k8s-service-mesh

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Kubernetes Service Mesh (Istio)

Kubernetes服务网格（Istio）

Traffic management, security, and observability using kubectl-mcp-server's Istio/Kiali tools.

借助kubectl-mcp-server的Istio/Kiali工具实现流量管理、安全与可观测性。

When to Apply

适用场景

Use this skill when:

User mentions: "Istio", "service mesh", "mTLS", "VirtualService", "traffic shifting"
Operations: traffic management, canary deployments, security policies
Keywords: "sidecar", "proxy", "traffic split", "mutual TLS"

在以下场景中使用本技能：

用户提及："Istio"、"service mesh"、"mTLS"、"VirtualService"、"traffic shifting"
操作需求：流量管理、金丝雀部署、安全策略配置
关键词："sidecar"、"proxy"、"traffic split"、"mutual TLS"

Priority Rules

优先级规则

Priority	Rule	Impact	Tools
1	Detect Istio installation first	CRITICAL	`istio_detect_tool`
2	Run analyze before changes	HIGH	`istio_analyze_tool`
3	Check proxy status for sync	HIGH	`istio_proxy_status_tool`
4	Verify sidecar injection	MEDIUM	`istio_sidecar_status_tool`

优先级	规则	影响程度	工具
1	先检测Istio安装状态	关键	`istio_detect_tool`
2	执行变更前先运行分析	高	`istio_analyze_tool`
3	检查代理同步状态	高	`istio_proxy_status_tool`
4	验证sidecar注入情况	中	`istio_sidecar_status_tool`

Quick Reference

快速参考

Task	Tool	Example
Detect Istio	`istio_detect_tool`	`istio_detect_tool()`
Analyze config	`istio_analyze_tool`	`istio_analyze_tool(namespace)`
Proxy status	`istio_proxy_status_tool`	`istio_proxy_status_tool()`
List VirtualServices	`istio_virtualservices_list_tool`	`istio_virtualservices_list_tool(namespace)`

任务	工具	示例
检测Istio	`istio_detect_tool`	`istio_detect_tool()`
分析配置	`istio_analyze_tool`	`istio_analyze_tool(namespace)`
代理状态	`istio_proxy_status_tool`	`istio_proxy_status_tool()`
列出VirtualServices	`istio_virtualservices_list_tool`	`istio_virtualservices_list_tool(namespace)`

Quick Status Check

快速状态检查

Detect Istio Installation

检测Istio安装状态

python

istio_detect_tool()

python

istio_detect_tool()

Check Proxy Status

检查代理状态

python

istio_proxy_status_tool()
istio_sidecar_status_tool(namespace)

python

istio_proxy_status_tool()
istio_sidecar_status_tool(namespace)

Analyze Configuration

分析配置

python

istio_analyze_tool(namespace)

python

istio_analyze_tool(namespace)

Traffic Management

流量管理

VirtualServices

List and inspect:

python

istio_virtualservices_list_tool(namespace)
istio_virtualservice_get_tool(name, namespace)

See TRAFFIC-SHIFTING.md for canary and blue-green patterns.

列出并查看：

python

istio_virtualservices_list_tool(namespace)
istio_virtualservice_get_tool(name, namespace)

查看TRAFFIC-SHIFTING.md了解金丝雀和蓝绿发布模式。

DestinationRules

python

istio_destinationrules_list_tool(namespace)

python

istio_destinationrules_list_tool(namespace)

Gateways

python

istio_gateways_list_tool(namespace)

python

istio_gateways_list_tool(namespace)

Traffic Shifting Patterns

流量切换模式

Canary Release (Weight-Based)

金丝雀发布（基于权重）

VirtualService for 90/10 split:

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service
spec:
  hosts:
  - my-service
  http:
  - route:
    - destination:
        host: my-service
        subset: stable
      weight: 90
    - destination:
        host: my-service
        subset: canary
      weight: 10

Apply and verify:

python

kubectl_apply(vs_yaml, namespace)
istio_virtualservice_get_tool("my-service", namespace)

实现90/10流量分配的VirtualService：

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service
spec:
  hosts:
  - my-service
  http:
  - route:
    - destination:
        host: my-service
        subset: stable
      weight: 90
    - destination:
        host: my-service
        subset: canary
      weight: 10

应用并验证：

python

kubectl_apply(vs_yaml, namespace)
istio_virtualservice_get_tool("my-service", namespace)

Header-Based Routing

基于Header的路由

Route beta users:

yaml

http:
- match:
  - headers:
      x-user-type:
        exact: beta
  route:
  - destination:
      host: my-service
      subset: canary
- route:
  - destination:
      host: my-service
      subset: stable

将beta用户路由至指定服务：

yaml

http:
- match:
  - headers:
      x-user-type:
        exact: beta
  route:
  - destination:
      host: my-service
      subset: canary
- route:
  - destination:
      host: my-service
      subset: stable

Security (mTLS)

安全（mTLS）

See MTLS.md for detailed mTLS configuration.

查看MTLS.md获取详细的mTLS配置说明。

PeerAuthentication (mTLS Mode)

PeerAuthentication（mTLS模式）

python

istio_peerauthentications_list_tool(namespace)

python

istio_peerauthentications_list_tool(namespace)

AuthorizationPolicy

python

istio_authorizationpolicies_list_tool(namespace)

python

istio_authorizationpolicies_list_tool(namespace)

Observability

可观测性

Proxy Metrics

代理指标

python

istio_proxy_status_tool()

python

istio_proxy_status_tool()

Hubble (Cilium Integration)

Hubble（与Cilium集成）

If using Cilium with Istio:

python

hubble_flows_query_tool(namespace)
cilium_endpoints_list_tool(namespace)

若将Istio与Cilium配合使用：

python

hubble_flows_query_tool(namespace)
cilium_endpoints_list_tool(namespace)

Troubleshooting

故障排查

Sidecar Not Injected

Sidecar未注入

python

istio_sidecar_status_tool(namespace)

python

istio_sidecar_status_tool(namespace)

Traffic Not Routing

流量未正确路由

python

istio_analyze_tool(namespace)
istio_virtualservice_get_tool(name, namespace)
istio_destinationrules_list_tool(namespace)
istio_proxy_status_tool()

python

istio_analyze_tool(namespace)
istio_virtualservice_get_tool(name, namespace)
istio_destinationrules_list_tool(namespace)
istio_proxy_status_tool()

mTLS Failures

mTLS失败

python

istio_peerauthentications_list_tool(namespace)

python

istio_peerauthentications_list_tool(namespace)

Common Issues

常见问题

Symptom	Check	Resolution
503 errors	`istio_analyze_tool()`	Fix VirtualService/DestinationRule
No sidecar	`istio_sidecar_status_tool()`	Label namespace
Config not applied	`istio_proxy_status_tool()`	Wait for sync or restart pod

症状	检查项	解决方案
503错误	`istio_analyze_tool()`	修复VirtualService/DestinationRule配置
无sidecar	`istio_sidecar_status_tool()`	为命名空间添加标签
配置未生效	`istio_proxy_status_tool()`	等待同步或重启Pod

Multi-Cluster Service Mesh

多集群服务网格

Istio multi-cluster setup:

python

istio_proxy_status_tool(context="primary")
istio_virtualservices_list_tool(namespace, context="primary")

istio_proxy_status_tool(context="remote")

Istio多集群配置：

python

istio_proxy_status_tool(context="primary")
istio_virtualservices_list_tool(namespace, context="primary")

istio_proxy_status_tool(context="remote")

Prerequisites

前置条件

Istio: Required for all Istio tools
bash
```
istioctl install --set profile=demo
```

Istio：所有Istio工具均需依赖Istio
bash
```
istioctl install --set profile=demo
```

k8s-service-mesh

Original

Translation

Kubernetes Service Mesh (Istio)

Kubernetes服务网格（Istio）

When to Apply

适用场景

Priority Rules

优先级规则

Quick Reference

快速参考

Quick Status Check

快速状态检查

Detect Istio Installation

检测Istio安装状态

Check Proxy Status

检查代理状态

Analyze Configuration

分析配置

Traffic Management

流量管理

VirtualServices

VirtualServices

DestinationRules

DestinationRules

Gateways

Gateways

Traffic Shifting Patterns

流量切换模式

Canary Release (Weight-Based)

金丝雀发布（基于权重）

Header-Based Routing

基于Header的路由

Security (mTLS)

安全（mTLS）

PeerAuthentication (mTLS Mode)

PeerAuthentication（mTLS模式）

AuthorizationPolicy

AuthorizationPolicy

Observability

可观测性

Proxy Metrics

代理指标

Hubble (Cilium Integration)

Hubble（与Cilium集成）

Troubleshooting

故障排查

Sidecar Not Injected

Sidecar未注入

Traffic Not Routing

流量未正确路由

mTLS Failures

mTLS失败

Common Issues

常见问题

Multi-Cluster Service Mesh

多集群服务网格

Prerequisites

前置条件

Related Skills

相关技能