# Service Mesh & Ingress Guide\n\n## Comparison\n\nThis guide helps you choose between different service mesh and ingress controller options for your Kubernetes deployments.\n\n### Understanding the Difference\n\n#### Service Mesh\n\nHandles **East-West traffic** (service-to-service communication):\n\n- Automatic mTLS encryption between services\n- Traffic management and routing\n- Observability and monitoring\n- Service discovery\n- Fault tolerance and resilience\n\n#### Ingress Controller\n\nHandles **North-South traffic** (external to internal):\n\n- Route external traffic into the cluster\n- TLS/HTTPS termination\n- Virtual hosts and path routing\n- Load balancing\n- Can work with or without a service mesh\n\n### Service Mesh Options\n\n#### Istio\n\n**Version**: 1.24.0\n\n**Best for**: Full-featured service mesh deployments with comprehensive observability\n\n**Key Features**:\n\n- ✅ Comprehensive feature set\n- ✅ Built-in Istio Gateway ingress controller\n- ✅ Advanced traffic management\n- ✅ Strong observability (Kiali, Grafana, Jaeger)\n- ✅ Virtual services, destination rules, traffic policies\n- ✅ Mutual TLS (mTLS) with automatic certificate rotation\n- ✅ Canary deployments and traffic mirroring\n\n**Resource Requirements**:\n\n- CPU: 500m (Pilot) + 100m per gateway\n- Memory: 2048Mi (Pilot) + 128Mi per gateway\n- High overhead\n\n**Pros**:\n\n- Industry-standard solution with large community\n- Rich feature set for complex requirements\n- Built-in ingress gateway (don't need external ingress)\n- Strong observability capabilities\n- Enterprise support available\n\n**Cons**:\n\n- Significant resource overhead\n- Complex configuration learning curve\n- Can be overkill for simple applications\n- Sidecar injection required for all services\n\n**Use when**:\n\n- You need comprehensive traffic management\n- Complex microservice patterns (canary deployments, traffic mirroring)\n- Enterprise requirements\n- You already understand service meshes\n- Your team has Istio expertise\n\n**Installation**:\n\n```\nprovisioning taskserv create istio\n```\n\n---\n\n#### Linkerd\n\n**Version**: 2.16.0\n\n**Best for**: Lightweight, high-performance service mesh with minimal complexity\n\n**Key Features**:\n\n- ✅ Ultra-lightweight (minimal resource footprint)\n- ✅ Simple configuration\n- ✅ Automatic mTLS with certificate rotation\n- ✅ Fast sidecar startup (built in Rust)\n- ✅ Live traffic visualization\n- ✅ Service topology and dependency discovery\n- ✅ Golden metrics out of the box (latency, success rate, throughput)\n\n**Resource Requirements**:\n\n- CPU proxy: 100m request, 1000m limit\n- Memory proxy: 20Mi request, 250Mi limit\n- Very lightweight compared to Istio\n\n**Pros**:\n\n- Minimal resource overhead\n- Simple, intuitive configuration\n- Fast startup and deployment\n- Built in Rust for performance\n- Excellent golden metrics\n- Good for resource-constrained environments\n- Can run alongside Istio\n\n**Cons**:\n\n- Fewer advanced features than Istio\n- Requires external ingress controller\n- Smaller ecosystem and fewer integrations\n- Less feature-rich traffic management\n- Requires cert-manager for mTLS\n\n**Use when**:\n\n- You want simplicity and minimal overhead\n- Running on resource-constrained clusters\n- You prefer straightforward configuration\n- You don't need advanced traffic management\n- You're using Kubernetes 1.21+\n\n**Installation**:\n\n```\n# Linkerd requires cert-manager\nprovisioning taskserv create cert-manager\nprovisioning taskserv create linkerd\nprovisioning taskserv create nginx-ingress  # Or traefik/contour\n```\n\n---\n\n#### Cilium\n\n**Version**: See existing Cilium taskserv\n\n**Best for**: CNI-based networking with integrated service mesh\n\n**Key Features**:\n\n- ✅ CNI and service mesh in one solution\n- ✅ eBPF-based for high performance\n- ✅ Network policy enforcement\n- ✅ Service mesh mode (optional)\n- ✅ Hubble for observability\n- ✅ Cluster mesh for multi-cluster\n\n**Pros**:\n\n- Replaces CNI plugin entirely\n- High-performance eBPF kernel networking\n- Can serve as both CNI and service mesh\n- No sidecar needed (uses eBPF)\n- Network policy support\n\n**Cons**:\n\n- Requires Linux kernel with eBPF support\n- Service mesh mode is secondary feature\n- More complex than Linkerd\n- Not as mature in service mesh role\n\n**Use when**:\n\n- You need both CNI and service mesh\n- You're on modern Linux kernels with eBPF\n- You want kernel-level networking\n\n---\n\n### Ingress Controller Options\n\n#### Nginx Ingress\n\n**Version**: 1.12.0\n\n**Best for**: Most Kubernetes deployments - proven, reliable, widely supported\n\n**Key Features**:\n\n- ✅ Battle-tested and production-proven\n- ✅ Most popular ingress controller\n- ✅ Extensive documentation and community\n- ✅ Rich configuration options\n- ✅ SSL/TLS termination\n- ✅ URL rewriting and routing\n- ✅ Rate limiting and DDoS protection\n\n**Pros**:\n\n- Proven stability in production\n- Widest community and ecosystem\n- Extensive documentation\n- Multiple commercial support options\n- Works with any service mesh\n- Moderate resource footprint\n\n**Cons**:\n\n- Configuration can be verbose\n- Limited middleware ecosystem (compared to Traefik)\n- No automatic TLS with Let's Encrypt\n- Configuration via annotations\n\n**Use when**:\n\n- You want proven stability\n- Wide community support is important\n- You need traditional ingress controller\n- You're building production systems\n- You want abundant documentation\n\n**Installation**:\n\n```\nprovisioning taskserv create nginx-ingress\n```\n\n**With Linkerd**:\n\n```\nprovisioning taskserv create linkerd\nprovisioning taskserv create nginx-ingress\n```\n\n---\n\n#### Traefik\n\n**Version**: 3.3.0\n\n**Best for**: Modern cloud-native applications with dynamic service discovery\n\n**Key Features**:\n\n- ✅ Automatic service discovery\n- ✅ Native Let's Encrypt support\n- ✅ Middleware system for advanced routing\n- ✅ Built-in dashboard and metrics\n- ✅ API-driven configuration\n- ✅ Dynamic configuration updates\n- ✅ Support for multiple protocols (HTTP, TCP, gRPC)\n\n**Pros**:\n\n- Modern, cloud-native design\n- Automatic TLS with Let's Encrypt\n- Middleware ecosystem for extensibility\n- Built-in dashboard for monitoring\n- Dynamic configuration without restart\n- API-driven approach\n- Growing community\n\n**Cons**:\n\n- Different configuration paradigm (IngressRoute CRD)\n- Smaller community than Nginx\n- Learning curve for traditional ops\n- Less mature than Nginx\n\n**Use when**:\n\n- You want modern cloud-native features\n- Automatic TLS is important\n- You like middleware-based routing\n- You want dynamic configuration\n- You're building microservices platforms\n\n**Installation**:\n\n```\nprovisioning taskserv create traefik\n```\n\n**With Linkerd**:\n\n```\nprovisioning taskserv create linkerd\nprovisioning taskserv create traefik\n```\n\n---\n\n#### Contour\n\n**Version**: 1.31.0\n\n**Best for**: Envoy-based ingress with simple CRD configuration\n\n**Key Features**:\n\n- ✅ Envoy proxy backend (same as Istio)\n- ✅ Simple CRD-based configuration\n- ✅ HTTPProxy CRD for advanced routing\n- ✅ Service delegation and composition\n- ✅ External authorization\n- ✅ Rate limiting support\n\n**Pros**:\n\n- Uses same Envoy proxy as Istio\n- Simple but powerful configuration\n- Good for multi-tenant clusters\n- CRD-based (declarative)\n- Good documentation\n\n**Cons**:\n\n- Smaller community than Nginx/Traefik\n- Fewer integrations and plugins\n- Less feature-rich than Traefik\n- Fewer real-world examples\n\n**Use when**:\n\n- You want Envoy proxy for consistency with Istio\n- You prefer simple configuration\n- You like CRD-based approach\n- You need multi-tenant support\n\n**Installation**:\n\n```\nprovisioning taskserv create contour\n```\n\n---\n\n#### HAProxy Ingress\n\n**Version**: 0.15.0\n\n**Best for**: High-performance environments requiring advanced load balancing\n\n**Key Features**:\n\n- ✅ HAProxy backend for performance\n- ✅ Advanced load balancing algorithms\n- ✅ High throughput\n- ✅ Flexible configuration\n- ✅ Proven performance\n\n**Pros**:\n\n- Excellent performance\n- Advanced load balancing options\n- Battle-tested HAProxy backend\n- Good for high-traffic scenarios\n\n**Cons**:\n\n- Less Kubernetes-native than others\n- Smaller community\n- Configuration complexity\n- Fewer modern features\n\n**Use when**:\n\n- Performance is critical\n- High traffic is expected\n- You need advanced load balancing\n\n---\n\n## Recommended Combinations\n\n### 1. Linkerd + Nginx Ingress (Recommended for most users)\n\n**Why**: Lightweight mesh + proven ingress = great balance\n\n```\nprovisioning taskserv create cert-manager\nprovisioning taskserv create linkerd\nprovisioning taskserv create nginx-ingress\n```\n\n**Pros**:\n\n- Minimal overhead\n- Simple to manage\n- Proven stability\n- Good observability\n\n**Cons**:\n\n- Less advanced features than Istio\n\n---\n\n### 2. Istio (Standalone)\n\n**Why**: All-in-one service mesh with built-in gateway\n\n```\nprovisioning taskserv create istio\n```\n\n**Pros**:\n\n- Unified traffic management\n- Powerful observability\n- No external ingress needed\n- Rich features\n\n**Cons**:\n\n- Higher resource usage\n- More complex\n\n---\n\n### 3. Linkerd + Traefik\n\n**Why**: Lightweight mesh + modern ingress\n\n```\nprovisioning taskserv create cert-manager\nprovisioning taskserv create linkerd\nprovisioning taskserv create traefik\n```\n\n**Pros**:\n\n- Minimal overhead\n- Modern features\n- Automatic TLS\n\n---\n\n### 4. No Mesh + Nginx Ingress (Simple deployments)\n\n**Why**: Just get traffic in without service mesh\n\n```\nprovisioning taskserv create nginx-ingress\n```\n\n**Pros**:\n\n- Simplest setup\n- Minimal overhead\n- Proven stability\n\n---\n\n## Decision Matrix\n\n| Requirement | Istio | Linkerd | Cilium | Nginx | Traefik | Contour | HAProxy |\n| ----------- | ------- | --------- | -------- | ------- | --------- | --------- | --------- |\n| Lightweight | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |\n| Simple Config | ❌ | ✅ | ⚠️ | ⚠️ | ✅ | ✅ | ❌ |\n| Full Features | ✅ | ⚠️ | ✅ | ⚠️ | ✅ | ⚠️ | ✅ |\n| Auto TLS | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ |\n| Service Mesh | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |\n| Performance | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |\n| Community | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ⚠️ |\n\n## Migration Paths\n\n### From Istio to Linkerd\n\n1. Install Linkerd alongside Istio\n2. Gradually migrate services (add Linkerd annotations)\n3. Verify Linkerd handles traffic correctly\n4. Install external ingress controller (Nginx/Traefik)\n5. Update Istio Virtual Services to use new ingress\n6. Remove Istio once migration complete\n\n### Between Ingress Controllers\n\n1. Install new ingress controller\n2. Create duplicate Ingress resources pointing to new controller\n3. Test with new ingress (use IngressClassName)\n4. Update DNS/load balancer to point to new ingress\n5. Drain connections from old ingress\n6. Remove old ingress controller\n\n---\n\n## Examples\n\nComplete examples of how to configure service meshes and ingress controllers in your workspace.\n\n### Example 1: Linkerd + Nginx Ingress Deployment\n\nThis is the recommended configuration for most deployments - lightweight and proven.\n\n#### Step 1: Create Taskserv Configurations\n\n**File**: `workspace/infra/my-cluster/taskservs/cert-manager.ncl`\n\n```\nimport provisioning.extensions.taskservs.infrastructure.cert_manager as cm\n\n# Cert-manager is required for Linkerd's mTLS certificates\n_taskserv = cm.CertManager {\n    version = "v1.15.0"\n    namespace = "cert-manager"\n}\n```\n\n**File**: `workspace/infra/my-cluster/taskservs/linkerd.ncl`\n\n```\nimport provisioning.extensions.taskservs.networking.linkerd as linkerd\n\n# Lightweight service mesh with minimal overhead\n_taskserv = linkerd.Linkerd {\n    version = "2.16.0"\n    namespace = "linkerd"\n\n    # Enable observability\n    ha_mode = False  # Use True for production HA\n    viz_enabled = True\n    prometheus = True\n    grafana = True\n\n    # Use cert-manager for mTLS certificates\n    cert_manager = True\n    trust_domain = "cluster.local"\n\n    # Resource configuration (very lightweight)\n    resources = {\n        proxy_cpu_request = "100m"\n        proxy_cpu_limit = "1000m"\n        proxy_memory_request = "20Mi"\n        proxy_memory_limit = "250Mi"\n    }\n}\n```\n\n**File**: `workspace/infra/my-cluster/taskservs/nginx-ingress.ncl`\n\n```\nimport provisioning.extensions.taskservs.networking.nginx_ingress as nginx\n\n# Battle-tested ingress controller\n_taskserv = nginx.NginxIngress {\n    version = "1.12.0"\n    namespace = "ingress-nginx"\n\n    # Deployment configuration\n    deployment_type = "Deployment"  # Or "DaemonSet" for node-local ingress\n    replicas = 2\n\n    # Enable metrics for observability\n    prometheus_metrics = True\n\n    # Resource allocation\n    resources = {\n        cpu_request = "100m"\n        cpu_limit = "1000m"\n        memory_request = "90Mi"\n        memory_limit = "500Mi"\n    }\n}\n```\n\n#### Step 2: Deploy Service Mesh Components\n\n```\n# Install cert-manager (prerequisite for Linkerd)\nprovisioning taskserv create cert-manager\n\n# Install Linkerd service mesh\nprovisioning taskserv create linkerd\n\n# Install Nginx ingress controller\nprovisioning taskserv create nginx-ingress\n\n# Verify installation\nlinkerd check\nkubectl get deploy -n ingress-nginx\n```\n\n#### Step 3: Configure Application Deployment\n\n**File**: `workspace/infra/my-cluster/clusters/web-api.ncl`\n\n```\nimport provisioning.kcl.k8s_deploy as k8s\nimport provisioning.extensions.taskservs.networking.nginx_ingress as nginx\n\n# Define the web API service with Linkerd service mesh and Nginx ingress\nservice = k8s.K8sDeploy {\n    # Basic information\n    name = "web-api"\n    namespace = "production"\n    create_ns = True\n\n    # Service mesh configuration - use Linkerd\n    service_mesh = "linkerd"\n    service_mesh_ns = "linkerd"\n    service_mesh_config = {\n        mtls_enabled = True\n        tracing_enabled = False\n    }\n\n    # Ingress configuration - use Nginx\n    ingress_controller = "nginx"\n    ingress_ns = "ingress-nginx"\n    ingress_config = {\n        tls_enabled = True\n        default_backend = "web-api:8080"\n    }\n\n    # Deployment spec\n    spec = {\n        replicas = 3\n        containers = [\n            {\n                name = "api"\n                image = "myregistry.azurecr.io/web-api:v1.0.0"\n                imagePull = "Always"\n                ports = [\n                    {\n                        name = "http"\n                        typ = "TCP"\n                        container = 8080\n                    }\n                ]\n            }\n        ]\n    }\n\n    # Kubernetes service\n    service = {\n        name = "web-api"\n        typ = "ClusterIP"\n        ports = [\n            {\n                name = "http"\n                typ = "TCP"\n                target = 8080\n            }\n        ]\n    }\n}\n```\n\n#### Step 4: Create Ingress Resource\n\n**File**: `workspace/infra/my-cluster/ingress/web-api-ingress.yaml`\n\n```\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: web-api\n  namespace: production\n  annotations:\n    cert-manager.io/cluster-issuer: letsencrypt-prod\n    nginx.ingress.kubernetes.io/rewrite-target: /\nspec:\n  ingressClassName: nginx\n  tls:\n    - hosts:\n        - api.example.com\n      secretName: web-api-tls\n  rules:\n    - host: api.example.com\n      http:\n        paths:\n          - path: /\n            pathType: Prefix\n            backend:\n              service:\n                name: web-api\n                port:\n                  number: 8080\n```\n\n---\n\n### Example 2: Istio (Standalone) Deployment\n\nComplete service mesh with built-in ingress gateway.\n\n#### Step 1: Install Istio\n\n**File**: `workspace/infra/my-cluster/taskservs/istio.ncl`\n\n```\nimport provisioning.extensions.taskservs.networking.istio as istio\n\n# Full-featured service mesh\n_taskserv = istio.Istio {\n    version = "1.24.0"\n    profile = "default"  # Options: default, demo, minimal, remote\n    namespace = "istio-system"\n\n    # Core features\n    mtls_enabled = True\n    mtls_mode = "PERMISSIVE"  # Start with PERMISSIVE, switch to STRICT when ready\n\n    # Traffic management\n    ingress_gateway = True\n    egress_gateway = False\n\n    # Observability\n    tracing = {\n        enabled = True\n        provider = "jaeger"\n        sampling_rate = 0.1  # Sample 10% for production\n    }\n\n    prometheus = True\n    grafana = True\n    kiali = True\n\n    # Resource configuration\n    resources = {\n        pilot_cpu = "500m"\n        pilot_memory = "2048Mi"\n        gateway_cpu = "100m"\n        gateway_memory = "128Mi"\n    }\n}\n```\n\n#### Step 2: Deploy Istio\n\n```\n# Install Istio\nprovisioning taskserv create istio\n\n# Verify installation\nistioctl verify-install\n```\n\n#### Step 3: Configure Application with Istio\n\n**File**: `workspace/infra/my-cluster/clusters/api-service.ncl`\n\n```\nimport provisioning.kcl.k8s_deploy as k8s\n\nservice = k8s.K8sDeploy {\n    name = "api-service"\n    namespace = "production"\n    create_ns = True\n\n    # Use Istio for both service mesh AND ingress\n    service_mesh = "istio"\n    service_mesh_ns = "istio-system"\n    ingress_controller = "istio-gateway"  # Istio's built-in gateway\n\n    spec = {\n        replicas = 3\n        containers = [\n            {\n                name = "api"\n                image = "myregistry.azurecr.io/api:v1.0.0"\n                ports = [\n                    { name = "http", typ = "TCP", container = 8080 }\n                ]\n            }\n        ]\n    }\n\n    service = {\n        name = "api-service"\n        typ = "ClusterIP"\n        ports = [\n            { name = "http", typ = "TCP", target = 8080 }\n        ]\n    }\n\n    # Istio-specific proxy configuration\n    prxyGatewayServers = [\n        {\n            port = { number = 80, protocol = "HTTP", name = "http" }\n            hosts = ["api.example.com"]\n        },\n        {\n            port = { number = 443, protocol = "HTTPS", name = "https" }\n            hosts = ["api.example.com"]\n            tls = {\n                mode = "SIMPLE"\n                credentialName = "api-tls-cert"\n            }\n        }\n    ]\n\n    # Virtual service routing configuration\n    prxyVirtualService = {\n        hosts = ["api.example.com"]\n        gateways = ["api-gateway"]\n        matches = [\n            {\n                typ = "http"\n                location = [\n                    { port = 80 }\n                ]\n                route_destination = [\n                    { port_number = 8080, host = "api-service" }\n                ]\n            }\n        ]\n    }\n}\n```\n\n---\n\n### Example 3: Linkerd + Traefik (Modern Cloud-Native)\n\nLightweight mesh with modern ingress controller and automatic TLS.\n\n#### Step 1: Create Configurations\n\n**File**: `workspace/infra/my-cluster/taskservs/linkerd.ncl`\n\n```\nimport provisioning.extensions.taskservs.networking.linkerd as linkerd\n\n_taskserv = linkerd.Linkerd {\n    version = "2.16.0"\n    namespace = "linkerd"\n    viz_enabled = True\n    prometheus = True\n}\n```\n\n**File**: `workspace/infra/my-cluster/taskservs/traefik.ncl`\n\n```\nimport provisioning.extensions.taskservs.networking.traefik as traefik\n\n# Modern ingress with middleware and auto-TLS\n_taskserv = traefik.Traefik {\n    version = "3.3.0"\n    namespace = "traefik"\n    replicas = 2\n\n    dashboard = True\n    metrics = True\n    access_logs = True\n\n    # Enable Let's Encrypt for automatic TLS\n    lets_encrypt = True\n    lets_encrypt_email = "admin@example.com"\n\n    resources = {\n        cpu_request = "100m"\n        cpu_limit = "1000m"\n        memory_request = "128Mi"\n        memory_limit = "512Mi"\n    }\n}\n```\n\n#### Step 2: Deploy\n\n```\nprovisioning taskserv create cert-manager\nprovisioning taskserv create linkerd\nprovisioning taskserv create traefik\n```\n\n#### Step 3: Create Traefik IngressRoute\n\n**File**: `workspace/infra/my-cluster/ingress/api-route.yaml`\n\n```\napiVersion: traefik.io/v1alpha1\nkind: IngressRoute\nmetadata:\n  name: api\n  namespace: production\nspec:\n  entryPoints:\n    - websecure\n  routes:\n    - match: Host(`api.example.com`)\n      kind: Rule\n      services:\n        - name: api-service\n          port: 8080\n  tls:\n    certResolver: letsencrypt\n    domains:\n      - main: api.example.com\n```\n\n---\n\n### Example 4: Minimal Setup (Just Nginx, No Service Mesh)\n\nFor simple deployments that don't need service mesh.\n\n#### Step 1: Install Nginx\n\n**File**: `workspace/infra/my-cluster/taskservs/nginx-ingress.ncl`\n\n```\nimport provisioning.extensions.taskservs.networking.nginx_ingress as nginx\n\n_taskserv = nginx.NginxIngress {\n    version = "1.12.0"\n    replicas = 2\n    prometheus_metrics = True\n}\n```\n\n#### Step 2: Deploy\n\n```\nprovisioning taskserv create nginx-ingress\n```\n\n#### Step 3: Application Configuration\n\n**File**: `workspace/infra/my-cluster/clusters/simple-app.ncl`\n\n```\nimport provisioning.kcl.k8s_deploy as k8s\n\nservice = k8s.K8sDeploy {\n    name = "simple-app"\n    namespace = "default"\n\n    # No service mesh - just ingress\n    ingress_controller = "nginx"\n    ingress_ns = "ingress-nginx"\n\n    spec = {\n        replicas = 2\n        containers = [\n            {\n                name = "app"\n                image = "nginx:latest"\n                ports = [{ name = "http", typ = "TCP", container = 80 }]\n            }\n        ]\n    }\n\n    service = {\n        name = "simple-app"\n        typ = "ClusterIP"\n        ports = [{ name = "http", typ = "TCP", target = 80 }]\n    }\n}\n```\n\n#### Step 4: Create Ingress\n\n**File**: `workspace/infra/my-cluster/ingress/simple-app-ingress.yaml`\n\n```\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: simple-app\n  namespace: default\nspec:\n  ingressClassName: nginx\n  rules:\n    - host: app.example.com\n      http:\n        paths:\n          - path: /\n            pathType: Prefix\n            backend:\n              service:\n                name: simple-app\n                port:\n                  number: 80\n```\n\n---\n\n## Enable Sidecar Injection for Services\n\n### For Linkerd\n\n```\n# Label namespace for automatic sidecar injection\nkubectl annotate namespace production linkerd.io/inject=enabled\n\n# Or add annotation to specific deployment\nkubectl annotate pod my-pod linkerd.io/inject=enabled\n```\n\n### For Istio\n\n```\n# Label namespace for automatic sidecar injection\nkubectl label namespace production istio-injection=enabled\n\n# Verify injection\nkubectl describe pod -n production | grep istio-proxy\n```\n\n---\n\n## Monitoring and Observability\n\n### Linkerd Dashboard\n\n```\n# Open Linkerd Viz dashboard\nlinkerd viz dashboard\n\n# View service topology\nlinkerd viz stat ns\nlinkerd viz tap -n production\n```\n\n### Istio Dashboards\n\n```\n# Kiali (service mesh visualization)\nkubectl port-forward -n istio-system svc/kiali 20000:20000\n# http://localhost:20000\n\n# Grafana (metrics)\nkubectl port-forward -n istio-system svc/grafana 3000:3000\n# http://localhost:3000 (default: admin/admin)\n\n# Jaeger (distributed tracing)\nkubectl port-forward -n istio-system svc/jaeger-query 16686:16686\n# http://localhost:16686\n```\n\n### Traefik Dashboard\n\n```\n# Forward Traefik dashboard\nkubectl port-forward -n traefik svc/traefik 8080:8080\n# http://localhost:8080/dashboard/\n```\n\n---\n\n## Quick Reference\n\n### Installation Commands\n\n#### Service Mesh - Istio\n\n```\n# Install Istio (includes built-in ingress gateway)\nprovisioning taskserv create istio\n\n# Verify installation\nistioctl verify-install\n\n# Enable sidecar injection on namespace\nkubectl label namespace default istio-injection=enabled\n\n# View Kiali dashboard\nkubectl port-forward -n istio-system svc/kiali 20000:20000\n# Open: http://localhost:20000\n```\n\n#### Service Mesh - Linkerd\n\n```\n# Install cert-manager first (Linkerd requirement)\nprovisioning taskserv create cert-manager\n\n# Install Linkerd\nprovisioning taskserv create linkerd\n\n# Verify installation\nlinkerd check\n\n# Enable automatic sidecar injection\nkubectl annotate namespace default linkerd.io/inject=enabled\n\n# View live dashboard\nlinkerd viz dashboard\n```\n\n#### Ingress Controllers\n\n```\n# Install Nginx Ingress (most popular)\nprovisioning taskserv create nginx-ingress\n\n# Install Traefik (modern cloud-native)\nprovisioning taskserv create traefik\n\n# Install Contour (Envoy-based)\nprovisioning taskserv create contour\n\n# Install HAProxy Ingress (high-performance)\nprovisioning taskserv create haproxy-ingress\n```\n\n### Common Installation Combinations\n\n#### Option 1: Linkerd + Nginx Ingress (Recommended)\n\n**Lightweight mesh + proven ingress**\n\n```\n# Step 1: Install cert-manager\nprovisioning taskserv create cert-manager\n\n# Step 2: Install Linkerd\nprovisioning taskserv create linkerd\n\n# Step 3: Install Nginx Ingress\nprovisioning taskserv create nginx-ingress\n\n# Step 4: Verify installation\nlinkerd check\nkubectl get deploy -n ingress-nginx\n\n# Step 5: Create sample application with Linkerd\nkubectl annotate namespace default linkerd.io/inject=enabled\nkubectl apply -f my-app.yaml\n```\n\n#### Option 2: Istio (Standalone)\n\n**Full-featured service mesh with built-in gateway**\n\n```\n# Install Istio\nprovisioning taskserv create istio\n\n# Verify\nistioctl verify-install\n\n# Enable sidecar injection\nkubectl label namespace default istio-injection=enabled\n\n# Deploy applications\nkubectl apply -f my-app.yaml\n```\n\n#### Option 3: Linkerd + Traefik\n\n**Lightweight mesh + modern ingress with auto TLS**\n\n```\n# Install prerequisites\nprovisioning taskserv create cert-manager\n\n# Install service mesh\nprovisioning taskserv create linkerd\n\n# Install modern ingress with Let's Encrypt\nprovisioning taskserv create traefik\n\n# Enable sidecar injection\nkubectl annotate namespace default linkerd.io/inject=enabled\n```\n\n#### Option 4: Just Nginx Ingress (No Mesh)\n\n**Simple deployments without service mesh**\n\n```\n# Install ingress controller\nprovisioning taskserv create nginx-ingress\n\n# Deploy applications\nkubectl apply -f ingress.yaml\n```\n\n### Verification Commands\n\n#### Check Linkerd\n\n```\n# Full system check\nlinkerd check\n\n# Specific component checks\nlinkerd check --pre              # Pre-install checks\nlinkerd check -n linkerd         # Linkerd namespace\nlinkerd check -n default         # Custom namespace\n\n# View version\nlinkerd version --client\nlinkerd version --server\n```\n\n#### Check Istio\n\n```\n# Full system analysis\nistioctl analyze\n\n# By namespace\nistioctl analyze -n default\n\n# Verify configuration\nistioctl verify-install\n\n# Check version\nistioctl version\n```\n\n#### Check Ingress Controllers\n\n```\n# List ingress resources\nkubectl get ingress -A\n\n# Get ingress details\nkubectl describe ingress -n default\n\n# Nginx specific\nkubectl get deploy -n ingress-nginx\nkubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx\n\n# Traefik specific\nkubectl get deploy -n traefik\nkubectl logs -n traefik deployment/traefik\n```\n\n### Troubleshooting\n\n#### Service Mesh Issues\n\n```\n# Linkerd - Check proxy status\nlinkerd check -n <namespace>\n\n# Linkerd - View service topology\nlinkerd tap -n <namespace> deployment/<name>\n\n# Istio - Check sidecar injection\nkubectl describe pod -n <namespace>  # Look for istio-proxy container\n\n# Istio - View traffic policies\nistioctl analyze\n```\n\n#### Ingress Controller Issues\n\n```\n# Check ingress controller logs\nkubectl logs -n ingress-nginx deployment/ingress-nginx-controller\nkubectl logs -n traefik deployment/traefik\n\n# Describe ingress resource\nkubectl describe ingress <name> -n <namespace>\n\n# Check ingress controller service\nkubectl get svc -n ingress-nginx\nkubectl get svc -n traefik\n```\n\n### Uninstallation\n\n#### Remove Linkerd\n\n```\n# Remove annotations from namespaces\nkubectl annotate namespace <namespace> linkerd.io/inject- --all\n\n# Uninstall Linkerd\nlinkerd uninstall | kubectl delete -f -\n\n# Remove Linkerd namespace\nkubectl delete namespace linkerd\n```\n\n#### Remove Istio\n\n```\n# Remove labels from namespaces\nkubectl label namespace <namespace> istio-injection- --all\n\n# Uninstall Istio\nistioctl uninstall --purge\n\n# Remove Istio namespace\nkubectl delete namespace istio-system\n```\n\n#### Remove Ingress Controllers\n\n```\n# Nginx\nhelm uninstall ingress-nginx -n ingress-nginx\nkubectl delete namespace ingress-nginx\n\n# Traefik\nhelm uninstall traefik -n traefik\nkubectl delete namespace traefik\n```\n\n### Performance Tuning\n\n#### Linkerd Resource Limits\n\n```\n# Adjust proxy resource limits in linkerd.ncl\n_taskserv = linkerd.Linkerd {\n    resources: {\n        proxy_cpu_limit = "2000m"      # Increase if needed\n        proxy_memory_limit = "512Mi"   # Increase if needed\n    }\n}\n```\n\n#### Istio Profile Selection\n\n```\n# Different resource profiles available\nprofile = "default"   # Full features (default)\nprofile = "demo"      # Demo mode (more resources)\nprofile = "minimal"   # Minimal (lower resources)\nprofile = "remote"    # Control plane only (advanced)\n```\n\n---\n\n## Complete Workspace Directory Structure\n\nAfter implementing these examples, your workspace should look like:\n\n```\nworkspace/infra/my-cluster/\n├── taskservs/\n│   ├── cert-manager.ncl          # For Linkerd mTLS\n│   ├── linkerd.ncl             # Service mesh option\n│   ├── istio.ncl               # OR Istio option\n│   ├── nginx-ingress.ncl       # Ingress controller\n│   └── traefik.ncl             # Alternative ingress\n├── clusters/\n│   ├── web-api.ncl             # Application with Linkerd + Nginx\n│   ├── api-service.ncl         # Application with Istio\n│   └── simple-app.ncl          # App without service mesh\n├── ingress/\n│   ├── web-api-ingress.yaml    # Nginx Ingress resource\n│   ├── api-route.yaml          # Traefik IngressRoute\n│   └── simple-app-ingress.yaml # Simple Ingress\n└── config.toml                 # Infrastructure-specific config\n```\n\n---\n\n## Next Steps\n\n1. **Choose your deployment model** (Linkerd+Nginx, Istio, or plain Nginx)\n2. **Create taskserv KCL files** in `workspace/infra/<cluster>/taskservs/`\n3. **Install components** using `provisioning taskserv create`\n4. **Create application deployments** with appropriate mesh/ingress configuration\n5. **Monitor and observe** using the appropriate dashboard\n\n---\n\n## Additional Resources\n\n- **Linkerd Documentation**: <https://linkerd.io/>\n- **Istio Documentation**: <https://istio.io/>\n- **Nginx Ingress**: <https://kubernetes.github.io/ingress-nginx/>\n- **Traefik Documentation**: <https://doc.traefik.io/>\n- **Contour Documentation**: <https://projectcontour.io/>\n- **Cilium Documentation**: <https://docs.cilium.io/>
