Admission webhook "linkerd-policy-validator.linkerd.io" denied the request: unknown variant `CORS`

[say5]

What is the issue?

Linkerd version edge-2026.2.1 admission webhook webhook linkerd-policy-validator.linkerd.io prevents HTTPRoute object with filter type CORS to be created.

How can it be reproduced?

Try to create HTTPRoute with filter type CORS.

Logs, error output, etc

for: "STDIN": error when patching "STDIN": admission webhook "linkerd-policy-validator.linkerd.io" denied the request: unknown variant `CORS`, expected one of `RequestHeaderModifier`, `ResponseHeaderModifier`, `RequestMirror`, `RequestRedirect`, `URLRewrite`, `ExtensionRef`

output of linkerd check -o short

Status check results are √

Environment

1. EKS version 1.33
2. Linkerd version edge-2026.2.
3. gateway api experimental 1.4.0

Possible solution

Maybe something like https://github.com/linkerd/linkerd2/pull/14844/changes can be applied here.

Additional context

No response

Would you like to work on fixing this bug?

None

[alpeb]

@say5 You pointed to #14844 which should already be included in edge-26.2.1. Can you help me understand what's different in your scenario that's causing this failure?

[say5]

@alpeb in ValidatingWebhookConfiguration linkerd is validating HTTPRoute /gateway.networking.k8s.io objects.

[alpeb]

Can you please provide an sample manifest for me to try reproducing this issue?

[say5]

Can you please provide an sample manifest for me to try reproducing this issue?

something like this:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example
spec:
  hostnames:
  - example.com
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: public
    namespace: kgateway-system
    sectionName: https
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: example-backend
      port: 8000
      weight: 1
    filters:
    - cors:
        allowHeaders:
        - Keep-Alive
        - User-Agent
        - X-Requested-With
        - If-Modified-Since
        - Cache-Control
        - Content-Type
        - Authorization
        allowMethods:
        - GET
        - POST
        - PUT
        - DELETE
        - OPTIONS
        allowOrigins:
        - https://example.com
        maxAge: 600
      type: CORS
    matches:
    - path:
        type: PathPrefix
        value: /