docs: add v0.1.1 changelog and service mesh detector docs

Author: ppiankov

CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-02-11
+
+### Added
+
+- 6 service mesh detectors for linkerd and istio
+  - LinkerdControlPlane: detects linkerd deployments with zero replicas (FATAL)
+  - LinkerdProxyInjection: detects linkerd pods in CrashLoopBackOff (CRITICAL)
+  - IstioControlPlane: detects istiod with zero replicas (FATAL)
+  - IstioSidecarInjection: detects istio-system pods in CrashLoopBackOff (CRITICAL)
+  - LinkerdCertExpiry: tiered alerts for identity cert expiry (<7d WARNING, <48h CRITICAL, <24h FATAL)
+  - IstioCertExpiry: tiered alerts for root cert expiry (<7d WARNING, <48h CRITICAL, <24h FATAL)
+
+### Changed
+
+- Total detector count: 7 → 13
+- CLAUDE.md synced with global project standards
+- CONTRIBUTING.md commit message format aligned with conventional commits
+- ARCHITECTURE.md Go version corrected to 1.25+, stale timing fixed to 1 minute
+
+### Fixed
+
+- Duplicate `.PHONY: deps` in Makefile
+- Stale problem timing documented as 2 minutes but implemented as 1 minute
+
 ## [0.1.0] - 2026-02-08
 
 ### Added
@@ -27,5 +51,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Prometheus health monitoring with connection status in TUI header
 - Multi-platform builds via Makefile (Linux, macOS, Windows)
 
-[Unreleased]: https://github.com/ppiankov/infranow/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/ppiankov/infranow/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/ppiankov/infranow/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/ppiankov/infranow/releases/tag/v0.1.0

README.md

@@ -209,11 +209,12 @@ Problem score formula: `severity_weight * (1 + blast_radius * 0.1) * (1 + persis
 
 ## Roadmap
 
-### v0.1.1
+### v0.1.1 (current)
 
 - ~~Increase test coverage to >80% across all packages~~ (done)
+- ~~Service mesh detectors for linkerd and istio~~ (done: 6 detectors)
+- ~~Certificate expiry detection with tiered severity~~ (done)
 - Integration tests with docker-compose + Prometheus
-- Watcher goroutine orchestration tests
 - Config file support (YAML)
 - Custom detector thresholds via config
 

docs/DETECTORS.md

@@ -231,6 +231,173 @@ kube_pod_status_phase{phase="Pending"} * on(namespace, pod) group_left() (time()
 
 ---
 
+## Service Mesh Detectors
+
+### LinkerdControlPlaneDetector
+
+**Purpose**: Detects linkerd control plane deployments with zero available replicas. When the control plane is down, proxy injection fails, mTLS breaks, and traffic routing stops for all meshed services.
+
+**Entity Type**: `service_mesh_control_plane`
+
+**Query**:
+```promql
+kube_deployment_status_replicas_available{namespace="linkerd"} == 0
+```
+
+**Severity**: `FATAL`
+
+**Blast Radius**: 15 (affects all meshed services)
+
+**Hint**: "Check pod status: kubectl get pods -n linkerd"
+
+---
+
+### LinkerdProxyInjectionDetector
+
+**Purpose**: Detects linkerd pods in CrashLoopBackOff. Catches proxy-injector, identity, and destination service failures.
+
+**Entity Type**: `service_mesh_control_plane`
+
+**Query**:
+```promql
+kube_pod_container_status_waiting_reason{namespace="linkerd",reason="CrashLoopBackOff"} > 0
+```
+
+**Severity**: `CRITICAL`
+
+**Blast Radius**: 10
+
+**Hint**: "Proxy injector or identity service failure"
+
+---
+
+### IstioControlPlaneDetector
+
+**Purpose**: Detects istiod with zero available replicas. When istiod is down, xDS config distribution stops and new deployments break.
+
+**Entity Type**: `service_mesh_control_plane`
+
+**Query**:
+```promql
+kube_deployment_status_replicas_available{namespace="istio-system",deployment="istiod"} == 0
+```
+
+**Severity**: `FATAL`
+
+**Blast Radius**: 15
+
+**Hint**: "Check pod status: kubectl get pods -n istio-system"
+
+---
+
+### IstioSidecarInjectionDetector
+
+**Purpose**: Detects istio-system pods in CrashLoopBackOff. Catches istiod, gateway, and pilot failures.
+
+**Entity Type**: `service_mesh_control_plane`
+
+**Query**:
+```promql
+kube_pod_container_status_waiting_reason{namespace="istio-system",reason="CrashLoopBackOff"} > 0
+```
+
+**Severity**: `CRITICAL`
+
+**Blast Radius**: 10
+
+**Hint**: "Sidecar injector or pilot failure"
+
+---
+
+## Service Mesh Certificate Detectors
+
+### LinkerdCertExpiryDetector
+
+**Purpose**: Detects linkerd identity certificates approaching expiry. Certificate expiry is the silent killer of service meshes — mTLS fails across all meshed services without warning.
+
+**Entity Type**: `service_mesh_certificate`
+
+**Query**:
+```promql
+(identity_cert_expiry_timestamp - time()) < 604800
+```
+
+**Severity** (tiered):
+- `WARNING`: < 7 days remaining
+- `CRITICAL`: < 48 hours remaining
+- `FATAL`: < 24 hours remaining or expired
+
+**Blast Radius**: 20 (highest — cert expiry kills the entire mesh)
+
+**Interval**: 60s
+
+**Hint**: "Rotate certs: linkerd check --proxy; Renew: linkerd upgrade | kubectl apply -f -"
+
+---
+
+### IstioCertExpiryDetector
+
+**Purpose**: Detects istio root certificate approaching expiry. When the Citadel root cert expires, all workload certificates become invalid.
+
+**Entity Type**: `service_mesh_certificate`
+
+**Query**:
+```promql
+(citadel_server_root_cert_expiry_timestamp - time()) < 604800
+```
+
+**Severity** (tiered):
+- `WARNING`: < 7 days remaining
+- `CRITICAL`: < 48 hours remaining
+- `FATAL`: < 24 hours remaining or expired
+
+**Blast Radius**: 20
+
+**Interval**: 60s
+
+**Hint**: "Check status: istioctl proxy-status; Rotate: istioctl create-remote-secret"
+
+---
+
+### Certificate Monitoring Setup
+
+Service mesh certificate metrics are **often missing from Prometheus**. This is the most common reason cert expiry goes undetected.
+
+**Why cert metrics are missing**:
+- Linkerd identity service not in Prometheus scrape targets
+- Istiod metrics endpoint not scraped
+- cert-manager not exporting metrics
+- ServiceMonitor or PodMonitor CRDs missing
+
+**How to verify**:
+```bash
+# Check if linkerd metrics are being scraped
+curl -s http://prometheus:9090/api/v1/targets | \
+  jq '.data.activeTargets[] | select(.labels.job | contains("linkerd"))'
+
+# Verify cert metric exists
+curl -s http://prometheus:9090/api/v1/query?query=identity_cert_expiry_timestamp
+curl -s http://prometheus:9090/api/v1/query?query=citadel_server_root_cert_expiry_timestamp
+```
+
+**Required scrape targets**:
+- **Linkerd**: `linkerd-identity` (port 9990), `linkerd-proxy-injector` (port 9995)
+- **Istio**: `istiod` (port 15014)
+- **cert-manager** (optional): `certmanager_certificate_expiration_timestamp_seconds`
+
+---
+
+### Service Mesh Metric Requirements
+
+| Metric | Source | Detector |
+|--------|--------|----------|
+| `kube_deployment_status_replicas_available` | kube-state-metrics | Control plane health |
+| `kube_pod_container_status_waiting_reason` | kube-state-metrics | Component crashes |
+| `identity_cert_expiry_timestamp` | linkerd-identity | Linkerd cert expiry |
+| `citadel_server_root_cert_expiry_timestamp` | istiod | Istio cert expiry |
+
+---
+
 ## Adding Custom Detectors
 
 To add a custom detector:
@@ -373,7 +540,7 @@ Post-MVP detector candidates:
 - **DatabaseReplicationLagDetector**: PostgreSQL/MySQL replication lag
 - **KafkaUnderReplicatedPartitionsDetector**: Kafka partition health
 - **RedisMemoryPressureDetector**: Redis memory usage
-- **CertificateExpirationDetector**: TLS certificate expiration
+- ~~**CertificateExpirationDetector**: TLS certificate expiration~~ (implemented in v0.1.1 as LinkerdCertExpiry + IstioCertExpiry)
 - **PVCFullDetector**: PersistentVolumeClaim usage
 - **NodeNotReadyDetector**: Kubernetes node health
 - **DeploymentReplicaMismatchDetector**: Desired vs actual replicas