The TrafficSplit CRD from linkerd-smi still carries the deprecated preserveUnknownFields

[Wenliang-CHEN]

What is the issue?

Hey all, similar to what this PR tried to fix, the TrafficSplit CRD in linkerd-smi also carries the preserveUnknownFields. I am creating this issue where I can park the fix PR.

How can it be reproduced?

The current version is v0.2.7, chart version v1.0.4. In the manifests from this chart we will see the field. This blocks ArgoCR from properly synchronizing the resources

Logs, error output, etc

N/A

output of linkerd check -o short

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version

linkerd-existence
-----------------
√ 'linkerd-config' config map exists
√ heartbeat ServiceAccount exist
√ control plane replica sets are ready
√ no unschedulable pods
√ control plane pods are ready
√ cluster networks contains all pods
√ cluster networks contains all services

linkerd-config
--------------
√ control plane Namespace exists
√ control plane ClusterRoles exist
√ control plane ClusterRoleBindings exist
√ control plane ServiceAccounts exist
√ control plane CustomResourceDefinitions exist
√ control plane MutatingWebhookConfigurations exist
√ control plane ValidatingWebhookConfigurations exist
√ proxy-init container runs as root user if docker container runtime is used

linkerd-identity
----------------
√ certificate config is valid
√ trust anchors are using supported crypto algorithm
√ trust anchors are within their validity period
√ trust anchors are valid for at least 60 days
√ issuer cert is using supported crypto algorithm
√ issuer cert is within its validity period
‼ issuer cert is valid for at least 60 days
    issuer certificate will expire on 2025-09-17T07:40:33Z
    see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-not-expiring-soon for hints
√ issuer cert is issued by the trust anchor

linkerd-webhooks-and-apisvc-tls
-------------------------------
√ proxy-injector webhook has valid cert
‼ proxy-injector cert is valid for at least 60 days
    certificate will expire on 2025-09-17T07:40:42Z
    see https://linkerd.io/2/checks/#l5d-proxy-injector-webhook-cert-not-expiring-soon for hints
√ sp-validator webhook has valid cert
‼ sp-validator cert is valid for at least 60 days
    certificate will expire on 2025-09-20T08:56:13Z
    see https://linkerd.io/2/checks/#l5d-sp-validator-webhook-cert-not-expiring-soon for hints
√ policy-validator webhook has valid cert
‼ policy-validator cert is valid for at least 60 days
    certificate will expire on 2025-09-17T07:40:31Z
    see https://linkerd.io/2/checks/#l5d-policy-validator-webhook-cert-not-expiring-soon for hints

linkerd-version
---------------
√ can determine the latest version
‼ cli is up-to-date
    is running version 24.5.1 but the latest edge version is 25.8.5
    see https://linkerd.io/2/checks/#l5d-version-cli for hints

control-plane-version
---------------------
√ can retrieve the control plane version
‼ control plane is up-to-date
    unsupported version channel: enterprise-2.18.0
    see https://linkerd.io/2/checks/#l5d-version-control for hints
‼ control plane and cli versions match
    control plane running enterprise-2.18.0 but cli running edge-24.5.1
    see https://linkerd.io/2/checks/#l5d-version-control for hints

linkerd-control-plane-proxy
---------------------------
√ control plane proxies are healthy
‼ control plane proxies are up-to-date
    some proxies are not running the current version:
	* linkerd-destination-68c5596c8d-284v8 (edge-25.7.3)
	* linkerd-destination-68c5596c8d-d7xnb (edge-25.7.3)
	* linkerd-destination-68c5596c8d-vkbpp (edge-25.7.3)
	* linkerd-destination-68c5596c8d-wk25g (edge-25.7.3)
	* linkerd-destination-68c5596c8d-x4tdq (edge-25.7.3)
	* linkerd-enterprise-5566cd5b9-4fhgr (edge-25.7.3)
	* linkerd-enterprise-5566cd5b9-8rwf8 (edge-25.7.3)
	* linkerd-enterprise-5566cd5b9-d9w28 (edge-25.7.3)
	* linkerd-enterprise-5566cd5b9-lsvfk (edge-25.7.3)
	* linkerd-enterprise-5566cd5b9-m74zx (edge-25.7.3)
	* linkerd-identity-7fdf4d75b7-gbgtn (edge-25.7.3)
	* linkerd-identity-7fdf4d75b7-gvpxz (edge-25.7.3)
	* linkerd-identity-7fdf4d75b7-mq5vj (edge-25.7.3)
	* linkerd-identity-7fdf4d75b7-rrd4t (edge-25.7.3)
	* linkerd-identity-7fdf4d75b7-vc29f (edge-25.7.3)
	* linkerd-proxy-injector-6d846f68b6-7d5pt (edge-25.7.3)
	* linkerd-proxy-injector-6d846f68b6-blx9w (edge-25.7.3)
	* linkerd-proxy-injector-6d846f68b6-chkj9 (edge-25.7.3)
	* linkerd-proxy-injector-6d846f68b6-lvnmb (edge-25.7.3)
	* linkerd-proxy-injector-6d846f68b6-srdxk (edge-25.7.3)
    see https://linkerd.io/2/checks/#l5d-cp-proxy-version for hints
‼ control plane proxies and cli versions match
    linkerd-destination-68c5596c8d-284v8 running edge-25.7.3 but cli running edge-24.5.1
    see https://linkerd.io/2/checks/#l5d-cp-proxy-cli-version for hints

linkerd-ha-checks
-----------------
√ multiple replicas of control plane pods

linkerd-extension-checks
------------------------
√ namespace configuration for extensions

linkerd-viz
-----------
√ linkerd-viz Namespace exists
√ can initialize the client
√ linkerd-viz ClusterRoles exist
√ linkerd-viz ClusterRoleBindings exist
√ tap API server has valid cert
√ tap API server cert is valid for at least 60 days
√ tap API service is running
‼ linkerd-viz pods are injected
    could not find proxy container for prometheus-scrape-1-77d574cfc-lmq7c pod
    see https://linkerd.io/2/checks/#l5d-viz-pods-injection for hints
‼ viz extension pods are running
    container "linkerd-proxy" in pod "prometheus-scrape-1-77d574cfc-lmq7c" is not ready
    see https://linkerd.io/2/checks/#l5d-viz-pods-running for hints
√ viz extension proxies are healthy
‼ viz extension proxies are up-to-date
    some proxies are not running the current version:
	* grafana-7c8cd46fcf-g7rgr (edge-25.7.3)
	* metrics-api-757f8d7ff-9l9hb (edge-25.7.3)
	* metrics-api-757f8d7ff-mfl4v (edge-25.7.3)
	* tap-7bd645b6b8-9q5hk (edge-25.7.3)
	* tap-injector-5548c565f5-s99qk (edge-25.7.3)
	* web-7fbbbd9c4d-72k8t (edge-25.7.3)
    see https://linkerd.io/2/checks/#l5d-viz-proxy-cp-version for hints
‼ viz extension proxies and cli versions match
    grafana-7c8cd46fcf-g7rgr running edge-25.7.3 but cli running edge-24.5.1
    see https://linkerd.io/2/checks/#l5d-viz-proxy-cli-version for hints
√ prometheus is installed and configured correctly
√ viz extension self-check

linkerd-smi
-----------
√ linkerd-smi extension Namespace exists
√ SMI extension service account exists
√ SMI extension pods are injected
√ SMI extension pods are running
√ SMI extension proxies are healthy

Status check results are √

Environment

EKS
Kubernetes v1.31.9
Linkerd 2.18.0

Possible solution

Just remove the field from the TrafficSplit CRD

Additional context

No response

Would you like to work on fixing this bug?

yes

[kflynn]

Hi @Wenliang-CHEN, thanks for the report!

Linkerd's support for SMI is, at this point, deprecated in favor of dynamic routing using Gateway API -- if you're running into something that you can do with SMI that you can't do with Gateway API, please let me know! I'm going to go ahead and close this issue, though, because we're not going to update the SMI stuff any more. (And I'm sorry for the delay -- we needed to update our docs to reflect what's correct.)

[Wenliang-CHEN]

Hi @kflynn thanks for the reply. Yeah, there is use case that specifically relies on the SMI extension, although not a core use case for Linkerd.

We are still using the old Flagger to run canary deployments. I think we need to migrate to using the gateway API instead. Is this the right doc that I need?

Cheers

[kflynn]

Yup, that's the one!