Incorrect schema for responseClasses.condition.not in service profile

[Hexcles]

What is the issue?

According to documentation https://linkerd.io/2.14/reference/service-profiles/#response-match, responseClasses.condition.not should take a single response match:

However, I have to use the following to work

      responseClasses:
        - condition:
            not:
              - status:
                  min: 521
          isFailure: false

which suggests not takes a list instead of a single response match, which seems incorrect.

How can it be reproduced?

Put this snippet into any service profile:

      responseClasses:
        - condition:
            not:
              status:
                min: 521
          isFailure: false

Logs, error output, etc

│ Required type Tuple[DynamicPseudoType], but got
│ Object["status":Object["min":Number]]
│ ...at attribute:
│ object.spec.routes[1].responseClasses[1].condition.not

output of linkerd check -o short

N/A

Environment

• k8s 1.24
• EKS
• Linux
• linkerd 2.14.1

Possible solution

No response

Additional context

No response

Would you like to work on fixing this bug?

None

[Hexcles]

Actually, if I try to apply

      responseClasses:
        - condition:
            not:
              - status:
                  min: 521
          isFailure: false

I'd get

│ admission webhook "linkerd-sp-validator.linkerd.io" denied the request:
│ failed to validate ServiceProfile: error unmarshaling JSON: while decoding
│ JSON: json: cannot unmarshal array into Go struct field
│ ResponseMatch.spec.routes.responseClasses.condition.not of type
│ v1alpha2.ResponseMatch

so looks like there's a mismatch between the validation during terraform plan and apply

[kflynn]

Hey @Hexcles -- yeah, this looks like a legitimate bug, let me see where we can fit this in...

[kflynn]

(This fix didn't quite make stable-2.14.2 but should be out in an edge release shortly!)