Misleading documentation on meshing with ingress mode

[FredrikAugust]

What is the issue?

On the meshing in ingress mode documentation page it reads

When an ingress is meshed in ingress mode, you must configure it to remove the l5d-dst-override header to avoid creating an open relay to cluster-local and external endpoints.

But further down, for Traefik v2, e.g., it tells you to add this header.

I might be reading this wrong, but it seems a bit self-contradictory?

How can it be reproduced?

N/A

Logs, error output, etc

N/A

output of linkerd check -o short

N/A

Environment

N/A

Possible solution

Rewrite the warning alert.

Additional context

No response

Would you like to work on fixing this bug?

None

[wmorgan]

Thanks for filing this. I moved it to the website repo which is where the docs live. I think you're right, the first statement could use a little clarification. Maybe instead of "you must configure it to remove the l5d-dst-override header" we say "you must configure it to strip the l5d-dst-override header from any incoming traffic" ...