What is the issue?

According to documentation https://linkerd.io/2.14/reference/service-profiles/#response-match, responseClasses.condition.not should take a single response match:

However, I have to use the following to work

      responseClasses:
        - condition:
            not:
              - status:
                  min: 521
          isFailure: false

which suggests not takes a list instead of a single response match, which seems incorrect.

How can it be reproduced?

Put this snippet into any service profile:

      responseClasses:
        - condition:
            not:
              status:
                min: 521
          isFailure: false

Logs, error output, etc

│ Required type Tuple[DynamicPseudoType], but got
│ Object["status":Object["min":Number]]
│ ...at attribute:
│ object.spec.routes[1].responseClasses[1].condition.not

output of linkerd check -o short

N/A

Environment

• k8s 1.24
• EKS
• Linux
• linkerd 2.14.1

Possible solution

No response

Additional context

No response

Would you like to work on fixing this bug?

None