feat(meshtls): initial guide

[slonka]

closes #1897

rendered: https://deploy-preview-1906--kuma.netlify.app/docs/dev/guides/progressively-rolling-in-strict-mtls/

Did you sign your commit? Instructions yes

Have you read Contributing guidelines? yes

[netlify]

✅ Deploy Preview for kuma ready!

Name	Link
🔨 Latest commit	701df3f
🔍 Latest deploy log	https://app.netlify.com/sites/kuma/deploys/66f27783cc5aae00083abcf6
😎 Deploy Preview	https://deploy-preview-1906--kuma.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 88 (🔴 down 5 from production) Accessibility: 90 (no change from production) Best Practices: 100 (no change from production) SEO: 85 (no change from production) PWA: 80 (no change from production) View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[lahabana]

This guide looks good.

I think a few things:

1. It would be good to have a mermaid diagram to show what things look like at each step
2. It would be good at the end to have a section: "Things to remember when migrating to strict TLS" with things like: "before turning something to strict check that this stat is no longer incrementing"

[slonka]

It would be good to have a mermaid diagram to show what things look like at each step

added, do you think I should also somehow show when things are in strict vs permissive mode?

It would be good at the end to have a section: "Things to remember when migrating to strict TLS" with things like: "before turning something to strict check that this stat is no longer incrementing"

added that but need to check that metric... @johncowen - did we write down the metrics we want to use in the GUI to show TLS-ed / non TLS-ed requests / connections?

also do you have any other final points that we should add?

[johncowen]

@slonka I think this is what you are talking about:

kumahq/kuma-gui#2974

Lemme know if not!

[slonka]

@lahabana - probably shouldn't ask the users to calculate things by hand... maybe we should keep tls_inspector stats for now with a * that it's not 100% sure and point people to GUI once the feature linked by JC makes sense, WDYT?

[lahabana]

Providing at least clarity as to which metrics users should like like seems ok to me no? What's being calculated here?

The graphs look good but would it be helpful to color the arrows depending on TLS and non-TLS traffic?