# Service Mesh & Ingress Guide

## Comparison

This guide helps you choose between different service mesh and ingress controller options for your Kubernetes deployments.

### Understanding the Difference

#### Service Mesh

Handles **East-West traffic** (service-to-service communication):

- Automatic mTLS encryption between services
- Traffic management and routing
- Observability and monitoring
- Service discovery
- Fault tolerance and resilience

#### Ingress Controller

Handles **North-South traffic** (external to internal):

- Route external traffic into the cluster
- TLS/HTTPS termination
- Virtual hosts and path routing
- Load balancing
- Can work with or without a service mesh

### Service Mesh Options

#### Istio

**Version**: 1.24.0

**Best for**: Full-featured service mesh deployments with comprehensive observability

**Key Features**:

- ✅ Comprehensive feature set
- ✅ Built-in Istio Gateway ingress controller
- ✅ Advanced traffic management
- ✅ Strong observability (Kiali, Grafana, Jaeger)
- ✅ Virtual services, destination rules, traffic policies
- ✅ Mutual TLS (mTLS) with automatic certificate rotation
- ✅ Canary deployments and traffic mirroring

**Resource Requirements**:

- CPU: 500m (Pilot) + 100m per gateway
- Memory: 2048Mi (Pilot) + 128Mi per gateway
- High overhead

**Pros**:

- Industry-standard solution with large community
- Rich feature set for complex requirements
- Built-in ingress gateway (don't need external ingress)
- Strong observability capabilities
- Enterprise support available

**Cons**:

- Significant resource overhead
- Complex configuration learning curve
- Can be overkill for simple applications
- Sidecar injection required for all services

**Use when**:

- You need comprehensive traffic management
- Complex microservice patterns (canary deployments, traffic mirroring)
- Enterprise requirements
- You already understand service meshes
- Your team has Istio expertise

**Installation**:

```bash
provisioning taskserv create istio
```plaintext

---

#### Linkerd

**Version**: 2.16.0

**Best for**: Lightweight, high-performance service mesh with minimal complexity

**Key Features**:

- ✅ Ultra-lightweight (minimal resource footprint)
- ✅ Simple configuration
- ✅ Automatic mTLS with certificate rotation
- ✅ Fast sidecar startup (built in Rust)
- ✅ Live traffic visualization
- ✅ Service topology and dependency discovery
- ✅ Golden metrics out of the box (latency, success rate, throughput)

**Resource Requirements**:

- CPU proxy: 100m request, 1000m limit
- Memory proxy: 20Mi request, 250Mi limit
- Very lightweight compared to Istio

**Pros**:

- Minimal resource overhead
- Simple, intuitive configuration
- Fast startup and deployment
- Built in Rust for performance
- Excellent golden metrics
- Good for resource-constrained environments
- Can run alongside Istio

**Cons**:

- Fewer advanced features than Istio
- Requires external ingress controller
- Smaller ecosystem and fewer integrations
- Less feature-rich traffic management
- Requires cert-manager for mTLS

**Use when**:

- You want simplicity and minimal overhead
- Running on resource-constrained clusters
- You prefer straightforward configuration
- You don't need advanced traffic management
- You're using Kubernetes 1.21+

**Installation**:

```bash
# Linkerd requires cert-manager
provisioning taskserv create cert-manager
provisioning taskserv create linkerd
provisioning taskserv create nginx-ingress  # Or traefik/contour
```plaintext

---

#### Cilium

**Version**: See existing Cilium taskserv

**Best for**: CNI-based networking with integrated service mesh

**Key Features**:

- ✅ CNI and service mesh in one solution
- ✅ eBPF-based for high performance
- ✅ Network policy enforcement
- ✅ Service mesh mode (optional)
- ✅ Hubble for observability
- ✅ Cluster mesh for multi-cluster

**Pros**:

- Replaces CNI plugin entirely
- High-performance eBPF kernel networking
- Can serve as both CNI and service mesh
- No sidecar needed (uses eBPF)
- Network policy support

**Cons**:

- Requires Linux kernel with eBPF support
- Service mesh mode is secondary feature
- More complex than Linkerd
- Not as mature in service mesh role

**Use when**:

- You need both CNI and service mesh
- You're on modern Linux kernels with eBPF
- You want kernel-level networking

---

### Ingress Controller Options

#### Nginx Ingress

**Version**: 1.12.0

**Best for**: Most Kubernetes deployments - proven, reliable, widely supported

**Key Features**:

- ✅ Battle-tested and production-proven
- ✅ Most popular ingress controller
- ✅ Extensive documentation and community
- ✅ Rich configuration options
- ✅ SSL/TLS termination
- ✅ URL rewriting and routing
- ✅ Rate limiting and DDoS protection

**Pros**:

- Proven stability in production
- Widest community and ecosystem
- Extensive documentation
- Multiple commercial support options
- Works with any service mesh
- Moderate resource footprint

**Cons**:

- Configuration can be verbose
- Limited middleware ecosystem (compared to Traefik)
- No automatic TLS with Let's Encrypt
- Configuration via annotations

**Use when**:

- You want proven stability
- Wide community support is important
- You need traditional ingress controller
- You're building production systems
- You want abundant documentation

**Installation**:

```bash
provisioning taskserv create nginx-ingress
```plaintext

**With Linkerd**:

```bash
provisioning taskserv create linkerd
provisioning taskserv create nginx-ingress
```plaintext

---

#### Traefik

**Version**: 3.3.0

**Best for**: Modern cloud-native applications with dynamic service discovery

**Key Features**:

- ✅ Automatic service discovery
- ✅ Native Let's Encrypt support
- ✅ Middleware system for advanced routing
- ✅ Built-in dashboard and metrics
- ✅ API-driven configuration
- ✅ Dynamic configuration updates
- ✅ Support for multiple protocols (HTTP, TCP, gRPC)

**Pros**:

- Modern, cloud-native design
- Automatic TLS with Let's Encrypt
- Middleware ecosystem for extensibility
- Built-in dashboard for monitoring
- Dynamic configuration without restart
- API-driven approach
- Growing community

**Cons**:

- Different configuration paradigm (IngressRoute CRD)
- Smaller community than Nginx
- Learning curve for traditional ops
- Less mature than Nginx

**Use when**:

- You want modern cloud-native features
- Automatic TLS is important
- You like middleware-based routing
- You want dynamic configuration
- You're building microservices platforms

**Installation**:

```bash
provisioning taskserv create traefik
```plaintext

**With Linkerd**:

```bash
provisioning taskserv create linkerd
provisioning taskserv create traefik
```plaintext

---

#### Contour

**Version**: 1.31.0

**Best for**: Envoy-based ingress with simple CRD configuration

**Key Features**:

- ✅ Envoy proxy backend (same as Istio)
- ✅ Simple CRD-based configuration
- ✅ HTTPProxy CRD for advanced routing
- ✅ Service delegation and composition
- ✅ External authorization
- ✅ Rate limiting support

**Pros**:

- Uses same Envoy proxy as Istio
- Simple but powerful configuration
- Good for multi-tenant clusters
- CRD-based (declarative)
- Good documentation

**Cons**:

- Smaller community than Nginx/Traefik
- Fewer integrations and plugins
- Less feature-rich than Traefik
- Fewer real-world examples

**Use when**:

- You want Envoy proxy for consistency with Istio
- You prefer simple configuration
- You like CRD-based approach
- You need multi-tenant support

**Installation**:

```bash
provisioning taskserv create contour
```plaintext

---

#### HAProxy Ingress

**Version**: 0.15.0

**Best for**: High-performance environments requiring advanced load balancing

**Key Features**:

- ✅ HAProxy backend for performance
- ✅ Advanced load balancing algorithms
- ✅ High throughput
- ✅ Flexible configuration
- ✅ Proven performance

**Pros**:

- Excellent performance
- Advanced load balancing options
- Battle-tested HAProxy backend
- Good for high-traffic scenarios

**Cons**:

- Less Kubernetes-native than others
- Smaller community
- Configuration complexity
- Fewer modern features

**Use when**:

- Performance is critical
- High traffic is expected
- You need advanced load balancing

---

## Recommended Combinations

### 1. Linkerd + Nginx Ingress (Recommended for most users)

**Why**: Lightweight mesh + proven ingress = great balance

```bash
provisioning taskserv create cert-manager
provisioning taskserv create linkerd
provisioning taskserv create nginx-ingress
```plaintext

**Pros**:

- Minimal overhead
- Simple to manage
- Proven stability
- Good observability

**Cons**:

- Less advanced features than Istio

---

### 2. Istio (Standalone)

**Why**: All-in-one service mesh with built-in gateway

```bash
provisioning taskserv create istio
```plaintext

**Pros**:

- Unified traffic management
- Powerful observability
- No external ingress needed
- Rich features

**Cons**:

- Higher resource usage
- More complex

---

### 3. Linkerd + Traefik

**Why**: Lightweight mesh + modern ingress

```bash
provisioning taskserv create cert-manager
provisioning taskserv create linkerd
provisioning taskserv create traefik
```plaintext

**Pros**:

- Minimal overhead
- Modern features
- Automatic TLS

---

### 4. No Mesh + Nginx Ingress (Simple deployments)

**Why**: Just get traffic in without service mesh

```bash
provisioning taskserv create nginx-ingress
```plaintext

**Pros**:

- Simplest setup
- Minimal overhead
- Proven stability

---

## Decision Matrix

| Requirement | Istio | Linkerd | Cilium | Nginx | Traefik | Contour | HAProxy |
|-----------|-------|---------|--------|-------|---------|---------|---------|
| Lightweight | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Simple Config | ❌ | ✅ | ⚠️ | ⚠️ | ✅ | ✅ | ❌ |
| Full Features | ✅ | ⚠️ | ✅ | ⚠️ | ✅ | ⚠️ | ✅ |
| Auto TLS | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ |
| Service Mesh | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| Performance | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Community | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | ⚠️ |

## Migration Paths

### From Istio to Linkerd

1. Install Linkerd alongside Istio
2. Gradually migrate services (add Linkerd annotations)
3. Verify Linkerd handles traffic correctly
4. Install external ingress controller (Nginx/Traefik)
5. Update Istio Virtual Services to use new ingress
6. Remove Istio once migration complete

### Between Ingress Controllers

1. Install new ingress controller
2. Create duplicate Ingress resources pointing to new controller
3. Test with new ingress (use IngressClassName)
4. Update DNS/load balancer to point to new ingress
5. Drain connections from old ingress
6. Remove old ingress controller

---

## Examples

Complete examples of how to configure service meshes and ingress controllers in your workspace.

### Example 1: Linkerd + Nginx Ingress Deployment

This is the recommended configuration for most deployments - lightweight and proven.

#### Step 1: Create Taskserv Configurations

**File**: `workspace/infra/my-cluster/taskservs/cert-manager.ncl`

```kcl
import provisioning.extensions.taskservs.infrastructure.cert_manager as cm

# Cert-manager is required for Linkerd's mTLS certificates
_taskserv = cm.CertManager {
    version = "v1.15.0"
    namespace = "cert-manager"
}
```plaintext

**File**: `workspace/infra/my-cluster/taskservs/linkerd.ncl`

```kcl
import provisioning.extensions.taskservs.networking.linkerd as linkerd

# Lightweight service mesh with minimal overhead
_taskserv = linkerd.Linkerd {
    version = "2.16.0"
    namespace = "linkerd"

    # Enable observability
    ha_mode = False  # Use True for production HA
    viz_enabled = True
    prometheus = True
    grafana = True

    # Use cert-manager for mTLS certificates
    cert_manager = True
    trust_domain = "cluster.local"

    # Resource configuration (very lightweight)
    resources = {
        proxy_cpu_request = "100m"
        proxy_cpu_limit = "1000m"
        proxy_memory_request = "20Mi"
        proxy_memory_limit = "250Mi"
    }
}
```plaintext

**File**: `workspace/infra/my-cluster/taskservs/nginx-ingress.ncl`

```kcl
import provisioning.extensions.taskservs.networking.nginx_ingress as nginx

# Battle-tested ingress controller
_taskserv = nginx.NginxIngress {
    version = "1.12.0"
    namespace = "ingress-nginx"

    # Deployment configuration
    deployment_type = "Deployment"  # Or "DaemonSet" for node-local ingress
    replicas = 2

    # Enable metrics for observability
    prometheus_metrics = True

    # Resource allocation
    resources = {
        cpu_request = "100m"
        cpu_limit = "1000m"
        memory_request = "90Mi"
        memory_limit = "500Mi"
    }
}
```plaintext

#### Step 2: Deploy Service Mesh Components

```bash
# Install cert-manager (prerequisite for Linkerd)
provisioning taskserv create cert-manager

# Install Linkerd service mesh
provisioning taskserv create linkerd

# Install Nginx ingress controller
provisioning taskserv create nginx-ingress

# Verify installation
linkerd check
kubectl get deploy -n ingress-nginx
```plaintext

#### Step 3: Configure Application Deployment

**File**: `workspace/infra/my-cluster/clusters/web-api.ncl`

```kcl
import provisioning.kcl.k8s_deploy as k8s
import provisioning.extensions.taskservs.networking.nginx_ingress as nginx

# Define the web API service with Linkerd service mesh and Nginx ingress
service = k8s.K8sDeploy {
    # Basic information
    name = "web-api"
    namespace = "production"
    create_ns = True

    # Service mesh configuration - use Linkerd
    service_mesh = "linkerd"
    service_mesh_ns = "linkerd"
    service_mesh_config = {
        mtls_enabled = True
        tracing_enabled = False
    }

    # Ingress configuration - use Nginx
    ingress_controller = "nginx"
    ingress_ns = "ingress-nginx"
    ingress_config = {
        tls_enabled = True
        default_backend = "web-api:8080"
    }

    # Deployment spec
    spec = {
        replicas = 3
        containers = [
            {
                name = "api"
                image = "myregistry.azurecr.io/web-api:v1.0.0"
                imagePull = "Always"
                ports = [
                    {
                        name = "http"
                        typ = "TCP"
                        container = 8080
                    }
                ]
            }
        ]
    }

    # Kubernetes service
    service = {
        name = "web-api"
        typ = "ClusterIP"
        ports = [
            {
                name = "http"
                typ = "TCP"
                target = 8080
            }
        ]
    }
}
```plaintext

#### Step 4: Create Ingress Resource

**File**: `workspace/infra/my-cluster/ingress/web-api-ingress.yaml`

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-api
  namespace: production
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.example.com
      secretName: web-api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-api
                port:
                  number: 8080
```plaintext

---

### Example 2: Istio (Standalone) Deployment

Complete service mesh with built-in ingress gateway.

#### Step 1: Install Istio

**File**: `workspace/infra/my-cluster/taskservs/istio.ncl`

```kcl
import provisioning.extensions.taskservs.networking.istio as istio

# Full-featured service mesh
_taskserv = istio.Istio {
    version = "1.24.0"
    profile = "default"  # Options: default, demo, minimal, remote
    namespace = "istio-system"

    # Core features
    mtls_enabled = True
    mtls_mode = "PERMISSIVE"  # Start with PERMISSIVE, switch to STRICT when ready

    # Traffic management
    ingress_gateway = True
    egress_gateway = False

    # Observability
    tracing = {
        enabled = True
        provider = "jaeger"
        sampling_rate = 0.1  # Sample 10% for production
    }

    prometheus = True
    grafana = True
    kiali = True

    # Resource configuration
    resources = {
        pilot_cpu = "500m"
        pilot_memory = "2048Mi"
        gateway_cpu = "100m"
        gateway_memory = "128Mi"
    }
}
```plaintext

#### Step 2: Deploy Istio

```bash
# Install Istio
provisioning taskserv create istio

# Verify installation
istioctl verify-install
```plaintext

#### Step 3: Configure Application with Istio

**File**: `workspace/infra/my-cluster/clusters/api-service.ncl`

```kcl
import provisioning.kcl.k8s_deploy as k8s

service = k8s.K8sDeploy {
    name = "api-service"
    namespace = "production"
    create_ns = True

    # Use Istio for both service mesh AND ingress
    service_mesh = "istio"
    service_mesh_ns = "istio-system"
    ingress_controller = "istio-gateway"  # Istio's built-in gateway

    spec = {
        replicas = 3
        containers = [
            {
                name = "api"
                image = "myregistry.azurecr.io/api:v1.0.0"
                ports = [
                    { name = "http", typ = "TCP", container = 8080 }
                ]
            }
        ]
    }

    service = {
        name = "api-service"
        typ = "ClusterIP"
        ports = [
            { name = "http", typ = "TCP", target = 8080 }
        ]
    }

    # Istio-specific proxy configuration
    prxyGatewayServers = [
        {
            port = { number = 80, protocol = "HTTP", name = "http" }
            hosts = ["api.example.com"]
        },
        {
            port = { number = 443, protocol = "HTTPS", name = "https" }
            hosts = ["api.example.com"]
            tls = {
                mode = "SIMPLE"
                credentialName = "api-tls-cert"
            }
        }
    ]

    # Virtual service routing configuration
    prxyVirtualService = {
        hosts = ["api.example.com"]
        gateways = ["api-gateway"]
        matches = [
            {
                typ = "http"
                location = [
                    { port = 80 }
                ]
                route_destination = [
                    { port_number = 8080, host = "api-service" }
                ]
            }
        ]
    }
}
```plaintext

---

### Example 3: Linkerd + Traefik (Modern Cloud-Native)

Lightweight mesh with modern ingress controller and automatic TLS.

#### Step 1: Create Configurations

**File**: `workspace/infra/my-cluster/taskservs/linkerd.ncl`

```kcl
import provisioning.extensions.taskservs.networking.linkerd as linkerd

_taskserv = linkerd.Linkerd {
    version = "2.16.0"
    namespace = "linkerd"
    viz_enabled = True
    prometheus = True
}
```plaintext

**File**: `workspace/infra/my-cluster/taskservs/traefik.ncl`

```kcl
import provisioning.extensions.taskservs.networking.traefik as traefik

# Modern ingress with middleware and auto-TLS
_taskserv = traefik.Traefik {
    version = "3.3.0"
    namespace = "traefik"
    replicas = 2

    dashboard = True
    metrics = True
    access_logs = True

    # Enable Let's Encrypt for automatic TLS
    lets_encrypt = True
    lets_encrypt_email = "admin@example.com"

    resources = {
        cpu_request = "100m"
        cpu_limit = "1000m"
        memory_request = "128Mi"
        memory_limit = "512Mi"
    }
}
```plaintext

#### Step 2: Deploy

```bash
provisioning taskserv create cert-manager
provisioning taskserv create linkerd
provisioning taskserv create traefik
```plaintext

#### Step 3: Create Traefik IngressRoute

**File**: `workspace/infra/my-cluster/ingress/api-route.yaml`

```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api
  namespace: production
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`api.example.com`)
      kind: Rule
      services:
        - name: api-service
          port: 8080
  tls:
    certResolver: letsencrypt
    domains:
      - main: api.example.com
```plaintext

---

### Example 4: Minimal Setup (Just Nginx, No Service Mesh)

For simple deployments that don't need service mesh.

#### Step 1: Install Nginx

**File**: `workspace/infra/my-cluster/taskservs/nginx-ingress.ncl`

```kcl
import provisioning.extensions.taskservs.networking.nginx_ingress as nginx

_taskserv = nginx.NginxIngress {
    version = "1.12.0"
    replicas = 2
    prometheus_metrics = True
}
```plaintext

#### Step 2: Deploy

```bash
provisioning taskserv create nginx-ingress
```plaintext

#### Step 3: Application Configuration

**File**: `workspace/infra/my-cluster/clusters/simple-app.ncl`

```kcl
import provisioning.kcl.k8s_deploy as k8s

service = k8s.K8sDeploy {
    name = "simple-app"
    namespace = "default"

    # No service mesh - just ingress
    ingress_controller = "nginx"
    ingress_ns = "ingress-nginx"

    spec = {
        replicas = 2
        containers = [
            {
                name = "app"
                image = "nginx:latest"
                ports = [{ name = "http", typ = "TCP", container = 80 }]
            }
        ]
    }

    service = {
        name = "simple-app"
        typ = "ClusterIP"
        ports = [{ name = "http", typ = "TCP", target = 80 }]
    }
}
```plaintext

#### Step 4: Create Ingress

**File**: `workspace/infra/my-cluster/ingress/simple-app-ingress.yaml`

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: simple-app
  namespace: default
spec:
  ingressClassName: nginx
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: simple-app
                port:
                  number: 80
```plaintext

---

## Enable Sidecar Injection for Services

### For Linkerd

```bash
# Label namespace for automatic sidecar injection
kubectl annotate namespace production linkerd.io/inject=enabled

# Or add annotation to specific deployment
kubectl annotate pod my-pod linkerd.io/inject=enabled
```plaintext

### For Istio

```bash
# Label namespace for automatic sidecar injection
kubectl label namespace production istio-injection=enabled

# Verify injection
kubectl describe pod -n production | grep istio-proxy
```plaintext

---

## Monitoring and Observability

### Linkerd Dashboard

```bash
# Open Linkerd Viz dashboard
linkerd viz dashboard

# View service topology
linkerd viz stat ns
linkerd viz tap -n production
```plaintext

### Istio Dashboards

```bash
# Kiali (service mesh visualization)
kubectl port-forward -n istio-system svc/kiali 20000:20000
# http://localhost:20000

# Grafana (metrics)
kubectl port-forward -n istio-system svc/grafana 3000:3000
# http://localhost:3000 (default: admin/admin)

# Jaeger (distributed tracing)
kubectl port-forward -n istio-system svc/jaeger-query 16686:16686
# http://localhost:16686
```plaintext

### Traefik Dashboard

```bash
# Forward Traefik dashboard
kubectl port-forward -n traefik svc/traefik 8080:8080
# http://localhost:8080/dashboard/
```plaintext

---

## Quick Reference

### Installation Commands

#### Service Mesh - Istio

```bash
# Install Istio (includes built-in ingress gateway)
provisioning taskserv create istio

# Verify installation
istioctl verify-install

# Enable sidecar injection on namespace
kubectl label namespace default istio-injection=enabled

# View Kiali dashboard
kubectl port-forward -n istio-system svc/kiali 20000:20000
# Open: http://localhost:20000
```plaintext

#### Service Mesh - Linkerd

```bash
# Install cert-manager first (Linkerd requirement)
provisioning taskserv create cert-manager

# Install Linkerd
provisioning taskserv create linkerd

# Verify installation
linkerd check

# Enable automatic sidecar injection
kubectl annotate namespace default linkerd.io/inject=enabled

# View live dashboard
linkerd viz dashboard
```plaintext

#### Ingress Controllers

```bash
# Install Nginx Ingress (most popular)
provisioning taskserv create nginx-ingress

# Install Traefik (modern cloud-native)
provisioning taskserv create traefik

# Install Contour (Envoy-based)
provisioning taskserv create contour

# Install HAProxy Ingress (high-performance)
provisioning taskserv create haproxy-ingress
```plaintext

### Common Installation Combinations

#### Option 1: Linkerd + Nginx Ingress (Recommended)

**Lightweight mesh + proven ingress**

```bash
# Step 1: Install cert-manager
provisioning taskserv create cert-manager

# Step 2: Install Linkerd
provisioning taskserv create linkerd

# Step 3: Install Nginx Ingress
provisioning taskserv create nginx-ingress

# Step 4: Verify installation
linkerd check
kubectl get deploy -n ingress-nginx

# Step 5: Create sample application with Linkerd
kubectl annotate namespace default linkerd.io/inject=enabled
kubectl apply -f my-app.yaml
```plaintext

#### Option 2: Istio (Standalone)

**Full-featured service mesh with built-in gateway**

```bash
# Install Istio
provisioning taskserv create istio

# Verify
istioctl verify-install

# Enable sidecar injection
kubectl label namespace default istio-injection=enabled

# Deploy applications
kubectl apply -f my-app.yaml
```plaintext

#### Option 3: Linkerd + Traefik

**Lightweight mesh + modern ingress with auto TLS**

```bash
# Install prerequisites
provisioning taskserv create cert-manager

# Install service mesh
provisioning taskserv create linkerd

# Install modern ingress with Let's Encrypt
provisioning taskserv create traefik

# Enable sidecar injection
kubectl annotate namespace default linkerd.io/inject=enabled
```plaintext

#### Option 4: Just Nginx Ingress (No Mesh)

**Simple deployments without service mesh**

```bash
# Install ingress controller
provisioning taskserv create nginx-ingress

# Deploy applications
kubectl apply -f ingress.yaml
```plaintext

### Verification Commands

#### Check Linkerd

```bash
# Full system check
linkerd check

# Specific component checks
linkerd check --pre              # Pre-install checks
linkerd check -n linkerd         # Linkerd namespace
linkerd check -n default         # Custom namespace

# View version
linkerd version --client
linkerd version --server
```plaintext

#### Check Istio

```bash
# Full system analysis
istioctl analyze

# By namespace
istioctl analyze -n default

# Verify configuration
istioctl verify-install

# Check version
istioctl version
```plaintext

#### Check Ingress Controllers

```bash
# List ingress resources
kubectl get ingress -A

# Get ingress details
kubectl describe ingress -n default

# Nginx specific
kubectl get deploy -n ingress-nginx
kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx

# Traefik specific
kubectl get deploy -n traefik
kubectl logs -n traefik deployment/traefik
```plaintext

### Troubleshooting

#### Service Mesh Issues

```bash
# Linkerd - Check proxy status
linkerd check -n <namespace>

# Linkerd - View service topology
linkerd tap -n <namespace> deployment/<name>

# Istio - Check sidecar injection
kubectl describe pod -n <namespace>  # Look for istio-proxy container

# Istio - View traffic policies
istioctl analyze
```plaintext

#### Ingress Controller Issues

```bash
# Check ingress controller logs
kubectl logs -n ingress-nginx deployment/ingress-nginx-controller
kubectl logs -n traefik deployment/traefik

# Describe ingress resource
kubectl describe ingress <name> -n <namespace>

# Check ingress controller service
kubectl get svc -n ingress-nginx
kubectl get svc -n traefik
```plaintext

### Uninstallation

#### Remove Linkerd

```bash
# Remove annotations from namespaces
kubectl annotate namespace <namespace> linkerd.io/inject- --all

# Uninstall Linkerd
linkerd uninstall | kubectl delete -f -

# Remove Linkerd namespace
kubectl delete namespace linkerd
```plaintext

#### Remove Istio

```bash
# Remove labels from namespaces
kubectl label namespace <namespace> istio-injection- --all

# Uninstall Istio
istioctl uninstall --purge

# Remove Istio namespace
kubectl delete namespace istio-system
```plaintext

#### Remove Ingress Controllers

```bash
# Nginx
helm uninstall ingress-nginx -n ingress-nginx
kubectl delete namespace ingress-nginx

# Traefik
helm uninstall traefik -n traefik
kubectl delete namespace traefik
```plaintext

### Performance Tuning

#### Linkerd Resource Limits

```bash
# Adjust proxy resource limits in linkerd.ncl
_taskserv = linkerd.Linkerd {
    resources: {
        proxy_cpu_limit = "2000m"      # Increase if needed
        proxy_memory_limit = "512Mi"   # Increase if needed
    }
}
```plaintext

#### Istio Profile Selection

```bash
# Different resource profiles available
profile = "default"   # Full features (default)
profile = "demo"      # Demo mode (more resources)
profile = "minimal"   # Minimal (lower resources)
profile = "remote"    # Control plane only (advanced)
```plaintext

---

## Complete Workspace Directory Structure

After implementing these examples, your workspace should look like:

```plaintext
workspace/infra/my-cluster/
├── taskservs/
│   ├── cert-manager.ncl          # For Linkerd mTLS
│   ├── linkerd.ncl             # Service mesh option
│   ├── istio.ncl               # OR Istio option
│   ├── nginx-ingress.ncl       # Ingress controller
│   └── traefik.ncl             # Alternative ingress
├── clusters/
│   ├── web-api.ncl             # Application with Linkerd + Nginx
│   ├── api-service.ncl         # Application with Istio
│   └── simple-app.ncl          # App without service mesh
├── ingress/
│   ├── web-api-ingress.yaml    # Nginx Ingress resource
│   ├── api-route.yaml          # Traefik IngressRoute
│   └── simple-app-ingress.yaml # Simple Ingress
└── config.toml                 # Infrastructure-specific config
```plaintext

---

## Next Steps

1. **Choose your deployment model** (Linkerd+Nginx, Istio, or plain Nginx)
2. **Create taskserv KCL files** in `workspace/infra/<cluster>/taskservs/`
3. **Install components** using `provisioning taskserv create`
4. **Create application deployments** with appropriate mesh/ingress configuration
5. **Monitor and observe** using the appropriate dashboard

---

## Additional Resources

- **Linkerd Documentation**: <https://linkerd.io/>
- **Istio Documentation**: <https://istio.io/>
- **Nginx Ingress**: <https://kubernetes.github.io/ingress-nginx/>
- **Traefik Documentation**: <https://doc.traefik.io/>
- **Contour Documentation**: <https://projectcontour.io/>
- **Cilium Documentation**: <https://docs.cilium.io/>
