PaperclipOrg
Claude Agent Skill · by Wshobson

Linkerd Patterns

Production-ready Linkerd configurations that actually work in the real world. Covers automatic mTLS injection, ServiceProfile setup for per-route retries, Traff

Install
Terminal · npx
$npx skills add https://github.com/wshobson/agents --skill linkerd-patterns
Works with Paperclip

How Linkerd Patterns fits into a Paperclip company.

Linkerd Patterns drops into any Paperclip agent that handles this kind of work. Assign it to a specialist inside a pre-configured PaperclipOrg company and the skill becomes available on every heartbeat — no prompt engineering, no tool wiring.

S
SaaS FactoryPaired

Pre-configured AI company — 18 agents, 18 skills, one-time purchase.

$27$59
Explore pack
Source file
SKILL.md305 lines
Expand
---name: linkerd-patternsdescription: Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.--- # Linkerd Patterns Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes. ## When to Use This Skill - Setting up a lightweight service mesh- Implementing automatic mTLS- Configuring traffic splits for canary deployments- Setting up service profiles for per-route metrics- Implementing retries and timeouts- Multi-cluster service mesh ## Core Concepts ### 1. Linkerd Architecture ```┌─────────────────────────────────────────────┐│                Control Plane                 ││  ┌─────────┐ ┌──────────┐ ┌──────────────┐ ││  │ destiny │ │ identity │ │ proxy-inject │ ││  └─────────┘ └──────────┘ └──────────────┘ │└─────────────────────────────────────────────┘                      │┌─────────────────────────────────────────────┐│                 Data Plane                   ││  ┌─────┐    ┌─────┐    ┌─────┐             ││  │proxy│────│proxy│────│proxy│             ││  └─────┘    └─────┘    └─────┘             ││     │           │           │               ││  ┌──┴──┐    ┌──┴──┐    ┌──┴──┐            ││  │ app │    │ app │    │ app │            ││  └─────┘    └─────┘    └─────┘            │└─────────────────────────────────────────────┘``` ### 2. Key Resources | Resource                | Purpose                              || ----------------------- | ------------------------------------ || **ServiceProfile**      | Per-route metrics, retries, timeouts || **TrafficSplit**        | Canary deployments, A/B testing      || **Server**              | Define server-side policies          || **ServerAuthorization** | Access control policies              | ## Templates ### Template 1: Mesh Installation ```bash# Install CLIcurl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh # Validate clusterlinkerd check --pre # Install CRDslinkerd install --crds | kubectl apply -f - # Install control planelinkerd install | kubectl apply -f - # Verify installationlinkerd check # Install viz extension (optional)linkerd viz install | kubectl apply -f -``` ### Template 2: Inject Namespace ```yaml# Automatic injection for namespaceapiVersion: v1kind: Namespacemetadata:  name: my-app  annotations:    linkerd.io/inject: enabled---# Or inject specific deploymentapiVersion: apps/v1kind: Deploymentmetadata:  name: my-app  annotations:    linkerd.io/inject: enabledspec:  template:    metadata:      annotations:        linkerd.io/inject: enabled``` ### Template 3: Service Profile with Retries ```yamlapiVersion: linkerd.io/v1alpha2kind: ServiceProfilemetadata:  name: my-service.my-namespace.svc.cluster.local  namespace: my-namespacespec:  routes:    - name: GET /api/users      condition:        method: GET        pathRegex: /api/users      responseClasses:        - condition:            status:              min: 500              max: 599          isFailure: true      isRetryable: true    - name: POST /api/users      condition:        method: POST        pathRegex: /api/users      # POST not retryable by default      isRetryable: false    - name: GET /api/users/{id}      condition:        method: GET        pathRegex: /api/users/[^/]+      timeout: 5s      isRetryable: true  retryBudget:    retryRatio: 0.2    minRetriesPerSecond: 10    ttl: 10s``` ### Template 4: Traffic Split (Canary) ```yamlapiVersion: split.smi-spec.io/v1alpha1kind: TrafficSplitmetadata:  name: my-service-canary  namespace: my-namespacespec:  service: my-service  backends:    - service: my-service-stable      weight: 900m # 90%    - service: my-service-canary      weight: 100m # 10%``` ### Template 5: Server Authorization Policy ```yaml# Define the serverapiVersion: policy.linkerd.io/v1beta1kind: Servermetadata:  name: my-service-http  namespace: my-namespacespec:  podSelector:    matchLabels:      app: my-service  port: http  proxyProtocol: HTTP/1---# Allow traffic from specific clientsapiVersion: policy.linkerd.io/v1beta1kind: ServerAuthorizationmetadata:  name: allow-frontend  namespace: my-namespacespec:  server:    name: my-service-http  client:    meshTLS:      serviceAccounts:        - name: frontend          namespace: my-namespace---# Allow unauthenticated traffic (e.g., from ingress)apiVersion: policy.linkerd.io/v1beta1kind: ServerAuthorizationmetadata:  name: allow-ingress  namespace: my-namespacespec:  server:    name: my-service-http  client:    unauthenticated: true    networks:      - cidr: 10.0.0.0/8``` ### Template 6: HTTPRoute for Advanced Routing ```yamlapiVersion: policy.linkerd.io/v1beta2kind: HTTPRoutemetadata:  name: my-route  namespace: my-namespacespec:  parentRefs:    - name: my-service      kind: Service      group: core      port: 8080  rules:    - matches:        - path:            type: PathPrefix            value: /api/v2        - headers:            - name: x-api-version              value: v2      backendRefs:        - name: my-service-v2          port: 8080    - matches:        - path:            type: PathPrefix            value: /api      backendRefs:        - name: my-service-v1          port: 8080``` ### Template 7: Multi-cluster Setup ```bash# On each cluster, install with cluster credentialslinkerd multicluster install | kubectl apply -f - # Link clusterslinkerd multicluster link --cluster-name west \  --api-server-address https://west.example.com:6443 \  | kubectl apply -f - # Export a service to other clusterskubectl label svc/my-service mirror.linkerd.io/exported=true # Verify cross-cluster connectivitylinkerd multicluster checklinkerd multicluster gateways``` ## Monitoring Commands ```bash# Live traffic viewlinkerd viz top deploy/my-app # Per-route metricslinkerd viz routes deploy/my-app # Check proxy statuslinkerd viz stat deploy -n my-namespace # View service dependencieslinkerd viz edges deploy -n my-namespace # Dashboardlinkerd viz dashboard``` ## Debugging ```bash# Check injection statuslinkerd check --proxy -n my-namespace # View proxy logskubectl logs deploy/my-app -c linkerd-proxy # Debug identity/TLSlinkerd identity -n my-namespace # Tap traffic (live)linkerd viz tap deploy/my-app --to deploy/my-backend``` ## Best Practices ### Do's - **Enable mTLS everywhere** - It's automatic with Linkerd- **Use ServiceProfiles** - Get per-route metrics and retries- **Set retry budgets** - Prevent retry storms- **Monitor golden metrics** - Success rate, latency, throughput ### Don'ts - **Don't skip check** - Always run `linkerd check` after changes- **Don't over-configure** - Linkerd defaults are sensible- **Don't ignore ServiceProfiles** - They unlock advanced features- **Don't forget timeouts** - Set appropriate values per route