Repository: knative/serving
Pull request #10237 (2020-12-01 19:35:13)

Switch to a rate limited queue in the image resolution code.
Right now we have no control over the enqueing speed.
Currently we don't re-enqueue in the resolver, so per-item limits
won't apply.
But general ones should.
FWIW, the controller that puts items in the resolution code uses the
same limits, so modulo multiple sidecars there should be no actual
delay.

/assign @julz mattmoor

knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10237#" title="Author self-approved">vagababov</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[pkg/reconciler/OWNERS](https://github.com/knative/serving/blob/master/pkg/reconciler/OWNERS)~~ [vagababov]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/go.mod b/go.mod
index 19c17750b..b823081e6 100644
--- a/go.mod
+++ b/go.mod
@@ -35,7 +35,7 @@ require (
 	k8s.io/code-generator v0.18.12
 	k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29
 	knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6
-	knative.dev/hack v0.0.0-20201125230335-c46a6498e9ed
+	knative.dev/hack v0.0.0-20201201234937-fddbf732e450
 	knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7
 	knative.dev/pkg v0.0.0-20201130192436-e5346d90e980
 )
diff --git a/go.sum b/go.sum
index 914cb879e..6d21f16db 100644
--- a/go.sum
+++ b/go.sum
@@ -1218,8 +1218,8 @@ knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6 h1:W1R7UnGSGJmL6btl8AY8AV
 knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6/go.mod h1:IocU4F1XK8udXpTRC4m9KWyEVtT928sSP+T7Oy34UDg=
 knative.dev/hack v0.0.0-20201120192952-353db687ec5b h1:Lc+AKgwhAZUD98mN++qTHeeaP6FRmS8fcwc/rXkP8G0=
 knative.dev/hack v0.0.0-20201120192952-353db687ec5b/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/hack v0.0.0-20201125230335-c46a6498e9ed h1:DrTU+vxQrNJtySxyNovUtl4si0ozjtU/AYhYaTz34YA=
-knative.dev/hack v0.0.0-20201125230335-c46a6498e9ed/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
+knative.dev/hack v0.0.0-20201201234937-fddbf732e450 h1:IyitWF7OzfunCgE4b9ZsJAeIRoQ6JOyqDrz/19X4iS4=
+knative.dev/hack v0.0.0-20201201234937-fddbf732e450/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
 knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7 h1:O40i4ZCYfpaw7m1yUwtmRhBOdT0HRp3MYD4PWaRzYqI=
 knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7/go.mod h1:EpImbpW3gu85Mg39GT7gUJTVYLtFYWDsZQCZlKFmGUM=
 knative.dev/pkg v0.0.0-20201125095035-9bf616d2f46a h1:pdJpLaq50mLKrPWYSQgTH2p64Dk7Fq/xID6l0F69cVY=
diff --git a/pkg/reconciler/revision/background.go b/pkg/reconciler/revision/background.go
index 84d8d6567..0396ebdad 100644
--- a/pkg/reconciler/revision/background.go
+++ b/pkg/reconciler/revision/background.go
@@ -42,7 +42,7 @@ type backgroundResolver struct {
 	resolver imageResolver
 	enqueue  func(types.NamespacedName)
 
-	queue workqueue.Interface
+	queue workqueue.RateLimitingInterface
 
 	mu      sync.Mutex
 	results map[types.NamespacedName]*resolveResult
@@ -82,7 +82,9 @@ func newBackgroundResolver(logger *zap.SugaredLogger, resolver imageResolver, en
 		enqueue:  enqueue,
 
 		results: make(map[types.NamespacedName]*resolveResult),
-		queue:   workqueue.NewNamed("digests"),
+		queue: workqueue.NewNamedRateLimitingQueue(
+			workqueue.DefaultControllerRateLimiter(),
+			"digests"),
 	}
 
 	return r
@@ -192,7 +194,13 @@ func (r *backgroundResolver) addWorkItems(rev *v1.Revision, name types.Namespace
 // in the resolveResult. If this completes the work for the revision, the
 // completionCallback is called.
 func (r *backgroundResolver) processWorkItem(item *workItem) {
-	defer r.queue.Done(item)
+	defer func() {
+		// NOTE: right now we do not retry failing items, but if we were
+		// `Forget` should be called only in case of a success
+		// (or if we abandon the item).
+		r.queue.Forget(item)
+		r.queue.Done(item)
+	}()
 
 	ctx, cancel := context.WithTimeout(context.Background(), item.timeout)
 	defer cancel()
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index de61b2634..3616159af 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -117,12 +117,13 @@ func (cur *Rollout) Validate() bool {
 
 // ObserveReady traverses the configs and the ones that are in rollout
 // but have not observed step time yet, will have it set, to
-// max(1, nowTS-cfg.StartTime).
+// max(1, nowTS-cfg.StartTime). nowTS is unix timestamp in ns.
 func (cur *Rollout) ObserveReady(nowTS int) {
 	for i := range cur.Configurations {
 		c := &cur.Configurations[i]
 		if c.StepDuration == 0 && c.StartTime > 0 {
-			c.StepDuration = int(math.Max(1, math.Ceil(time.Duration(nowTS-c.StartTime).Seconds())))
+			c.StepDuration = int(math.Max(1,
+				math.Ceil(time.Duration(nowTS-c.StartTime).Seconds())))
 		}
 	}
 }
@@ -132,6 +133,7 @@ func (cur *Rollout) ObserveReady(nowTS int) {
 // At the end of the call the returned object will contain the
 // desired traffic shape.
 // Step will return cur if no previous state was available.
+// nowTS is unix timestamp in ns.
 func (cur *Rollout) Step(prev *Rollout, nowTS int) *Rollout {
 	if prev == nil || len(prev.Configurations) == 0 {
 		return cur
@@ -212,8 +214,6 @@ func (cur *Rollout) Step(prev *Rollout, nowTS int) *Rollout {
 // the older revisions.
 func adjustPercentage(goal int, cr *ConfigurationRollout) {
 	switch diff := goal - cr.Percent; {
-	case goal == 0:
-		cr.Revisions = nil // No traffic, no rollout.
 	case diff > 0:
 		cr.Revisions[len(cr.Revisions)-1].Percent += diff
 	case diff < 0:
diff --git a/pkg/reconciler/route/traffic/traffic.go b/pkg/reconciler/route/traffic/traffic.go
index c9c233cce..4ab7c19ce 100644
--- a/pkg/reconciler/route/traffic/traffic.go
+++ b/pkg/reconciler/route/traffic/traffic.go
@@ -190,6 +190,11 @@ func buildRolloutForTag(r *Rollout, tag string, rts RevisionTargets) {
 			continue
 		}
 
+		// Ignore the rollouts with 0 percent target traffic.
+		// This can happen only for the default tag.
+		if *rt.Percent == 0 {
+			continue
+		}
 		// The targets with the same revision are already joined together.
 		r.Configurations = append(r.Configurations, ConfigurationRollout{
 			ConfigurationName: rt.ConfigurationName,
diff --git a/vendor/knative.dev/hack/codegen-library.sh b/vendor/knative.dev/hack/codegen-library.sh
new file mode 100644
index 000000000..cb9c282b2
--- /dev/null
+++ b/vendor/knative.dev/hack/codegen-library.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Setup the env for doing Knative style codegen.
+
+kn_hack_library=${kn_hack_library:-"$(dirname $0)/../vendor/knative.dev/hack/library.sh"}
+
+if [[ -f "$kn_hack_library" ]]; then
+  source $kn_hack_library
+else
+  echo "this file is intended to be imported from a golang project that vendors knative.dev/hack"
+  exit
+fi
+
+export GOPATH=$(go_mod_gopath_hack)
+export MODULE_NAME=$(go_mod_module_name)
+export CODEGEN_PKG=${CODEGEN_PKG:-$(cd ${REPO_ROOT_DIR}; ls -d -1 ./vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
+export KNATIVE_CODEGEN_PKG=${KNATIVE_CODEGEN_PKG:-$(cd ${REPO_ROOT_DIR}; ls -d -1 ./vendor/knative.dev/pkg 2>/dev/null || echo ../pkg)}
+
+chmod +x ${CODEGEN_PKG}/generate-groups.sh
+chmod +x ${KNATIVE_CODEGEN_PKG}/hack/generate-knative.sh
diff --git a/vendor/knative.dev/hack/library.sh b/vendor/knative.dev/hack/library.sh
index 9b90b0025..8ed7182d9 100644
--- a/vendor/knative.dev/hack/library.sh
+++ b/vendor/knative.dev/hack/library.sh
@@ -98,6 +98,37 @@ function function_exists() {
   [[ "$(type -t $1)" == "function" ]]
 }
 
+# GitHub Actions aware output grouping.
+function group() {
+  # End the group is there is already a group.
+  if [ -z ${__GROUP_TRACKER+x} ]; then
+    export __GROUP_TRACKER="grouping"
+    trap end_group EXIT
+  else
+    end_group
+  fi
+  # Start a new group.
+  start_group "$@"
+}
+
+# GitHub Actions aware output grouping.
+function start_group() {
+  if [[ -n ${GITHUB_WORKFLOW:-} ]]; then
+    echo "::group::$@"
+    trap end_group EXIT
+  else
+    echo "--- $@"
+  fi
+}
+
+# GitHub Actions aware end of output grouping.
+function end_group() {
+  if [[ -n ${GITHUB_WORKFLOW:-} ]]; then
+    echo "::endgroup::"
+  fi
+}
+
+
 # Waits until the given object doesn't exist.
 # Parameters: $1 - the kind of the object.
 #             $2 - object's name.
@@ -528,7 +559,7 @@ function go_update_deps() {
   done
 
   if [[ $UPGRADE == 1 ]]; then
-    echo "--- Upgrading to ${VERSION}"
+    group "Upgrading to ${VERSION}"
     # From shell parameter expansion:
     # ${parameter:+word}
     # If parameter is null or unset, nothing is substituted, otherwise the expansion of word is substituted.
@@ -548,7 +579,7 @@ function go_update_deps() {
     fi
   fi
 
-  echo "--- Go mod tidy and vendor"
+  group "Go mod tidy and vendor"
 
   # Prune modules.
   local orig_pipefail_opt=$(shopt -p -o pipefail)
@@ -557,7 +588,7 @@ function go_update_deps() {
   go mod vendor 2>&1 |  grep -v "ignoring symlink" || true
   eval "$orig_pipefail_opt"
 
-  echo "--- Removing unwanted vendor files"
+  group "Removing unwanted vendor files"
 
   # Remove unwanted vendor files
   find vendor/ \( -name "OWNERS" \
@@ -568,13 +599,32 @@ function go_update_deps() {
 
   export GOFLAGS=-mod=vendor
 
-  echo "--- Updating licenses"
+  group "Updating licenses"
   update_licenses third_party/VENDOR-LICENSE "./..."
 
-  echo "--- Removing broken symlinks"
+  group "Removing broken symlinks"
   remove_broken_symlinks ./vendor
 }
 
+# Return the go module name of the current module.
+# Intended to be used like:
+#   export MODULE_NAME=$(go_mod_module_name)
+function go_mod_module_name() {
+  go mod graph | cut -d' ' -f 1 | grep -v '@' | head -1
+}
+
+# Return a GOPATH to a temp directory. Works around the out-of-GOPATH issues
+# for k8s client gen mixed with go mod.
+# Intended to be used like:
+#   export GOPATH=$(go_mod_gopath_hack)
+function go_mod_gopath_hack() {
+  local TMP_DIR="$(mktemp -d)"
+  local TMP_REPO_PATH="${TMP_DIR}/src/$(go_mod_module_name)"
+  mkdir -p "$(dirname "${TMP_REPO_PATH}")" && ln -s "${REPO_ROOT_DIR}" "${TMP_REPO_PATH}"
+
+  echo "${TMP_DIR}"
+}
+
 # Run kntest tool, error out and ask users to install it if it's not currently installed.
 # Parameters: $1..$n - parameters passed to the tool.
 function run_kntest() {
diff --git a/vendor/knative.dev/hack/microbenchmarks.sh b/vendor/knative.dev/hack/microbenchmarks.sh
index 440af2e14..ee375842c 100644
--- a/vendor/knative.dev/hack/microbenchmarks.sh
+++ b/vendor/knative.dev/hack/microbenchmarks.sh
@@ -14,6 +14,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# -count argument when running go test
+readonly BENCH_RUN_COUNT=${BENCH_RUN_COUNT:-5}
+
+# -benchtime argument when running go test
+readonly BENCH_RUN_TIME=${BENCH_RUN_TIME:-5s}
+
 function microbenchmarks_run() {
   if [ "$1" != "" ]; then
     OUTPUT_FILE="$1"
@@ -21,13 +27,23 @@ function microbenchmarks_run() {
     OUTPUT_FILE="${ARTIFACTS:-$(mktemp -d)}/bench-result.txt"
   fi
 
-  echo "Output will be at $OUTPUT_FILE"
-
   # Run all microbenchmarks
   go clean
-  go test -bench=. -benchmem -run="^$" -v ./...   >> "$OUTPUT_FILE" || exit
+  go test -bench=. -benchtime=$BENCH_RUN_TIME -count=$BENCH_RUN_COUNT -benchmem -run="^$" -v ./...   >> "$OUTPUT_FILE" || exit
 }
 
+# To run microbenchmarks on your machine and compare your revision with upstream/master:
+#
+# git fetch upstream
+# source microbenchmarks.sh
+# microbenchmarks_run_and_compare upstream/master
+#
+# NOTE: Hypothetically we should run these microbenchmarks on a machine running only a kernel and a shell,
+# but this might be sometimes hard to achieve unless you have a spare computer to play with.
+# When running microbenchmarks on your dev machine, make sure you have the bare minimum applications running on your laptop,
+# otherwise you'll get a variance too high.
+# Close Slack, the browser, the IDE, stop Docker, stop Netflix and grab a coffee while waiting for the results.
+# Depending on the benchmark complexity/reproducibility, if the variance is too high, repeat the benchmarks.
 function microbenchmarks_run_and_compare() {
   if [ "$1" == "" ] || [ $# -gt 1 ]; then
     echo "Error: Expecting an argument" >&2
@@ -35,23 +51,37 @@ function microbenchmarks_run_and_compare() {
     exit 1
   fi
 
+  if [ "$2" == "" ]; then
+    OUTPUT_DIR=${ARTIFACTS:-$(mktemp -d)}
+  else
+    OUTPUT_DIR="$2"
+  fi
+
+  mkdir -p "$OUTPUT_DIR"
+
   # Benchstat is required to compare the bench results
   GO111MODULE=off go get golang.org/x/perf/cmd/benchstat
 
   # Revision to use to compare with actual
   REVISION="$1"
-  OUTPUT_DIR=${ARTIFACTS:-$(mktemp -d)}
 
-  echo "Outputs will be at $OUTPUT_DIR"
+  echo "--- Outputs will be at $OUTPUT_DIR"
 
   # Run this revision benchmarks
   microbenchmarks_run "$OUTPUT_DIR/new.txt"
 
+  echo "--- This revision results:"
+  cat "$OUTPUT_DIR/new.txt"
+
   # Run other revision benchmarks
   git checkout "$REVISION"
   microbenchmarks_run "$OUTPUT_DIR/old.txt"
 
+  echo "--- $REVISION results:"
+  cat "$OUTPUT_DIR/old.txt"
+
   # Print results in console
+  echo "--- Benchstat:"
   benchstat "$OUTPUT_DIR/old.txt" "$OUTPUT_DIR/new.txt"
 
   # Generate html results
diff --git a/vendor/modules.txt b/vendor/modules.txt
index be5672bde..ae2f927e9 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -973,7 +973,7 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/hack v0.0.0-20201125230335-c46a6498e9ed
+# knative.dev/hack v0.0.0-20201201234937-fddbf732e450
 ## explicit
 knative.dev/hack
 # knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7


Test patch:
diff --git a/pkg/reconciler/route/traffic/traffic_test.go b/pkg/reconciler/route/traffic/traffic_test.go
index 828e7122b..7dba88dcc 100644
--- a/pkg/reconciler/route/traffic/traffic_test.go
+++ b/pkg/reconciler/route/traffic/traffic_test.go
@@ -730,17 +730,34 @@ func TestBuildTrafficConfigurationCanary(t *testing.T) {
 			goodNewRev.Name: goodNewRev,
 		},
 	}
-	if tc, err := BuildTrafficConfiguration(configLister, revLister, testRouteWithTrafficTargets(WithSpecTraffic(v1.TrafficTarget{
+	tc, err := BuildTrafficConfiguration(configLister, revLister, testRouteWithTrafficTargets(WithSpecTraffic(v1.TrafficTarget{
 		RevisionName: goodOldRev.Name,
 		Percent:      ptr.Int64(90),
 	}, v1.TrafficTarget{
 		ConfigurationName: goodConfig.Name,
 		Percent:           ptr.Int64(10),
-	}))); err != nil {
+	})))
+	if err != nil {
 		t.Error("Unexpected error", err)
 	} else if got, want := tc, expected; !cmp.Equal(want, got, cmpOpts...) {
 		t.Error("Unexpected traffic diff (-want +got):", cmp.Diff(want, got, cmpOpts...))
 	}
+
+	// Ensure just the 10% is going to be rolled out.
+	gotR := tc.BuildRollout()
+	wantR := &Rollout{
+		Configurations: []ConfigurationRollout{{
+			ConfigurationName: goodConfig.Name,
+			Percent:           10,
+			Revisions: []RevisionRollout{{
+				RevisionName: goodNewRev.Name,
+				Percent:      10,
+			}},
+		}},
+	}
+	if !cmp.Equal(gotR, wantR) {
+		t.Errorf("Rollout mismatch, diff(-want,+got):\n%s", cmp.Diff(wantR, gotR))
+	}
 }
 
 // Splitting traffic between latest revision and a fixed revision which is also latest.
@@ -1483,6 +1500,105 @@ func getTestReadyConfig(name string) (*v1.Configuration, *v1.Revision, *v1.Revis
 	return config, rev1, rev2
 }
 
+func TestBuildTrafficConfigurationTag0Percent(t *testing.T) {
+	expected := &Config{
+		Targets: map[string]RevisionTargets{
+			DefaultTarget: {{
+				TrafficTarget: v1.TrafficTarget{
+					ConfigurationName: niceConfig.Name,
+					RevisionName:      niceNewRev.Name,
+					Percent:           ptr.Int64(100),
+					LatestRevision:    ptr.Bool(true),
+				},
+				Protocol: net.ProtocolH2C,
+			}, {
+				TrafficTarget: v1.TrafficTarget{
+					ConfigurationName: goodConfig.Name,
+					RevisionName:      goodNewRev.Name,
+					Percent:           ptr.Int64(0),
+					LatestRevision:    ptr.Bool(true),
+					Tag:               "robert",
+				},
+				Protocol: net.ProtocolH2C,
+			}},
+			"robert": {{
+				TrafficTarget: v1.TrafficTarget{
+					ConfigurationName: goodConfig.Name,
+					RevisionName:      goodNewRev.Name,
+					Percent:           ptr.Int64(100),
+					Tag:               "robert",
+					LatestRevision:    ptr.Bool(true),
+				},
+				Protocol: net.ProtocolH2C,
+			}},
+		},
+		revisionTargets: []RevisionTarget{{
+			TrafficTarget: v1.TrafficTarget{
+				ConfigurationName: niceConfig.Name,
+				RevisionName:      niceNewRev.Name,
+				Percent:           ptr.Int64(100),
+				LatestRevision:    ptr.Bool(true),
+			},
+			Protocol: net.ProtocolH2C,
+		}, {
+			TrafficTarget: v1.TrafficTarget{
+				ConfigurationName: goodConfig.Name,
+				RevisionName:      goodNewRev.Name,
+				Percent:           ptr.Int64(0),
+				LatestRevision:    ptr.Bool(true),
+				Tag:               "robert",
+			},
+			Protocol: net.ProtocolH2C,
+		}},
+		Configurations: map[string]*v1.Configuration{
+			niceConfig.Name: niceConfig,
+			goodConfig.Name: goodConfig,
+		},
+		Revisions: map[string]*v1.Revision{
+			niceNewRev.Name: niceNewRev,
+			goodNewRev.Name: goodNewRev,
+		},
+	}
+	tc, err := BuildTrafficConfiguration(configLister, revLister, testRouteWithTrafficTargets(WithSpecTraffic(v1.TrafficTarget{
+		ConfigurationName: niceConfig.Name,
+		Percent:           ptr.Int64(100),
+	}, v1.TrafficTarget{
+		ConfigurationName: goodConfig.Name,
+		Percent:           ptr.Int64(0),
+		Tag:               "robert",
+	})))
+	if err != nil {
+		t.Fatal("Unexpected error", err)
+	}
+	if got, want := tc, expected; !cmp.Equal(want, got, cmpOpts...) {
+		fmt.Println(spew.Sdump(got))
+		t.Fatalf("Unexpected traffic diff (-want +got):\n%s", cmp.Diff(want, got, cmpOpts...))
+	}
+
+	gotR := tc.BuildRollout()
+	wantR := &Rollout{
+		Configurations: []ConfigurationRollout{{
+			ConfigurationName: niceConfig.Name,
+			Percent:           100,
+			Revisions: []RevisionRollout{{
+				RevisionName: niceNewRev.Name,
+				Percent:      100,
+			}},
+		}, {
+			ConfigurationName: goodConfig.Name,
+			Tag:               "robert",
+			Percent:           100,
+			Revisions: []RevisionRollout{{
+				RevisionName: goodNewRev.Name,
+				Percent:      100,
+			}},
+		}},
+	}
+	if !cmp.Equal(gotR, wantR) {
+		t.Errorf("Rollout mismatch, diff(-want,+got):\n%s", cmp.Diff(wantR, gotR))
+	}
+}
+
 func TestMain(m *testing.M) {
 	setUp()
 	os.Exit(m.Run())
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 4dc11ff97..b24ddea40 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -126,7 +126,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -141,7 +141,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -170,7 +170,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -206,7 +206,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -244,7 +244,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -268,7 +268,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -338,7 +338,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -354,7 +354,7 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20201130-861d1ad1"
+        serving.knative.dev/release: "v20201201-861d1ad1"
     spec:
       serviceAccountName: controller
       containers:
@@ -418,7 +418,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -432,7 +432,7 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20201130-861d1ad1"
+        serving.knative.dev/release: "v20201201-861d1ad1"
     spec:
       serviceAccountName: controller
       containers:
@@ -493,7 +493,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20201130-861d1ad1"
+    serving.knative.dev/release: "v20201201-861d1ad1"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports: