 linkerd.io/inject: enabled111```112113### Template 3: Service Profile with Retries114115```yaml116apiVersion: linkerd.io/v1alpha2117kind: ServiceProfile118metadata:119 name: my-service.my-namespace.svc.cluster.local120 namespace: my-namespace121spec:122 routes:123 - name: GET /api/users124 condition:125 method: GET126 pathRegex: /api/users127 responseClasses:128 - condition:129 status:130 min: 500131 max: 599132 isFailure: true133 isRetryable: true134 - name: POST /api/users135 condition:136 method: POST137 pathRegex: /api/users138 # POST not retryable by default139 isRetryable: false140 - name: GET /api/users/{id}141 condition:142 method: GET143 pathRegex: /api/users/[^/]+144 timeout: 5s145 isRetryable: true146 retryBudget:147 retryRatio: 0.2148 minRetriesPerSecond: 10149 ttl: 10s150```151152### Template 4: Traffic Split (Canary)153154```yaml155apiVersion: split.smi-spec.io/v1alpha1156kind: TrafficSplit157metadata:158 name: my-service-canary159 namespace: my-namespace160spec:161 service: my-service162 backends:163 - service: my-service-stable164 weight: 900m # 90%165 - service: my-service-canary166 weight: 100m # 10%167```168169### Template 5: Server Authorization Policy170171```yaml172# Define the server173apiVersion: policy.linkerd.io/v1beta1174kind: Server175metadata:176 name: my-service-http177 namespace: my-namespace178spec:179 podSelector:180 matchLabels:181 app: my-service182 port: http183 proxyProtocol: HTTP/1184---185# Allow traffic from specific clients186apiVersion: policy.linkerd.io/v1beta1187kind: ServerAuthorization188metadata:189 name: allow-frontend190 namespace: my-namespace191spec:192 server:193 name: my-service-http194 client:195 meshTLS:196 serviceAccounts:197 - name: frontend198 namespace: my-namespace199---200# Allow unauthenticated traffic (e.g., from ingress)201apiVersion: policy.linkerd.io/v1beta1202kind: ServerAuthorization203metadata:204 name: allow-ingress205 namespace: my-namespace206spec:207 server:208 name: my-service-http209 client:210 unauthenticated: true211 networks:212 - cidr: 10.0.0.0/8213```214215### Template 6: HTTPRoute for Advanced Routing216217```yaml218apiVersion: policy.linkerd.io/v1beta2219kind: HTTPRoute220metadata:221 name: my-route222 namespace: my-namespace223spec:224 parentRefs:225 - name: my-service226 kind: Service227 group: core228 port: 8080229 rules:230 - matches:231 - path:232 type: PathPrefix233 value: /api/v2234 - headers:235 - name: x-api-version236 value: v2237 backendRefs:238 - name: my-service-v2239 port: 8080240 - matches:241 - path:242 type: PathPrefix243 value: /api244 backendRefs:245 - name: my-service-v1246 port: 8080247```248249### Template 7: Multi-cluster Setup250251```bash252# On each cluster, install with cluster credentials253linkerd multicluster install | kubectl apply -f -254255# Link clusters256linkerd multicluster link --cluster-name west \257 --api-server-address https://west.example.com:6443 \258 | kubectl apply -f -259260# Export a service to other clusters261kubectl label svc/my-service mirror.linkerd.io/exported=true262263# Verify cross-cluster connectivity264linkerd multicluster check265linkerd multicluster gateways266```267268## Monitoring Commands269270```bash271# Live traffic view272linkerd viz top deploy/my-app273274# Per-route metrics275linkerd viz routes deploy/my-app276277# Check proxy status278linkerd viz stat deploy -n my-namespace279280# View service dependencies281linkerd viz edges deploy -n my-namespace282283# Dashboard284linkerd viz dashboard285```286287## Debugging288289```bash290# Check injection status291linkerd check --proxy -n my-namespace292293# View proxy logs294kubectl logs deploy/my-app -c linkerd-proxy295296# Debug identity/TLS297linkerd identity -n my-namespace298299# Tap traffic (live)300linkerd viz tap deploy/my-app --to deploy/my-backend301```302303## Best Practices304305### Do's306- **Enable mTLS everywhere** - It's automatic with Linkerd307- **Use ServiceProfiles** - Get per-route metrics and retries308- **Set retry budgets** - Prevent retry storms309- **Monitor golden metrics** - Success rate, latency, throughput310311### Don'ts312- **Don't skip check** - Always run `linkerd check` after changes313- **Don't over-configure** - Linkerd defaults are sensible314- **Don't ignore ServiceProfiles** - They unlock advanced features315- **Don't forget timeouts** - Set appropriate values per route316317## Resources318319- [Linkerd Documentation](https://linkerd.io/2.14/overview/)320- [Service Profiles](https://linkerd.io/2.14/features/service-profiles/)321- [Authorization Policy](https://linkerd.io/2.14/features/server-policy/)322
Full transparency — inspect the skill content before installing.