k8s-service-mesh — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited k8s-service-mesh (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Traffic management, security, and observability using kubectl-mcp-server's Istio/Kiali tools.
Use this skill when:
| Priority | Rule | Impact | Tools |
|---|---|---|---|
| 1 | Detect Istio installation first | CRITICAL | istio_detect_tool |
| 2 | Run analyze before changes | HIGH | istio_analyze_tool |
| 3 | Check proxy status for sync | HIGH | istio_proxy_status_tool |
| 4 | Verify sidecar injection | MEDIUM | istio_sidecar_status_tool |
| Task | Tool | Example |
|---|---|---|
| Detect Istio | istio_detect_tool | istio_detect_tool() |
| Analyze config | istio_analyze_tool | istio_analyze_tool(namespace) |
| Proxy status | istio_proxy_status_tool | istio_proxy_status_tool() |
| List VirtualServices | istio_virtualservices_list_tool | istio_virtualservices_list_tool(namespace) |
istio_detect_tool()istio_proxy_status_tool()
istio_sidecar_status_tool(namespace)istio_analyze_tool(namespace)List and inspect:
istio_virtualservices_list_tool(namespace)
istio_virtualservice_get_tool(name, namespace)See TRAFFIC-SHIFTING.md for canary and blue-green patterns.
istio_destinationrules_list_tool(namespace)istio_gateways_list_tool(namespace)VirtualService for 90/10 split:
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: my-service
spec:
hosts:
- my-service
http:
- route:
- destination:
host: my-service
subset: stable
weight: 90
- destination:
host: my-service
subset: canary
weight: 10Apply and verify:
kubectl_apply(vs_yaml, namespace)
istio_virtualservice_get_tool("my-service", namespace)Route beta users:
http:
- match:
- headers:
x-user-type:
exact: beta
route:
- destination:
host: my-service
subset: canary
- route:
- destination:
host: my-service
subset: stableSee MTLS.md for detailed mTLS configuration.
istio_peerauthentications_list_tool(namespace)istio_authorizationpolicies_list_tool(namespace)istio_proxy_status_tool()If using Cilium with Istio:
hubble_flows_query_tool(namespace)
cilium_endpoints_list_tool(namespace)istio_sidecar_status_tool(namespace)istio_analyze_tool(namespace)
istio_virtualservice_get_tool(name, namespace)
istio_destinationrules_list_tool(namespace)
istio_proxy_status_tool()istio_peerauthentications_list_tool(namespace)| Symptom | Check | Resolution |
|---|---|---|
| 503 errors | istio_analyze_tool() | Fix VirtualService/DestinationRule |
| No sidecar | istio_sidecar_status_tool() | Label namespace |
| Config not applied | istio_proxy_status_tool() | Wait for sync or restart pod |
Istio multi-cluster setup:
istio_proxy_status_tool(context="primary")
istio_virtualservices_list_tool(namespace, context="primary")
istio_proxy_status_tool(context="remote") istioctl install --set profile=demo~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.