Repository: knative/serving
Pull request #14064 (2023-06-04 18:19:35)

Remove deprecated internalEncryption dependency
Remove deprecated internalEncryption dependency and replace with trust levels

knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/14064#" title="Author self-approved">davidhadas</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign dsimansk for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative/serving/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["dsimansk"]} -->
codecov[bot]: ## [Codecov](https://app.codecov.io/gh/knative/serving/pull/14064?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
Patch coverage: **`100.00`**% and project coverage change: **`+0.05`** :tada:
> Comparison is base [(`349b2d6`)](https://app.codecov.io/gh/knative/serving/commit/349b2d61b0e82efda4f713e5d6f2c31f3fa9ff1c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.21% compared to head [(`7d43317`)](https://app.codecov.io/gh/knative/serving/pull/14064?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.26%.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main   #14064      +/-   ##
==========================================
+ Coverage   86.21%   86.26%   +0.05%     
==========================================
  Files         199      199              
  Lines       14767    14767              
==========================================
+ Hits        12731    12739       +8     
+ Misses       1734     1727       -7     
+ Partials      302      301       -1     
```


| [Impacted Files](https://app.codecov.io/gh/knative/serving/pull/14064?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/autoscaling/kpa/kpa.go](https://app.codecov.io/gh/knative/serving/pull/14064?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcva3BhL2twYS5nbw==) | `95.26% <100.00%> (ø)` | |
| [pkg/reconciler/route/resources/ingress.go](https://app.codecov.io/gh/knative/serving/pull/14064?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvcm91dGUvcmVzb3VyY2VzL2luZ3Jlc3MuZ28=) | `94.80% <100.00%> (ø)` | |

... and [2 files with indirect coverage changes](https://app.codecov.io/gh/knative/serving/pull/14064/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)


</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/knative/serving/pull/14064?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).

davidhadas: /retest
dprotaso: /lgtm
/approve

Patch:
diff --git a/pkg/reconciler/autoscaling/kpa/kpa.go b/pkg/reconciler/autoscaling/kpa/kpa.go
index e155aa56b..013022d2d 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa.go
@@ -25,6 +25,7 @@ import (
 	"go.uber.org/zap"
 
 	nv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/logging"
 	pkgmetrics "knative.dev/pkg/metrics"
 	"knative.dev/pkg/ptr"
@@ -128,7 +129,7 @@ func (c *Reconciler) ReconcileKind(ctx context.Context, pa *autoscalingv1alpha1.
 	// When activator CA is enabled, force activator always in path.
 	// TODO: This is a temporary state and to be fixed.
 	// See also issues/11906 and issues/12797.
-	case config.FromContext(ctx).Network.InternalEncryption:
+	case config.FromContext(ctx).Network.DataplaneTrust != netcfg.TrustDisabled:
 		mode = nv1alpha1.SKSOperationModeProxy
 
 	// If the want == -1 and PA is inactive that implies the autoscaler
diff --git a/pkg/reconciler/route/resources/ingress.go b/pkg/reconciler/route/resources/ingress.go
index 588a37cfe..64bb51020 100644
--- a/pkg/reconciler/route/resources/ingress.go
+++ b/pkg/reconciler/route/resources/ingress.go
@@ -29,6 +29,7 @@ import (
 
 	"knative.dev/networking/pkg/apis/networking"
 	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	netheader "knative.dev/networking/pkg/http/header"
 	ingress "knative.dev/networking/pkg/ingress"
 	"knative.dev/pkg/kmeta"
@@ -149,7 +150,7 @@ func makeIngressSpec(
 				return netv1alpha1.IngressSpec{}, err
 			}
 			rule := makeIngressRule(domains, r.Namespace,
-				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.InternalEncryption)
+				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.DataplaneTrust != netcfg.TrustDisabled)
 			if featuresConfig.TagHeaderBasedRouting == apicfg.Enabled {
 				if rule.HTTP.Paths[0].AppendHeaders == nil {
 					rule.HTTP.Paths[0].AppendHeaders = make(map[string]string, 1)
@@ -171,7 +172,7 @@ func makeIngressSpec(
 					// Since names are sorted `DefaultTarget == ""` is the first one,
 					// so just pass the subslice.
 					rule.HTTP.Paths = append(
-						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.InternalEncryption, names[1:]), rule.HTTP.Paths...)
+						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.DataplaneTrust != netcfg.TrustDisabled, names[1:]), rule.HTTP.Paths...)
 				} else {
 					// If a request is routed by a tag-attached hostname instead of the tag header,
 					// the request may not have the tag header "Knative-Serving-Tag",


Test patch:
diff --git a/pkg/activator/net/throttler_test.go b/pkg/activator/net/throttler_test.go
index d8735078f..5d15a7d7c 100644
--- a/pkg/activator/net/throttler_test.go
+++ b/pkg/activator/net/throttler_test.go
@@ -65,130 +65,195 @@ func newTestThrottler(ctx context.Context) *Throttler {
 
 func TestThrottlerUpdateCapacity(t *testing.T) {
 	logger := TestLogger(t)
-	rt := &revisionThrottler{
-		logger:               logger,
-		breaker:              queue.NewBreaker(testBreakerParams),
-		containerConcurrency: 10,
-	}
-
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(100)
-	if got, want := rt.breaker.Capacity(), 100*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(5)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10/5; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(200)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
 
-	// now test with CC=0.
-	// in the CC=0 cases we use the infinite breaker whose capacity can either be
-	// totally blocked (0) or totally open (1).
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	rt.numActivators.Store(200)
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// shouldn't really happen since revisionMaxConcurrency is very, very large,
-	// but check that we behave reasonably if it's exceeded.
-	capacity := rt.calculateCapacity(revisionMaxConcurrency+5, 1)
-	if got, want := capacity, queue.MaxBreakerCapacity; got != want {
-		t.Errorf("calculateCapacity = %d, want: %d", got, want)
-	}
-
-	// Now test with podIP trackers in tow.
-	// Simple case.
-	rt.numActivators.Store(1)
-	rt.activatorIndex.Store(0)
-	rt.podTrackers = makeTrackers(1, 10)
-	rt.containerConcurrency = 10
-	rt.breaker = queue.NewBreaker(testBreakerParams)
-
-	rt.updateCapacity(0 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 backends.
-	rt.podTrackers = makeTrackers(2, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 20; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 activators.
-	rt.numActivators.Store(2)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 0.
-	rt.podTrackers = makeTrackers(3, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 1.
-	rt.activatorIndex.Store(1)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
+	tests := []struct {
+		name                 string
+		capacity             int
+		numActivators        int32
+		activatorIndex       int32
+		containerConcurrency int
+		isNewInfiniteBreaker bool
+		podTrackers          []*podTracker
+		want                 int
+		checkAssignedPod     bool
+	}{{
+		name:                 "capacity: 1, cc: 10",
+		capacity:             1,
+		containerConcurrency: 10,
+		want:                 1 * 10,
+	}, {
+		name:                 "capacity: 10, cc: 10",
+		capacity:             10,
+		containerConcurrency: 10,
+		want:                 10 * 10,
+	}, {
+		name:                 "capacity: 100, cc: 10",
+		capacity:             100,
+		containerConcurrency: 10,
+		want:                 100 * 10,
+	}, {
+		name:                 "numActivators: 5, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        5,
+		containerConcurrency: 10,
+		want:                 10 * 10 / 5,
+	}, {
+		name:                 "numActivators: 200, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 1,
+	}, {
+		name:                 "numActivators: 200, capacity: 0, cc: 10",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 0,
+	}, {
+		// now test with CC=0.
+		// in the CC=0 cases we use the infinite breaker whose capacity can either be
+		// totally blocked (0) or totally open (1).
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 10, cc: 0",
+		capacity:             10,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		// Now test with podIP trackers in tow.
+		// Simple case.
+		name:                 "numActivators: 1, capacity: 0, cc: 10, trackers(1, 10)",
+		capacity:             0,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(1, 10),
+		want:                 10,
+	}, {
+		name:                 "2 backends. numActivators: 1, capacity: -1, cc: 10, trackers(2, 10)",
+		capacity:             -1,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 20,
+	}, {
+		name:                 "2 activators. numActivators: 2, capacity: -1, cc: 10, trackers(2, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 10,
+	}, {
+		name:                 "3 pods, index 0. numActivators: 2, index: 0, capacity: -1, cc: 10, trackers(3, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 15,
+	}, {
+		name:                 "3 pods, index 1. numActivators: 2, index: 1, capacity: -1, cc: 10, trackers(3, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 15,
+	}, {
+		name:                 "Infinite capacity with podIP trackers.",
+		capacity:             1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 0,
+		podTrackers:          makeTrackers(3, 0),
+		isNewInfiniteBreaker: true,
+		want:                 1,
+		checkAssignedPod:     true,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              queue.NewBreaker(testBreakerParams),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			rt.activatorIndex.Store(tt.activatorIndex)
+			rt.podTrackers = tt.podTrackers
+			if tt.isNewInfiniteBreaker {
+				rt.breaker = newInfiniteBreaker(logger)
+			}
+			rt.updateCapacity(tt.capacity)
+			if got := rt.breaker.Capacity(); got != tt.want {
+				t.Errorf("Capacity = %d, want: %d", got, tt.want)
+			}
+			if tt.checkAssignedPod {
+				if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
+					t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
+						cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+				}
+			}
+		})
 	}
+}
 
-	// Infinite capacity with podIP trackers.
-	rt.activatorIndex.Store(1)
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-	rt.podTrackers = makeTrackers(3, 0)
-	rt.updateCapacity(1)
+func TestThrottlerCalculateCapacity(t *testing.T) {
+	logger := TestLogger(t)
 
-	// infinite breaker capacity is either 0 (blocked) or 1 (totally open)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
-		t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
-			cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+	tests := []struct {
+		name                 string
+		numActivators        int32
+		containerConcurrency int
+		size                 int
+		activatorCount       int
+	}{{
+		name:                 "over revisionMaxConcurrency",
+		numActivators:        200,
+		containerConcurrency: 0,
+		size:                 revisionMaxConcurrency + 5,
+		activatorCount:       1,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              newInfiniteBreaker(logger),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			// shouldn't really happen since revisionMaxConcurrency is very, very large,
+			// but check that we behave reasonably if it's exceeded.
+			capacity := rt.calculateCapacity(tt.size, tt.activatorCount)
+			if got, want := capacity, queue.MaxBreakerCapacity; got != want {
+				t.Errorf("calculateCapacity = %d, want: %d", got, want)
+			}
+		})
 	}
 }
 
diff --git a/pkg/reconciler/autoscaling/config/store_test.go b/pkg/reconciler/autoscaling/config/store_test.go
index 06681f0ef..6de86bbf9 100644
--- a/pkg/reconciler/autoscaling/config/store_test.go
+++ b/pkg/reconciler/autoscaling/config/store_test.go
@@ -66,17 +66,17 @@ func TestStoreImmutableConfig(t *testing.T) {
 	config := store.Load()
 	config.Autoscaler.MaxScaleUpRate = 100.0
 	config.Deployment.ProgressDeadline = 3 * time.Minute
-	config.Network.InternalEncryption = true
+	config.Network.DataplaneTrust = netcfg.TrustMinimal
 	newConfig := store.Load()
 
 	if newConfig.Autoscaler.MaxScaleUpRate == 100.0 {
-		t.Error("Autoscaler config is not immuable")
+		t.Error("Autoscaler config is not immutable")
 	}
 	if newConfig.Deployment.ProgressDeadline == 3*time.Minute {
-		t.Error("Deployment config is not immuable")
+		t.Error("Deployment config is not immutable")
 	}
 
-	if newConfig.Network.InternalEncryption {
-		t.Error("Network config is not immuable")
+	if newConfig.Network.DataplaneTrust != netcfg.TrustDisabled {
+		t.Error("Network config is not immutable")
 	}
 }
diff --git a/pkg/reconciler/autoscaling/kpa/kpa_test.go b/pkg/reconciler/autoscaling/kpa/kpa_test.go
index 59541f50f..b12a56cb3 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa_test.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa_test.go
@@ -128,7 +128,7 @@ func initialScaleZeroASConfig() *autoscalerconfig.Config {
 
 func activatorCertsNetConfig() *netcfg.Config {
 	nc, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "true",
+		netcfg.DataplaneTrustKey: "minimal",
 	})
 	return nc
 }
@@ -140,7 +140,7 @@ func defaultConfig() *config.Config {
 		deployment.ProgressDeadlineKey:  progressDeadline.String(),
 	})
 	networkConfig, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "false",
+		netcfg.DataplaneTrustKey: "disabled",
 	})
 
 	return &config.Config{
diff --git a/pkg/reconciler/route/resources/ingress_test.go b/pkg/reconciler/route/resources/ingress_test.go
index 89dd75eac..2c6c7085b 100644
--- a/pkg/reconciler/route/resources/ingress_test.go
+++ b/pkg/reconciler/route/resources/ingress_test.go
@@ -1427,6 +1427,6 @@ func testContextWithHTTPOption() context.Context {
 
 func testContextWithActivatorCA() context.Context {
 	cfg := testConfig()
-	cfg.Network.InternalEncryption = true
+	cfg.Network.DataplaneTrust = netcfg.TrustMinimal
 	return config.ToContext(context.Background(), cfg)
 }
diff --git a/pkg/reconciler/route/resources/service_test.go b/pkg/reconciler/route/resources/service_test.go
index 684b06c79..a17e7972b 100644
--- a/pkg/reconciler/route/resources/service_test.go
+++ b/pkg/reconciler/route/resources/service_test.go
@@ -419,6 +419,7 @@ func testConfig() *config.Config {
 			DefaultIngressClass: "test-ingress-class",
 			DomainTemplate:      netcfg.DefaultDomainTemplate,
 			TagTemplate:         netcfg.DefaultTagTemplate,
+			DataplaneTrust:      netcfg.TrustDisabled,
 		},
 		Features: &apiConfig.Features{
 			MultiContainer:               apiConfig.Disabled,
diff --git a/test/e2e/autoscale_test.go b/test/e2e/autoscale_test.go
index f5ac77059..86c3d133e 100644
--- a/test/e2e/autoscale_test.go
+++ b/test/e2e/autoscale_test.go
@@ -173,7 +173,7 @@ func TestTargetBurstCapacity(t *testing.T) {
 	if err != nil {
 		t.Fatal("Fail to get ConfigMap config-network:", err)
 	}
-	if strings.EqualFold(cm.Data[netcfg.InternalEncryptionKey], "true") {
+	if !strings.EqualFold(cm.Data[netcfg.DataplaneTrustKey], string(netcfg.TrustDisabled)) {
 		// TODO: Remove this when https://github.com/knative/serving/issues/12797 was done.
 		t.Skip("Skipping TestTargetBurstCapacity as activator-ca is specified. See issue/12797.")
 	}
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 885db5b69..b58e49d36 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 77e1cf889b1757f503744baa22a447c9d82f72c2
+# Generated when HEAD was 4e166a43e710d4dada8aad32b0e4a864c064278a
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -54,7 +54,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -93,7 +93,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -114,7 +114,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -149,7 +149,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 data:
   # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
@@ -192,11 +192,6 @@ data:
     # `knative-serving`
     local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"
 
-    # If true, knative will use the Istio VirtualService's status to determine
-    # endpoint readiness. Otherwise, probe as usual.
-    # NOTE: This feature is currently experimental and should not be used in production.
-    enable-virtualservice-status: "false"
-
 ---
 # Allows the Webhooks to be reached by kube-api with or without
 # sidecar injection and with mTLS PERMISSIVE and STRICT.
@@ -208,7 +203,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -226,7 +221,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -244,7 +239,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -277,7 +272,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -294,14 +289,14 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230601-77e1cf88"
+        app.kubernetes.io/version: "20230605-4e166a43"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:da481f0c4fbae9e560ea0c5ae6cb783567b161cff56bc5ea97b1f7aa633cb5ed
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:aa51fad43b704341635fdd5612046aab4781fb919f5a55ccd7cd9e3e7611ac3b
           resources:
             requests:
               cpu: 30m
@@ -380,7 +375,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -394,14 +389,14 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230601-77e1cf88"
+        app.kubernetes.io/version: "20230605-4e166a43"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:ce9dff8cf2af9b0a8061e62d88f32c64f2e440fda7001136d7073650510ba602
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:36ff4d24fc348aa0b74c5c714432f46547ed5cef03d43c43a8acc987407ea078
           resources:
             requests:
               cpu: 20m
@@ -485,7 +480,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -512,7 +507,7 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -551,7 +546,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -590,7 +585,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230605-4e166a43"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions: