Repository: knative/serving
Pull request #14058 (2023-06-02 20:20:50)

Change storage version of DomainMapping to v1beta1
Fixes https://github.com/knative/serving/issues/14059

<!-- Please include the 'why' behind your changes if no issue exists -->
## Proposed Changes

* This deprecates DomainMapping v1alpha1 and changes the storage version to v1beta1

**Release Note**

<!-- Enter your extended release note in the below block. If the PR requires
additional action from users switching to the new release, include the string
"action required". If no release note is required, write "NONE". -->

```release-note
DomainMapping/v1alpha1 is deprecated - use v1beta1 APIs
```


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/14058#" title="Author self-approved">dprotaso</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative/serving/blob/main/OWNERS)~~ [dprotaso]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov[bot]: ## [Codecov](https://app.codecov.io/gh/knative/serving/pull/14058?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
Patch coverage has no change and project coverage change: **`+0.02`** :tada:
> Comparison is base [(`d07bf78`)](https://app.codecov.io/gh/knative/serving/commit/d07bf7853b64345fa8d2b84b72707020c717cdb4?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.21% compared to head [(`47dce30`)](https://app.codecov.io/gh/knative/serving/pull/14058?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.23%.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main   #14058      +/-   ##
==========================================
+ Coverage   86.21%   86.23%   +0.02%     
==========================================
  Files         199      199              
  Lines       14767    14767              
==========================================
+ Hits        12731    12734       +3     
+ Misses       1734     1732       -2     
+ Partials      302      301       -1     
```


[see 1 file with indirect coverage changes](https://app.codecov.io/gh/knative/serving/pull/14058/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)


</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/knative/serving/pull/14058?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).

knative-prow[bot]: @dprotaso: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
upgrade-tests_serving_main | 47dce3054d25aef78ff1497980a47825de6c72db | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/14058/upgrade-tests_serving_main/1664728813755437056) | true | `/test upgrade-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 9bf8cadb0..b47fefd4d 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -152,7 +152,7 @@ aliases:
   technical-oversight-committee:
   - dprotaso
   - dsimansk
-  - evankanderson
+  - kvmware
   - psschwei
   - zroubalik
   trademark-committee:
diff --git a/cmd/controller/main.go b/cmd/controller/main.go
index c4895f011..94dd13db9 100644
--- a/cmd/controller/main.go
+++ b/cmd/controller/main.go
@@ -20,7 +20,7 @@ import (
 	// The set of controllers this controller process runs.
 	"flag"
 
-	certificate "knative.dev/control-protocol/pkg/certificates/reconciler"
+	certificate "knative.dev/networking/pkg/certificates/reconciler"
 	"knative.dev/pkg/reconciler"
 	"knative.dev/pkg/signals"
 	"knative.dev/serving/pkg/reconciler/configuration"
diff --git a/config/core/300-resources/domain-mapping.yaml b/config/core/300-resources/domain-mapping.yaml
index 9e048d99b..8ea083587 100644
--- a/config/core/300-resources/domain-mapping.yaml
+++ b/config/core/300-resources/domain-mapping.yaml
@@ -25,7 +25,7 @@ spec:
   versions:
     - name: v1beta1
       served: true
-      storage: false
+      storage: true
       subresources:
         status: {}
       additionalPrinterColumns:
@@ -149,7 +149,9 @@ spec:
                   type: string
     - name: v1alpha1
       served: true
-      storage: true
+      storage: false
+      deprecated: true
+      deprecationWarning: The v1alpha1 version of DomainMapping has been deprecated and will be removed in a future release of the API. Please upgrade to v1beta1
       subresources:
         status: {}
       schema:
diff --git a/config/core/300-secret.yaml b/config/core/300-secret.yaml
index faeabb73f..abce97bd1 100644
--- a/config/core/300-secret.yaml
+++ b/config/core/300-secret.yaml
@@ -15,8 +15,8 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  # Do not drop -ctrl-ca suffix as control-protocol requires it.
-  # https://github.com/knative-sandbox/control-protocol/blob/main/pkg/certificates/reconciler/controller.go
+  # Do not drop -ctrl-ca suffix as certificate creation requires it
+  # https://github.com/knative/networking/blob/main/pkg/certificates/reconciler/controller.go#L38
   name: serving-certs-ctrl-ca
   namespace: knative-serving
   labels:
diff --git a/config/post-install/storage-version-migration.yaml b/config/post-install/storage-version-migration.yaml
index 887d7dfa9..b7b0c5708 100644
--- a/config/post-install/storage-version-migration.yaml
+++ b/config/post-install/storage-version-migration.yaml
@@ -47,6 +47,7 @@ spec:
           - "configurations.serving.knative.dev"
           - "revisions.serving.knative.dev"
           - "routes.serving.knative.dev"
+          - "domainmappings.serving.knative.dev"
         resources:
           requests:
             cpu: 100m
diff --git a/go.mod b/go.mod
index 2e035c5eb..0e29e9073 100644
--- a/go.mod
+++ b/go.mod
@@ -32,11 +32,10 @@ require (
 	k8s.io/code-generator v0.26.5
 	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
 	k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2
-	knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6
-	knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d
-	knative.dev/hack v0.0.0-20230530201435-5b7907fbe350
-	knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60
-	knative.dev/pkg v0.0.0-20230531073936-5671699f23d9
+	knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8
+	knative.dev/hack v0.0.0-20230606014732-a861c8e9da08
+	knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6
+	knative.dev/pkg v0.0.0-20230606013829-94b81fcefb58
 	sigs.k8s.io/yaml v1.3.0
 )
 
diff --git a/go.sum b/go.sum
index 2a4c18194..1ae4a37af 100644
--- a/go.sum
+++ b/go.sum
@@ -1194,16 +1194,14 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
 k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6 h1:kajORjwXlGzSPddhazNIE01i5Efgqo52iB8VdFou22g=
-knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6/go.mod h1:G3SAcfsMvSh0QeE0qybQ4G1J7v60XeH1DLaHGx12Ixk=
-knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d h1:UCorKZ+dKWmBesDNpocdKLsd/yo+qsCCvnlzj4+QNxs=
-knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d/go.mod h1:6IjiiR5I2DjCWdOsj0jLvrIjzDaKYaq4jUhT1ImrWwg=
-knative.dev/hack v0.0.0-20230530201435-5b7907fbe350 h1:lSV9uFTohrQd7i5OUhLnR87PwUHJplQKJSEiZgzP/VY=
-knative.dev/hack v0.0.0-20230530201435-5b7907fbe350/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
-knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60 h1:vErunGWa8pZNriLFaE4UbgdqNECKF7gJTYZE+DdOuOE=
-knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60/go.mod h1:ieNknBTSWl441656hZF1JNHbTXbab138w8qPEwuwC0Q=
-knative.dev/pkg v0.0.0-20230531073936-5671699f23d9 h1:xd7E2nuQ358cXR4jB7Y5+FH88Mm+SQTZty5pXa1TSfs=
-knative.dev/pkg v0.0.0-20230531073936-5671699f23d9/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
+knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8 h1:mcADzDjLLEfO+8pDQofp/HqP7Z4vwwVBRdH2rnsrF0Q=
+knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8/go.mod h1:PfSeGXb3BpXZRZlzpVhsDcWB0qCCw/+tKNMUYKhyvpo=
+knative.dev/hack v0.0.0-20230606014732-a861c8e9da08 h1:6DH2ktsj5KoKMAxPFmiDopMCVR1LzhxFNy3D/JCg7JE=
+knative.dev/hack v0.0.0-20230606014732-a861c8e9da08/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
+knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6 h1:m+CUC915l+Ey1DNmMlM/5bwzt/dPQOw43KD989xDdFI=
+knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6/go.mod h1:Z2HjQrktBjIbiqLf69ZrqbMjaJ1peSLJZhYwG+BjXno=
+knative.dev/pkg v0.0.0-20230606013829-94b81fcefb58 h1:fsFj11vFdFkKk0TMJYnA7hus9FUhV1oMltRvbWCyQj8=
+knative.dev/pkg v0.0.0-20230606013829-94b81fcefb58/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
 pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/pkg/activator/certificate/cache.go b/pkg/activator/certificate/cache.go
index 699ace5cc..62f43e4f8 100644
--- a/pkg/activator/certificate/cache.go
+++ b/pkg/activator/certificate/cache.go
@@ -28,7 +28,7 @@ import (
 	v1 "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/tools/cache"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/controller"
 	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
@@ -103,7 +103,7 @@ func (cr *CertCache) updateCache(secret *corev1.Secret) {
 
 	cr.TLSConf.RootCAs = pool
 	cr.TLSConf.ServerName = certificates.LegacyFakeDnsName
-	cr.TLSConf.MinVersion = tls.VersionTLS12
+	cr.TLSConf.MinVersion = tls.VersionTLS13
 }
 
 func (cr *CertCache) handleCertificateUpdate(_, new interface{}) {
diff --git a/pkg/queue/sharedmain/main.go b/pkg/queue/sharedmain/main.go
index a28d88775..0400d4164 100644
--- a/pkg/queue/sharedmain/main.go
+++ b/pkg/queue/sharedmain/main.go
@@ -32,7 +32,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/types"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netstats "knative.dev/networking/pkg/http/stats"
 	pkglogging "knative.dev/pkg/logging"
 	"knative.dev/pkg/logging/logkey"
diff --git a/pkg/reconciler/autoscaling/kpa/kpa.go b/pkg/reconciler/autoscaling/kpa/kpa.go
index e155aa56b..013022d2d 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa.go
@@ -25,6 +25,7 @@ import (
 	"go.uber.org/zap"
 
 	nv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/logging"
 	pkgmetrics "knative.dev/pkg/metrics"
 	"knative.dev/pkg/ptr"
@@ -128,7 +129,7 @@ func (c *Reconciler) ReconcileKind(ctx context.Context, pa *autoscalingv1alpha1.
 	// When activator CA is enabled, force activator always in path.
 	// TODO: This is a temporary state and to be fixed.
 	// See also issues/11906 and issues/12797.
-	case config.FromContext(ctx).Network.InternalEncryption:
+	case config.FromContext(ctx).Network.DataplaneTrust != netcfg.TrustDisabled:
 		mode = nv1alpha1.SKSOperationModeProxy
 
 	// If the want == -1 and PA is inactive that implies the autoscaler
diff --git a/pkg/reconciler/revision/reconcile_resources.go b/pkg/reconciler/revision/reconcile_resources.go
index 1ff13b27a..4818c35b9 100644
--- a/pkg/reconciler/revision/reconcile_resources.go
+++ b/pkg/reconciler/revision/reconcile_resources.go
@@ -28,7 +28,7 @@ import (
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	"knative.dev/pkg/kmeta"
 	"knative.dev/pkg/kmp"
 	"knative.dev/pkg/logging"
diff --git a/pkg/reconciler/route/resources/ingress.go b/pkg/reconciler/route/resources/ingress.go
index 588a37cfe..64bb51020 100644
--- a/pkg/reconciler/route/resources/ingress.go
+++ b/pkg/reconciler/route/resources/ingress.go
@@ -29,6 +29,7 @@ import (
 
 	"knative.dev/networking/pkg/apis/networking"
 	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	netheader "knative.dev/networking/pkg/http/header"
 	ingress "knative.dev/networking/pkg/ingress"
 	"knative.dev/pkg/kmeta"
@@ -149,7 +150,7 @@ func makeIngressSpec(
 				return netv1alpha1.IngressSpec{}, err
 			}
 			rule := makeIngressRule(domains, r.Namespace,
-				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.InternalEncryption)
+				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.DataplaneTrust != netcfg.TrustDisabled)
 			if featuresConfig.TagHeaderBasedRouting == apicfg.Enabled {
 				if rule.HTTP.Paths[0].AppendHeaders == nil {
 					rule.HTTP.Paths[0].AppendHeaders = make(map[string]string, 1)
@@ -171,7 +172,7 @@ func makeIngressSpec(
 					// Since names are sorted `DefaultTarget == ""` is the first one,
 					// so just pass the subslice.
 					rule.HTTP.Paths = append(
-						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.InternalEncryption, names[1:]), rule.HTTP.Paths...)
+						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.DataplaneTrust != netcfg.TrustDisabled, names[1:]), rule.HTTP.Paths...)
 				} else {
 					// If a request is routed by a tag-attached hostname instead of the tag header,
 					// the request may not have the tag header "Knative-Serving-Tag",
diff --git a/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE b/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE
deleted file mode 100644
index 261eeb9e9..000000000
--- a/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/knative.dev/control-protocol/LICENSE b/vendor/knative.dev/control-protocol/LICENSE
deleted file mode 100644
index 261eeb9e9..000000000
--- a/vendor/knative.dev/control-protocol/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
index 8d9530844..35787c8d5 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
@@ -29,7 +29,7 @@ func (c *Certificate) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates CertificateSpec object.
-func (spec *CertificateSpec) Validate(ctx context.Context) (all *apis.FieldError) {
+func (spec *CertificateSpec) Validate(_ context.Context) (all *apis.FieldError) {
 	// Spec must have at least one DNS Name.
 	if len(spec.DNSNames) == 0 {
 		all = all.Also(apis.ErrMissingField("dnsNames"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
index a0cec0126..1d3ff93c8 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
@@ -28,5 +28,5 @@ func (d *Domain) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in DomainSpec
-func (*DomainSpec) SetDefaults(ctx context.Context) {
+func (*DomainSpec) SetDefaults(_ context.Context) {
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
index d2434e234..85d556972 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
@@ -50,7 +50,7 @@ func (ds *DomainSpec) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-func (lb *LoadBalancerIngressSpec) Validate(ctx context.Context) *apis.FieldError {
+func (lb *LoadBalancerIngressSpec) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if lb.Domain == "" && lb.DomainInternal == "" && lb.IP == "" && !lb.MeshOnly {
 		return all.Also(apis.ErrMissingOneOf("domain", "domainInternal", "ip", "meshOnly"))
@@ -58,7 +58,7 @@ func (lb *LoadBalancerIngressSpec) Validate(ctx context.Context) *apis.FieldErro
 	return all
 }
 
-func (cfg *IngressConfig) Validate(ctx context.Context) *apis.FieldError {
+func (cfg *IngressConfig) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if cfg.Name == "" {
 		all = all.Also(apis.ErrMissingField("name"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
index 890717dd6..6cfc08524 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
@@ -38,7 +38,7 @@ func (is *IngressSpec) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in IngressTLS
-func (t *IngressTLS) SetDefaults(ctx context.Context) {}
+func (t *IngressTLS) SetDefaults(_ context.Context) {}
 
 // SetDefaults populates default values in IngressRule
 func (r *IngressRule) SetDefaults(ctx context.Context) {
@@ -56,7 +56,7 @@ func (h *HTTPIngressRuleValue) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in HTTPIngressPath
-func (h *HTTPIngressPath) SetDefaults(ctx context.Context) {
+func (h *HTTPIngressPath) SetDefaults(_ context.Context) {
 	// If only one split is specified, we default to 100.
 	if len(h.Splits) == 1 && h.Splits[0].Percent == 0 {
 		h.Splits[0].Percent = 100
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
index ed708d420..2a49acddb 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
@@ -152,7 +152,7 @@ func (b IngressBackend) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates IngressTLS object.
-func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
+func (t *IngressTLS) Validate(_ context.Context) *apis.FieldError {
 	// Provided TLS setting must not be empty.
 	if equality.Semantic.DeepEqual(t, &IngressTLS{}) {
 		return apis.ErrMissingField(apis.CurrentField)
@@ -168,7 +168,7 @@ func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-func (t HTTPOption) Validate(ctx context.Context) (all *apis.FieldError) {
+func (t HTTPOption) Validate(_ context.Context) (all *apis.FieldError) {
 	switch t {
 	case "", HTTPOptionEnabled, HTTPOptionRedirected:
 		break
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
index 85d7c41f1..5614104be 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
@@ -28,5 +28,5 @@ func (r *Realm) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in RealmSpec
-func (*RealmSpec) SetDefaults(ctx context.Context) {
+func (*RealmSpec) SetDefaults(_ context.Context) {
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
index 7137499d7..93caf7016 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
@@ -28,7 +28,7 @@ func (r *Realm) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates RealmSpec object.
-func (rs *RealmSpec) Validate(ctx context.Context) *apis.FieldError {
+func (rs *RealmSpec) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if rs.External == "" && rs.Internal == "" {
 		all = all.Also(apis.ErrMissingOneOf("external", "internal"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
index 884754d09..cb358ad90 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
@@ -24,6 +24,6 @@ func (ss *ServerlessService) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults sets default values on the ServerlessServiceSpec.
-func (*ServerlessServiceSpec) SetDefaults(ctx context.Context) {
+func (*ServerlessServiceSpec) SetDefaults(_ context.Context) {
 	// Nothing is defaultable so far.
 }
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/certs.go b/vendor/knative.dev/networking/pkg/certificates/certs.go
similarity index 71%
rename from vendor/knative.dev/control-protocol/pkg/certificates/certs.go
rename to vendor/knative.dev/networking/pkg/certificates/certs.go
index 68cb4f125..16cca6047 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/certs.go
+++ b/vendor/knative.dev/networking/pkg/certificates/certs.go
@@ -23,13 +23,9 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"math/big"
 	"time"
-
-	"go.uber.org/zap"
-	"knative.dev/pkg/logging"
 )
 
 var randReader = rand.Reader
@@ -39,7 +35,7 @@ var serialNumberLimit = new(big.Int).Lsh(big.NewInt(1), 128)
 func createCertTemplate(expirationInterval time.Duration, sans []string) (*x509.Certificate, error) {
 	serialNumber, err := rand.Int(randReader, serialNumberLimit)
 	if err != nil {
-		return nil, errors.New("failed to generate serial number: " + err.Error())
+		return nil, fmt.Errorf("failed to generate serial number: %w", err)
 	}
 
 	tmpl := x509.Certificate{
@@ -83,12 +79,12 @@ func createTransportCertTemplate(expirationInterval time.Duration, sans []string
 	return cert, err
 }
 
-func createCert(template, parent *x509.Certificate, pub, parentPriv interface{}) (cert *x509.Certificate, certPEM *pem.Block, err error) {
+func createCert(template, parent *x509.Certificate, pub, parentPriv interface{}) (certPEM *pem.Block, err error) {
 	certDER, err := x509.CreateCertificate(rand.Reader, template, parent, pub, parentPriv)
 	if err != nil {
 		return
 	}
-	cert, err = x509.ParseCertificate(certDER)
+	_, err = x509.ParseCertificate(certDER)
 	if err != nil {
 		return
 	}
@@ -97,24 +93,20 @@ func createCert(template, parent *x509.Certificate, pub, parentPriv interface{})
 }
 
 // CreateCACerts generates the root CA cert
-func CreateCACerts(ctx context.Context, expirationInterval time.Duration) (*KeyPair, error) {
-	logger := logging.FromContext(ctx)
+func CreateCACerts(expirationInterval time.Duration) (*KeyPair, error) {
 	caKeyPair, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		logger.Errorw("error generating random key", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating random key: %w", err)
 	}
 
 	rootCertTmpl, err := createCACertTemplate(expirationInterval)
 	if err != nil {
-		logger.Errorw("error generating CA cert", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating CA cert: %w", err)
 	}
 
-	_, caCertPem, err := createCert(rootCertTmpl, rootCertTmpl, &caKeyPair.PublicKey, caKeyPair)
+	caCertPem, err := createCert(rootCertTmpl, rootCertTmpl, &caKeyPair.PublicKey, caKeyPair)
 	if err != nil {
-		logger.Errorw("error signing the CA cert", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error signing the CA cert: %w", err)
 	}
 	caPrivateKeyPem := &pem.Block{
 		Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(caKeyPair),
@@ -123,37 +115,33 @@ func CreateCACerts(ctx context.Context, expirationInterval time.Duration) (*KeyP
 }
 
 // Deprecated: CreateControlPlaneCert generates the certificate for the client
-func CreateControlPlaneCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
-	return CreateCert(ctx, caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
+func CreateControlPlaneCert(_ context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
+	return CreateCert(caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
 }
 
 // Deprecated: CreateDataPlaneCert generates the certificate for the server
-func CreateDataPlaneCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
-	return CreateCert(ctx, caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
+func CreateDataPlaneCert(_ context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
+	return CreateCert(caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
 }
 
 // CreateCert generates the certificate for use by client and server
-func CreateCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration, sans ...string) (*KeyPair, error) {
-	logger := logging.FromContext(ctx)
+func CreateCert(caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration, sans ...string) (*KeyPair, error) {
 
 	// Then create the private key for the serving cert
 	keyPair, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		logger.Errorw("error generating random key", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating random key: %w", err)
 	}
 
 	certTemplate, err := createTransportCertTemplate(expirationInterval, sans)
 	if err != nil {
-		logger.Errorw("failed to create the certificate template", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("failed to create the certificate template: %w", err)
 	}
 
 	// create a certificate which wraps the public key, sign it with the CA private key
-	_, certPEM, err := createCert(certTemplate, caCertificate, &keyPair.PublicKey, caKey)
+	certPEM, err := createCert(certTemplate, caCertificate, &keyPair.PublicKey, caKey)
 	if err != nil {
-		logger.Errorw("error signing certificate template", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error signing certificate template: %w", err)
 	}
 
 	privateKeyPEM := &pem.Block{
@@ -187,9 +175,9 @@ func ParseCert(certPemBytes []byte, privateKeyPemBytes []byte) (*x509.Certificat
 	return cert, pk, err
 }
 
-// ValidateCert checks the expiration of the certificate
-func ValidateCert(cert *x509.Certificate, rotationThreshold time.Duration) error {
-	if !cert.NotAfter.After(time.Now().Add(rotationThreshold)) {
+// CheckExpiry checks the expiration of the certificate
+func CheckExpiry(cert *x509.Certificate, rotationThreshold time.Duration) error {
+	if time.Now().Add(rotationThreshold).After(cert.NotAfter) {
 		return fmt.Errorf("certificate is going to expire %v", cert.NotAfter)
 	}
 	return nil
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/constants.go b/vendor/knative.dev/networking/pkg/certificates/constants.go
similarity index 75%
rename from vendor/knative.dev/control-protocol/pkg/certificates/constants.go
rename to vendor/knative.dev/networking/pkg/certificates/constants.go
index cfb125e33..04a1d7747 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/constants.go
+++ b/vendor/knative.dev/networking/pkg/certificates/constants.go
@@ -19,9 +19,12 @@ package certificates
 import "strings"
 
 const (
-	Organization           = "knative.dev"
-	LegacyFakeDnsName      = "data-plane." + Organization
-	FakeDnsName            = LegacyFakeDnsName // Deprecated
+	Organization = "knative.dev"
+	//nolint:all
+	LegacyFakeDnsName = "data-plane." + Organization
+	//nolint:all
+	// Deprecated: FakeDnsName is deprecated. Please use the DataPlaneRoutingName or DataPlaneUserName function.
+	FakeDnsName            = LegacyFakeDnsName
 	dataPlaneUserPrefix    = "kn-user-"
 	dataPlaneRoutingPrefix = "kn-routing-"
 	ControlPlaneName       = "kn-control"
@@ -33,18 +36,21 @@ const (
 	PrivateKeyName = "tls.key"
 
 	//These should be able to be deprecated some time in the future when the new names are fully adopted
+	// #nosec
 	SecretCaCertKey = "ca-cert.pem"
-	SecretCertKey   = "public-cert.pem"
-	SecretPKKey     = "private-key.pem"
+	// #nosec
+	SecretCertKey = "public-cert.pem"
+	// #nosec
+	SecretPKKey = "private-key.pem"
 )
 
 // DataPlaneRoutingName constructs a san for a data-plane-routing certificate
 // Accepts a routingId  - a unique identifier used as part of the san (default is "0" used when an empty routingId is provided)
-func DataPlaneRoutingName(routingId string) string {
-	if routingId == "" {
-		routingId = "0"
+func DataPlaneRoutingName(routingID string) string {
+	if routingID == "" {
+		routingID = "0"
 	}
-	return dataPlaneRoutingPrefix + strings.ToLower(routingId)
+	return dataPlaneRoutingPrefix + strings.ToLower(routingID)
 }
 
 // DataPlaneUserName constructs a san for a data-plane-user certificate
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/key_pair.go b/vendor/knative.dev/networking/pkg/certificates/key_pair.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/key_pair.go
rename to vendor/knative.dev/networking/pkg/certificates/key_pair.go
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
similarity index 86%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
index c6687a81b..8a4ced724 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go
+++ b/vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
@@ -17,6 +17,7 @@ limitations under the License.
 package sample
 
 import (
+	"bytes"
 	"context"
 	"crypto/rsa"
 	"crypto/x509"
@@ -34,7 +35,7 @@ import (
 	pkgreconciler "knative.dev/pkg/reconciler"
 	"knative.dev/pkg/system"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 )
 
 const (
@@ -89,14 +90,14 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 		r.logger.Errorf("Error accessing CA certificate secret %q %q: %v", system.Namespace(), r.caSecretName, err)
 		return err
 	}
-	caCert, caPk, err := parseAndValidateSecret(caSecret, false)
+	caCert, caPk, err := parseAndValidateSecret(caSecret, nil)
 	if err != nil {
 		r.logger.Infof("CA cert invalid: %v", err)
 
 		// We need to generate a new CA cert, then shortcircuit the reconciler
-		keyPair, err := certificates.CreateCACerts(ctx, caExpirationInterval)
+		keyPair, err := certificates.CreateCACerts(caExpirationInterval)
 		if err != nil {
-			return fmt.Errorf("cannot generate the CA cert: %v", err)
+			return fmt.Errorf("cannot generate the CA cert: %w", err)
 		}
 		return r.commitUpdatedSecret(ctx, caSecret, keyPair, nil)
 	}
@@ -107,8 +108,8 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 	case controlPlaneSecretType:
 		sans = []string{certificates.ControlPlaneName, certificates.LegacyFakeDnsName}
 	case dataPlaneRoutingSecretType:
-		routingId := secret.Labels[secretRoutingId]
-		san := certificates.DataPlaneRoutingName(routingId)
+		routingID := secret.Labels[secretRoutingID]
+		san := certificates.DataPlaneRoutingName(routingID)
 		sans = []string{san, certificates.LegacyFakeDnsName}
 	case dataPlaneUserSecretType:
 		sans = []string{certificates.DataPlaneUserName(secret.Namespace), certificates.LegacyFakeDnsName}
@@ -118,15 +119,15 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 		return fmt.Errorf("unknown cert type: %v", r.secretTypeLabelName)
 	}
 
-	cert, _, err := parseAndValidateSecret(secret, true, sans...)
+	cert, _, err := parseAndValidateSecret(secret, caSecret.Data[certificates.SecretCertKey], sans...)
 	if err != nil {
 		r.logger.Infof("Secret invalid: %v", err)
 		// Check the secret to reconcile type
 
 		var keyPair *certificates.KeyPair
-		keyPair, err = certificates.CreateCert(ctx, caPk, caCert, expirationInterval, sans...)
+		keyPair, err = certificates.CreateCert(caPk, caCert, expirationInterval, sans...)
 		if err != nil {
-			return fmt.Errorf("cannot generate the cert: %v", err)
+			return fmt.Errorf("cannot generate the cert: %w", err)
 		}
 		err = r.commitUpdatedSecret(ctx, secret, keyPair, caSecret.Data[certificates.SecretCertKey])
 		if err != nil {
@@ -144,7 +145,7 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 }
 
 // All sans provided are required to be lower case
-func parseAndValidateSecret(secret *corev1.Secret, shouldContainCaCert bool, sans ...string) (*x509.Certificate, *rsa.PrivateKey, error) {
+func parseAndValidateSecret(secret *corev1.Secret, caCert []byte, sans ...string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	certBytes, ok := secret.Data[certificates.SecretCertKey]
 	if !ok {
 		return nil, nil, fmt.Errorf("missing cert bytes")
@@ -153,17 +154,21 @@ func parseAndValidateSecret(secret *corev1.Secret, shouldContainCaCert bool, san
 	if !ok {
 		return nil, nil, fmt.Errorf("missing pk bytes")
 	}
-	if shouldContainCaCert {
-		if _, ok := secret.Data[certificates.SecretCaCertKey]; !ok {
+	if caCert != nil {
+		ca, ok := secret.Data[certificates.SecretCaCertKey]
+		if !ok {
 			return nil, nil, fmt.Errorf("missing ca cert bytes")
 		}
+		if !bytes.Equal(ca, caCert) {
+			return nil, nil, fmt.Errorf("ca cert bytes changed")
+		}
 	}
 
 	cert, caPk, err := certificates.ParseCert(certBytes, pkBytes)
 	if err != nil {
 		return nil, nil, err
 	}
-	if err := certificates.ValidateCert(cert, rotationThreshold); err != nil {
+	if err := certificates.CheckExpiry(cert, rotationThreshold); err != nil {
 		return nil, nil, err
 	}
 
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
similarity index 98%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
index 88bac5a21..dab349547 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go
+++ b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
@@ -38,7 +38,7 @@ import (
 const (
 	caSecretNamePostfix    = "-ctrl-ca"
 	secretLabelNamePostfix = "-ctrl"
-	secretRoutingId        = "routing-id"
+	secretRoutingID        = "routing-id"
 )
 
 // NewControllerFactory generates a ControllerConstructor for the control certificates reconciler.
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller_impl.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller_impl.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller_impl.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/controller_impl.go
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/reconciler.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/reconciler.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/reconciler.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/reconciler.go
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 1c981b28a..36bd9236c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1243,7 +1243,7 @@ k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/strings/slices
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6
+# knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8
 ## explicit; go 1.18
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -1264,20 +1264,18 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d
-## explicit; go 1.18
-knative.dev/control-protocol/pkg/certificates
-knative.dev/control-protocol/pkg/certificates/reconciler
-# knative.dev/hack v0.0.0-20230530201435-5b7907fbe350
+# knative.dev/hack v0.0.0-20230606014732-a861c8e9da08
 ## explicit; go 1.18
 knative.dev/hack
 knative.dev/hack/shell
-# knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60
+# knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6
 ## explicit; go 1.18
 knative.dev/networking/config
 knative.dev/networking/pkg
 knative.dev/networking/pkg/apis/networking
 knative.dev/networking/pkg/apis/networking/v1alpha1
+knative.dev/networking/pkg/certificates
+knative.dev/networking/pkg/certificates/reconciler
 knative.dev/networking/pkg/client/clientset/versioned
 knative.dev/networking/pkg/client/clientset/versioned/fake
 knative.dev/networking/pkg/client/clientset/versioned/scheme
@@ -1309,7 +1307,7 @@ knative.dev/networking/pkg/http/stats
 knative.dev/networking/pkg/ingress
 knative.dev/networking/pkg/k8s
 knative.dev/networking/pkg/prober
-# knative.dev/pkg v0.0.0-20230531073936-5671699f23d9
+# knative.dev/pkg v0.0.0-20230606013829-94b81fcefb58
 ## explicit; go 1.18
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/pkg/activator/certificate/cache_test.go b/pkg/activator/certificate/cache_test.go
index d417e80d4..5378bb2c6 100644
--- a/pkg/activator/certificate/cache_test.go
+++ b/pkg/activator/certificate/cache_test.go
@@ -31,7 +31,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/tools/cache"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netcfg "knative.dev/networking/pkg/config"
 	fakekubeclient "knative.dev/pkg/client/injection/kube/client/fake"
 	fakesecretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret/fake"
diff --git a/pkg/activator/net/throttler_test.go b/pkg/activator/net/throttler_test.go
index d8735078f..5d15a7d7c 100644
--- a/pkg/activator/net/throttler_test.go
+++ b/pkg/activator/net/throttler_test.go
@@ -65,130 +65,195 @@ func newTestThrottler(ctx context.Context) *Throttler {
 
 func TestThrottlerUpdateCapacity(t *testing.T) {
 	logger := TestLogger(t)
-	rt := &revisionThrottler{
-		logger:               logger,
-		breaker:              queue.NewBreaker(testBreakerParams),
-		containerConcurrency: 10,
-	}
-
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(100)
-	if got, want := rt.breaker.Capacity(), 100*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(5)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10/5; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(200)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
 
-	// now test with CC=0.
-	// in the CC=0 cases we use the infinite breaker whose capacity can either be
-	// totally blocked (0) or totally open (1).
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	rt.numActivators.Store(200)
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// shouldn't really happen since revisionMaxConcurrency is very, very large,
-	// but check that we behave reasonably if it's exceeded.
-	capacity := rt.calculateCapacity(revisionMaxConcurrency+5, 1)
-	if got, want := capacity, queue.MaxBreakerCapacity; got != want {
-		t.Errorf("calculateCapacity = %d, want: %d", got, want)
-	}
-
-	// Now test with podIP trackers in tow.
-	// Simple case.
-	rt.numActivators.Store(1)
-	rt.activatorIndex.Store(0)
-	rt.podTrackers = makeTrackers(1, 10)
-	rt.containerConcurrency = 10
-	rt.breaker = queue.NewBreaker(testBreakerParams)
-
-	rt.updateCapacity(0 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 backends.
-	rt.podTrackers = makeTrackers(2, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 20; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 activators.
-	rt.numActivators.Store(2)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 0.
-	rt.podTrackers = makeTrackers(3, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 1.
-	rt.activatorIndex.Store(1)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
+	tests := []struct {
+		name                 string
+		capacity             int
+		numActivators        int32
+		activatorIndex       int32
+		containerConcurrency int
+		isNewInfiniteBreaker bool
+		podTrackers          []*podTracker
+		want                 int
+		checkAssignedPod     bool
+	}{{
+		name:                 "capacity: 1, cc: 10",
+		capacity:             1,
+		containerConcurrency: 10,
+		want:                 1 * 10,
+	}, {
+		name:                 "capacity: 10, cc: 10",
+		capacity:             10,
+		containerConcurrency: 10,
+		want:                 10 * 10,
+	}, {
+		name:                 "capacity: 100, cc: 10",
+		capacity:             100,
+		containerConcurrency: 10,
+		want:                 100 * 10,
+	}, {
+		name:                 "numActivators: 5, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        5,
+		containerConcurrency: 10,
+		want:                 10 * 10 / 5,
+	}, {
+		name:                 "numActivators: 200, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 1,
+	}, {
+		name:                 "numActivators: 200, capacity: 0, cc: 10",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 0,
+	}, {
+		// now test with CC=0.
+		// in the CC=0 cases we use the infinite breaker whose capacity can either be
+		// totally blocked (0) or totally open (1).
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 10, cc: 0",
+		capacity:             10,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		// Now test with podIP trackers in tow.
+		// Simple case.
+		name:                 "numActivators: 1, capacity: 0, cc: 10, trackers(1, 10)",
+		capacity:             0,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(1, 10),
+		want:                 10,
+	}, {
+		name:                 "2 backends. numActivators: 1, capacity: -1, cc: 10, trackers(2, 10)",
+		capacity:             -1,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 20,
+	}, {
+		name:                 "2 activators. numActivators: 2, capacity: -1, cc: 10, trackers(2, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 10,
+	}, {
+		name:                 "3 pods, index 0. numActivators: 2, index: 0, capacity: -1, cc: 10, trackers(3, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 15,
+	}, {
+		name:                 "3 pods, index 1. numActivators: 2, index: 1, capacity: -1, cc: 10, trackers(3, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 15,
+	}, {
+		name:                 "Infinite capacity with podIP trackers.",
+		capacity:             1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 0,
+		podTrackers:          makeTrackers(3, 0),
+		isNewInfiniteBreaker: true,
+		want:                 1,
+		checkAssignedPod:     true,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              queue.NewBreaker(testBreakerParams),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			rt.activatorIndex.Store(tt.activatorIndex)
+			rt.podTrackers = tt.podTrackers
+			if tt.isNewInfiniteBreaker {
+				rt.breaker = newInfiniteBreaker(logger)
+			}
+			rt.updateCapacity(tt.capacity)
+			if got := rt.breaker.Capacity(); got != tt.want {
+				t.Errorf("Capacity = %d, want: %d", got, tt.want)
+			}
+			if tt.checkAssignedPod {
+				if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
+					t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
+						cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+				}
+			}
+		})
 	}
+}
 
-	// Infinite capacity with podIP trackers.
-	rt.activatorIndex.Store(1)
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-	rt.podTrackers = makeTrackers(3, 0)
-	rt.updateCapacity(1)
+func TestThrottlerCalculateCapacity(t *testing.T) {
+	logger := TestLogger(t)
 
-	// infinite breaker capacity is either 0 (blocked) or 1 (totally open)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
-		t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
-			cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+	tests := []struct {
+		name                 string
+		numActivators        int32
+		containerConcurrency int
+		size                 int
+		activatorCount       int
+	}{{
+		name:                 "over revisionMaxConcurrency",
+		numActivators:        200,
+		containerConcurrency: 0,
+		size:                 revisionMaxConcurrency + 5,
+		activatorCount:       1,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              newInfiniteBreaker(logger),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			// shouldn't really happen since revisionMaxConcurrency is very, very large,
+			// but check that we behave reasonably if it's exceeded.
+			capacity := rt.calculateCapacity(tt.size, tt.activatorCount)
+			if got, want := capacity, queue.MaxBreakerCapacity; got != want {
+				t.Errorf("calculateCapacity = %d, want: %d", got, want)
+			}
+		})
 	}
 }
 
diff --git a/pkg/reconciler/autoscaling/config/store_test.go b/pkg/reconciler/autoscaling/config/store_test.go
index 06681f0ef..6de86bbf9 100644
--- a/pkg/reconciler/autoscaling/config/store_test.go
+++ b/pkg/reconciler/autoscaling/config/store_test.go
@@ -66,17 +66,17 @@ func TestStoreImmutableConfig(t *testing.T) {
 	config := store.Load()
 	config.Autoscaler.MaxScaleUpRate = 100.0
 	config.Deployment.ProgressDeadline = 3 * time.Minute
-	config.Network.InternalEncryption = true
+	config.Network.DataplaneTrust = netcfg.TrustMinimal
 	newConfig := store.Load()
 
 	if newConfig.Autoscaler.MaxScaleUpRate == 100.0 {
-		t.Error("Autoscaler config is not immuable")
+		t.Error("Autoscaler config is not immutable")
 	}
 	if newConfig.Deployment.ProgressDeadline == 3*time.Minute {
-		t.Error("Deployment config is not immuable")
+		t.Error("Deployment config is not immutable")
 	}
 
-	if newConfig.Network.InternalEncryption {
-		t.Error("Network config is not immuable")
+	if newConfig.Network.DataplaneTrust != netcfg.TrustDisabled {
+		t.Error("Network config is not immutable")
 	}
 }
diff --git a/pkg/reconciler/autoscaling/kpa/kpa_test.go b/pkg/reconciler/autoscaling/kpa/kpa_test.go
index 59541f50f..b12a56cb3 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa_test.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa_test.go
@@ -128,7 +128,7 @@ func initialScaleZeroASConfig() *autoscalerconfig.Config {
 
 func activatorCertsNetConfig() *netcfg.Config {
 	nc, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "true",
+		netcfg.DataplaneTrustKey: "minimal",
 	})
 	return nc
 }
@@ -140,7 +140,7 @@ func defaultConfig() *config.Config {
 		deployment.ProgressDeadlineKey:  progressDeadline.String(),
 	})
 	networkConfig, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "false",
+		netcfg.DataplaneTrustKey: "disabled",
 	})
 
 	return &config.Config{
diff --git a/pkg/reconciler/route/resources/ingress_test.go b/pkg/reconciler/route/resources/ingress_test.go
index 89dd75eac..2c6c7085b 100644
--- a/pkg/reconciler/route/resources/ingress_test.go
+++ b/pkg/reconciler/route/resources/ingress_test.go
@@ -1427,6 +1427,6 @@ func testContextWithHTTPOption() context.Context {
 
 func testContextWithActivatorCA() context.Context {
 	cfg := testConfig()
-	cfg.Network.InternalEncryption = true
+	cfg.Network.DataplaneTrust = netcfg.TrustMinimal
 	return config.ToContext(context.Background(), cfg)
 }
diff --git a/pkg/reconciler/route/resources/service_test.go b/pkg/reconciler/route/resources/service_test.go
index 684b06c79..a17e7972b 100644
--- a/pkg/reconciler/route/resources/service_test.go
+++ b/pkg/reconciler/route/resources/service_test.go
@@ -419,6 +419,7 @@ func testConfig() *config.Config {
 			DefaultIngressClass: "test-ingress-class",
 			DomainTemplate:      netcfg.DefaultDomainTemplate,
 			TagTemplate:         netcfg.DefaultTagTemplate,
+			DataplaneTrust:      netcfg.TrustDisabled,
 		},
 		Features: &apiConfig.Features{
 			MultiContainer:               apiConfig.Disabled,
diff --git a/test/e2e/autoscale_test.go b/test/e2e/autoscale_test.go
index f5ac77059..86c3d133e 100644
--- a/test/e2e/autoscale_test.go
+++ b/test/e2e/autoscale_test.go
@@ -173,7 +173,7 @@ func TestTargetBurstCapacity(t *testing.T) {
 	if err != nil {
 		t.Fatal("Fail to get ConfigMap config-network:", err)
 	}
-	if strings.EqualFold(cm.Data[netcfg.InternalEncryptionKey], "true") {
+	if !strings.EqualFold(cm.Data[netcfg.DataplaneTrustKey], string(netcfg.TrustDisabled)) {
 		// TODO: Remove this when https://github.com/knative/serving/issues/12797 was done.
 		t.Skip("Skipping TestTargetBurstCapacity as activator-ca is specified. See issue/12797.")
 	}
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 2f3ddc264..3c20b5301 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,7 +19,7 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
@@ -52,7 +52,7 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
@@ -93,7 +93,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 
@@ -119,7 +119,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 data:
@@ -168,7 +168,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -180,7 +180,7 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230601-c32774b3"
+        app.kubernetes.io/version: "20230606-305fc394"
         app.kubernetes.io/name: knative-serving
     spec:
       serviceAccountName: controller
@@ -188,7 +188,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:71129a3d31e59fb107f3b8c61068d92da1b5d48c7f2fd1ab648d12894f3675f5
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:fc8f51a165d3efc7935c5c33e2704fde319ce5797f9bd1f1b0eb809439f02fee
           resources:
             requests:
               cpu: 30m
@@ -227,7 +227,7 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
@@ -266,7 +266,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -279,7 +279,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230601-c32774b3"
+        app.kubernetes.io/version: "20230606-305fc394"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
     spec:
@@ -288,7 +288,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:1336e25037f174df7345c09996008a9bbfa26965f1bd50ec54cc5ffe677a3ba5
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:27ea22a0bb2360e01d6e6ddf2325d770ca4907f0f4d50cf2de49e8560fe50d2a
           resources:
             requests:
               cpu: 20m
@@ -352,7 +352,7 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230606-305fc394"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
diff --git a/third_party/gateway-api-latest/istio-gateway.yaml b/third_party/gateway-api-latest/istio-gateway.yaml
index e05b51077..05f8805f3 100644
--- a/third_party/gateway-api-latest/istio-gateway.yaml
+++ b/third_party/gateway-api-latest/istio-gateway.yaml
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230606-0b6a8b08"
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
   type: ClusterIP
diff --git a/third_party/gateway-api-latest/net-gateway-api.yaml b/third_party/gateway-api-latest/net-gateway-api.yaml
index fea3cb0fc..0c9e15770 100644
--- a/third_party/gateway-api-latest/net-gateway-api.yaml
+++ b/third_party/gateway-api-latest/net-gateway-api.yaml
@@ -5204,7 +5204,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230606-0b6a8b08"
 aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
@@ -5220,7 +5220,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230606-0b6a8b08"
 rules:
   - apiGroups: ["gateway.networking.k8s.io"]
     resources: ["httproutes", "referencegrants", "referencepolicies"]
@@ -5253,7 +5253,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230606-0b6a8b08"
 data:
   _example: |
     ################################
@@ -5307,7 +5307,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230606-0b6a8b08"
     app.kubernetes.io/name: knative-serving
 spec:
   replicas: 1
@@ -5334,7 +5334,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:7405891efe33b7af8dbc71269e7542f67a03f2440a6f9343c1932776d77858ad
+          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:5f6e223b942d305f994c2880eda2ecd39afd5fe96fccb049ee88c9344f393385
           resources:
             requests:
               cpu: 100m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 885db5b69..b58e49d36 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 77e1cf889b1757f503744baa22a447c9d82f72c2
+# Generated when HEAD was 4e166a43e710d4dada8aad32b0e4a864c064278a
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -54,7 +54,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -93,7 +93,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -114,7 +114,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -149,7 +149,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 data:
   # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
@@ -192,11 +192,6 @@ data:
     # `knative-serving`
     local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"
 
-    # If true, knative will use the Istio VirtualService's status to determine
-    # endpoint readiness. Otherwise, probe as usual.
-    # NOTE: This feature is currently experimental and should not be used in production.
-    enable-virtualservice-status: "false"
-
 ---
 # Allows the Webhooks to be reached by kube-api with or without
 # sidecar injection and with mTLS PERMISSIVE and STRICT.
@@ -208,7 +203,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -226,7 +221,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -244,7 +239,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -277,7 +272,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -294,14 +289,14 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230601-77e1cf88"
+        app.kubernetes.io/version: "20230605-4e166a43"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:da481f0c4fbae9e560ea0c5ae6cb783567b161cff56bc5ea97b1f7aa633cb5ed
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:aa51fad43b704341635fdd5612046aab4781fb919f5a55ccd7cd9e3e7611ac3b
           resources:
             requests:
               cpu: 30m
@@ -380,7 +375,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -394,14 +389,14 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230601-77e1cf88"
+        app.kubernetes.io/version: "20230605-4e166a43"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:ce9dff8cf2af9b0a8061e62d88f32c64f2e440fda7001136d7073650510ba602
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:36ff4d24fc348aa0b74c5c714432f46547ed5cef03d43c43a8acc987407ea078
           resources:
             requests:
               cpu: 20m
@@ -485,7 +480,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -512,7 +507,7 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -551,7 +546,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -590,7 +585,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index efd1f0e52..28901ff57 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -20,7 +20,7 @@ metadata:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -45,7 +45,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 data:
   envoy-bootstrap.yaml: |
@@ -168,7 +168,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 data:
   _example: |
@@ -259,7 +259,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -269,7 +269,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -301,7 +301,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -335,7 +335,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -357,7 +357,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:5e4ac306727f16f83f1e3895b3559651fbec60173196865f610dc926f694cfd5
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:3f473551b53ae9c0247d1f432b62662ac4d26ce0f6d80b7df3f1b96f9c00275d
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -415,7 +415,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -450,7 +450,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -559,7 +559,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -583,7 +583,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -607,7 +607,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   minReplicas: 1
@@ -633,7 +633,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230606-5c2cb228"
     app.kubernetes.io/name: knative-serving
 spec:
   minAvailable: 80%