Repository: knative-sandbox/eventing-kafka-broker
Pull request #2738 (2022-10-21 11:06:35)

[Automated] Update eventing-kafka-broker-eventing nightly
/assign @knative/delivery-wg-leads
/cc @knative/delivery-wg-leads

Produced via:
```shell
for x in eventing-crds.yaml eventing-core.yaml; do
  curl https://storage.googleapis.com/knative-nightly/eventing/latest/$x > ${GITHUB_WORKSPACE}/./third_party/eventing-latest/$x
done
```

Details:
```

```

knative-prow[bot]: @knative-automation: GitHub didn't allow me to request PR reviews from the following users: knative/delivery-wg-leads.

Note that only [knative-sandbox members](https://github.com/orgs/knative-sandbox/people) and repo collaborators can review this PR, and authors cannot review their own PRs.

<details>

In response to [this](https://github.com/knative-sandbox/eventing-kafka-broker/pull/2738):

>/assign @knative/delivery-wg-leads
>/cc @knative/delivery-wg-leads
>
>Produced via:
>```shell
>for x in eventing-crds.yaml eventing-core.yaml; do
>  curl https://storage.googleapis.com/knative-nightly/eventing/latest/$x > ${GITHUB_WORKSPACE}/./third_party/eventing-latest/$x
>done
>```
>
>Details:
>```
>
>```


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/eventing-kafka-broker/pull/2738#" title="Author self-approved">knative-automation</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign zroubalik for approval by writing `/assign @zroubalik` in a comment. For more information see:[The Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Feventing-kafka-broker).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/eventing-kafka-broker/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["zroubalik"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#2738](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (03711af) into [main](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/commit/85db1f912c8ef9a9df2710221be6153248e2c299?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (85db1f9) will **decrease** coverage by `5.98%`.
> The diff coverage is `n/a`.

```diff
@@             Coverage Diff              @@
##               main    #2738      +/-   ##
============================================
- Coverage     61.18%   55.19%   -5.99%     
============================================
  Files           148       75      -73     
  Lines         10580     8035    -2545     
  Branches        231        0     -231     
============================================
- Hits           6473     4435    -2038     
+ Misses         3646     3276     -370     
+ Partials        461      324     -137     
```

| Flag | Coverage Δ | |
|---|---|---|
| java-unittests | `?` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) | Coverage Δ | |
|---|---|---|
| [...lane/pkg/reconciler/consumergroup/consumergroup.go](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-Y29udHJvbC1wbGFuZS9wa2cvcmVjb25jaWxlci9jb25zdW1lcmdyb3VwL2NvbnN1bWVyZ3JvdXAuZ28=) | `52.89% <0.00%> (-0.76%)` | :arrow_down: |
| [...er/impl/consumer/InvalidCloudEventInterceptor.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9kaXNwYXRjaGVyL3NyYy9tYWluL2phdmEvZGV2L2tuYXRpdmUvZXZlbnRpbmcva2Fma2EvYnJva2VyL2Rpc3BhdGNoZXIvaW1wbC9jb25zdW1lci9JbnZhbGlkQ2xvdWRFdmVudEludGVyY2VwdG9yLmphdmE=) | | |
| [...ker/core/reconciler/IngressReconcilerListener.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9jb3JlL3NyYy9tYWluL2phdmEvZGV2L2tuYXRpdmUvZXZlbnRpbmcva2Fma2EvYnJva2VyL2NvcmUvcmVjb25jaWxlci9JbmdyZXNzUmVjb25jaWxlckxpc3RlbmVyLmphdmE=) | | |
| [...atcher/impl/filter/subscriptionsapi/NotFilter.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9kaXNwYXRjaGVyL3NyYy9tYWluL2phdmEvZGV2L2tuYXRpdmUvZXZlbnRpbmcva2Fma2EvYnJva2VyL2Rpc3BhdGNoZXIvaW1wbC9maWx0ZXIvc3Vic2NyaXB0aW9uc2FwaS9Ob3RGaWx0ZXIuamF2YQ==) | | |
| [.../kafka/broker/dispatcher/impl/ResourceContext.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9kaXNwYXRjaGVyL3NyYy9tYWluL2phdmEvZGV2L2tuYXRpdmUvZXZlbnRpbmcva2Fma2EvYnJva2VyL2Rpc3BhdGNoZXIvaW1wbC9SZXNvdXJjZUNvbnRleHQuamF2YQ==) | | |
| [...nting/kafka/broker/core/security/AuthProvider.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9jb3JlL3NyYy9tYWluL2phdmEvZGV2L2tuYXRpdmUvZXZlbnRpbmcva2Fma2EvYnJva2VyL2NvcmUvc2VjdXJpdHkvQXV0aFByb3ZpZGVyLmphdmE=) | | |
| [...ispatcher/impl/http/WebClientCloudEventSender.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9kaXNwYXRjaGVyL3NyYy9tYWluL2phdmEvZGV2L2tuYXRpdmUvZXZlbnRpbmcva2Fma2EvYnJva2VyL2Rpc3BhdGNoZXIvaW1wbC9odHRwL1dlYkNsaWVudENsb3VkRXZlbnRTZW5kZXIuamF2YQ==) | | |
| [...g/kafka/broker/receiver/impl/ReceiverVerticle.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9yZWNlaXZlci9zcmMvbWFpbi9qYXZhL2Rldi9rbmF0aXZlL2V2ZW50aW5nL2thZmthL2Jyb2tlci9yZWNlaXZlci9pbXBsL1JlY2VpdmVyVmVydGljbGUuamF2YQ==) | | |
| [...ceiver/impl/handler/IngressRequestHandlerImpl.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9yZWNlaXZlci9zcmMvbWFpbi9qYXZhL2Rldi9rbmF0aXZlL2V2ZW50aW5nL2thZmthL2Jyb2tlci9yZWNlaXZlci9pbXBsL2hhbmRsZXIvSW5ncmVzc1JlcXVlc3RIYW5kbGVySW1wbC5qYXZh) | | |
| [...eceiver/impl/IngressProducerReconcilableStore.java](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-ZGF0YS1wbGFuZS9yZWNlaXZlci9zcmMvbWFpbi9qYXZhL2Rldi9rbmF0aXZlL2V2ZW50aW5nL2thZmthL2Jyb2tlci9yZWNlaXZlci9pbXBsL0luZ3Jlc3NQcm9kdWNlclJlY29uY2lsYWJsZVN0b3JlLmphdmE=) | | |
| ... and [64 more](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2738/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) | |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)


Patch:
diff --git a/control-plane/config/eventing-kafka-broker/200-controller/500-controller.yaml b/control-plane/config/eventing-kafka-broker/200-controller/500-controller.yaml
index 261c0bb0c..6a495b35a 100644
--- a/control-plane/config/eventing-kafka-broker/200-controller/500-controller.yaml
+++ b/control-plane/config/eventing-kafka-broker/200-controller/500-controller.yaml
@@ -185,6 +185,10 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       restartPolicy: Always
diff --git a/control-plane/config/eventing-kafka-broker/200-webhook/500-webhook.yaml b/control-plane/config/eventing-kafka-broker/200-webhook/500-webhook.yaml
index b7cc21b07..2c1347799 100644
--- a/control-plane/config/eventing-kafka-broker/200-webhook/500-webhook.yaml
+++ b/control-plane/config/eventing-kafka-broker/200-webhook/500-webhook.yaml
@@ -81,6 +81,12 @@ spec:
 
           securityContext:
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
 
           ports:
             - name: https-webhook
diff --git a/control-plane/config/eventing-kafka-source/200-controller/500-controller.yaml b/control-plane/config/eventing-kafka-source/200-controller/500-controller.yaml
index bcc2bff7d..2a2977f65 100644
--- a/control-plane/config/eventing-kafka-source/200-controller/500-controller.yaml
+++ b/control-plane/config/eventing-kafka-source/200-controller/500-controller.yaml
@@ -113,6 +113,10 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       restartPolicy: Always
diff --git a/control-plane/config/post-install/500-post-install-job.yaml b/control-plane/config/post-install/500-post-install-job.yaml
index c5be8e2cb..a368c9efa 100644
--- a/control-plane/config/post-install/500-post-install-job.yaml
+++ b/control-plane/config/post-install/500-post-install-job.yaml
@@ -43,3 +43,12 @@ spec:
                   fieldPath: metadata.namespace
             - name: CHANNEL_GENERAL_CONFIG_MAP_NAME
               value: kafka-channel-config
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
diff --git a/control-plane/config/post-install/500-storage-version-migrator.yaml b/control-plane/config/post-install/500-storage-version-migrator.yaml
index 26a3b70e0..41e712546 100644
--- a/control-plane/config/post-install/500-storage-version-migrator.yaml
+++ b/control-plane/config/post-install/500-storage-version-migrator.yaml
@@ -43,3 +43,12 @@ spec:
             - "kafkasources.sources.knative.dev"
             - "kafkachannels.messaging.knative.dev"
             - "kafkasinks.eventing.knative.dev"
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
diff --git a/control-plane/pkg/reconciler/broker/broker.go b/control-plane/pkg/reconciler/broker/broker.go
index bac36b5aa..520e94fea 100644
--- a/control-plane/pkg/reconciler/broker/broker.go
+++ b/control-plane/pkg/reconciler/broker/broker.go
@@ -128,7 +128,7 @@ func (r *Reconciler) reconcileKind(ctx context.Context, broker *eventing.Broker)
 
 	logger.Debug("Got contract config map")
 
-	if !r.IsReceiverRunning() || !r.IsDispatcherRunning() {
+	if !r.IsReceiverRunning() {
 		return statusConditionManager.DataPlaneNotAvailable()
 	}
 	statusConditionManager.DataPlaneAvailable()
diff --git a/control-plane/pkg/reconciler/trigger/v2/controllerv2.go b/control-plane/pkg/reconciler/trigger/v2/controllerv2.go
index b4ed114dc..2e189e7e8 100644
--- a/control-plane/pkg/reconciler/trigger/v2/controllerv2.go
+++ b/control-plane/pkg/reconciler/trigger/v2/controllerv2.go
@@ -40,6 +40,9 @@ import (
 	apiseventing "knative.dev/eventing/pkg/apis/eventing"
 	eventing "knative.dev/eventing/pkg/apis/eventing/v1"
 	eventinglisters "knative.dev/eventing/pkg/client/listers/eventing/v1"
+
+	kubeclient "knative.dev/pkg/client/injection/kube/client"
+	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 )
 
 const (
@@ -64,6 +67,8 @@ func NewController(ctx context.Context, configs *config.Env) *controller.Impl {
 		Env:                 configs,
 		ConsumerGroupLister: consumerGroupInformer.Lister(),
 		InternalsClient:     consumergroupclient.Get(ctx),
+		SecretLister:        secretinformer.Get(ctx).Lister(),
+		KubeClient:          kubeclient.Get(ctx),
 	}
 
 	impl := triggerreconciler.NewImpl(ctx, reconciler, func(impl *controller.Impl) controller.Options {
diff --git a/control-plane/pkg/reconciler/trigger/v2/triggerv2.go b/control-plane/pkg/reconciler/trigger/v2/triggerv2.go
index 5ed1d53e3..77d43c746 100644
--- a/control-plane/pkg/reconciler/trigger/v2/triggerv2.go
+++ b/control-plane/pkg/reconciler/trigger/v2/triggerv2.go
@@ -22,15 +22,18 @@ import (
 	"strings"
 
 	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
 	corelisters "k8s.io/client-go/listers/core/v1"
 	sources "knative.dev/eventing-kafka/pkg/apis/sources/v1beta1"
 	eventingduck "knative.dev/eventing/pkg/apis/duck/v1"
 	eventing "knative.dev/eventing/pkg/apis/eventing/v1"
 	eventingclientset "knative.dev/eventing/pkg/client/clientset/versioned"
 	eventinglisters "knative.dev/eventing/pkg/client/listers/eventing/v1"
+	"knative.dev/pkg/apis"
 	"knative.dev/pkg/kmeta"
 	"knative.dev/pkg/reconciler"
 
@@ -41,10 +44,21 @@ import (
 	"knative.dev/eventing-kafka-broker/control-plane/pkg/config"
 	"knative.dev/eventing-kafka-broker/control-plane/pkg/kafka"
 	kafkalogging "knative.dev/eventing-kafka-broker/control-plane/pkg/logging"
+	"knative.dev/eventing-kafka-broker/control-plane/pkg/security"
+
+	"knative.dev/eventing-kafka-broker/control-plane/pkg/apis/eventing/v1alpha1"
+
+	kedafunc "knative.dev/eventing-kafka-broker/control-plane/pkg/keda"
+	brokerreconciler "knative.dev/eventing-kafka-broker/control-plane/pkg/reconciler/broker"
 )
 
 const (
 	deliveryOrderAnnotation = "kafka.eventing.knative.dev/delivery.order"
+	// TopicPrefix is the Kafka Broker topic prefix - (topic name: knative-broker-<broker-namespace>-<broker-name>).
+	TopicPrefix = "knative-broker-"
+
+	// ExternalTopicAnnotation for using external kafka topic for the broker
+	ExternalTopicAnnotation = "kafka.eventing.knative.dev/external.topic"
 )
 
 type Reconciler struct {
@@ -54,6 +68,8 @@ type Reconciler struct {
 	Env                 *config.Env
 	ConsumerGroupLister internalslst.ConsumerGroupLister
 	InternalsClient     internalsclient.Interface
+	SecretLister        corelisters.SecretLister
+	KubeClient          kubernetes.Interface
 }
 
 func (r *Reconciler) ReconcileKind(ctx context.Context, trigger *eventing.Trigger) reconciler.Event {
@@ -66,16 +82,18 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, trigger *eventing.Trigge
 	}
 
 	if apierrors.IsNotFound(err) {
+
 		// Actually check if the broker doesn't exist.
 		// Note: do not introduce another `broker` variable with `:`
 		broker, err = r.EventingClient.EventingV1().Brokers(trigger.Namespace).Get(ctx, trigger.Spec.Broker, metav1.GetOptions{})
+
 		if apierrors.IsNotFound(err) {
 			return fmt.Errorf("failed to get broker: %w", err)
 		}
 	}
 
 	// Ignore Triggers that are associated with a Broker we don't own.
-	if isKnativeKafkaBroker, brokerClass := isKnativeKafkaBroker(broker); !isKnativeKafkaBroker {
+	if hasRelevantBroker, brokerClass := r.hasRelevantBrokerClass(broker); !hasRelevantBroker {
 		logger.Debug("Ignoring Trigger", zap.String(eventing.BrokerClassAnnotationKey, brokerClass))
 		return nil
 	}
@@ -110,7 +128,7 @@ func (r Reconciler) reconcileConsumerGroup(ctx context.Context, broker *eventing
 	}
 
 	offset := sources.OffsetLatest
-	isLatestOffset, err := kafka.IsOffsetLatest(r.ConfigMapLister, r.Env.DataPlaneConfigMapNamespace, r.Env.ContractConfigMapName, "config-kafka-broker-consumer.properties")
+	isLatestOffset, err := kafka.IsOffsetLatest(r.ConfigMapLister, r.Env.DataPlaneConfigMapNamespace, r.Env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey)
 	if err != nil {
 		return nil, fmt.Errorf("failed to determine initial offset: %w", err)
 	}
@@ -118,7 +136,15 @@ func (r Reconciler) reconcileConsumerGroup(ctx context.Context, broker *eventing
 		offset = sources.OffsetEarliest
 	}
 
-	newcg := &internalscg.ConsumerGroup{
+	secret, err := security.Secret(ctx, &security.AnnotationsSecretLocator{Annotations: broker.Status.Annotations, Namespace: trigger.Namespace}, security.DefaultSecretProviderFunc(r.SecretLister, r.KubeClient))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get secret: %w", err)
+	}
+
+	bootstrapServers := broker.Status.Annotations[kafka.BootstrapServersConfigMapKey]
+	topicName := broker.Status.Annotations[kafka.TopicAnnotation]
+
+	expectedCg := &internalscg.ConsumerGroup{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      string(trigger.UID),
 			Namespace: trigger.Namespace,
@@ -137,8 +163,11 @@ func (r Reconciler) reconcileConsumerGroup(ctx context.Context, broker *eventing
 					},
 				},
 				Spec: internalscg.ConsumerSpec{
-					Topics:  []string{},                                                                               //todo get topics from broker resource
-					Configs: internalscg.ConsumerConfigs{Configs: map[string]string{"group.id": string(trigger.UID)}}, //todo get bootstrap.servers from broker resource
+					Topics: []string{topicName},
+					Configs: internalscg.ConsumerConfigs{Configs: map[string]string{
+						"group.id":          string(trigger.UID),
+						"bootstrap.servers": bootstrapServers,
+					}},
 					Delivery: &internalscg.DeliverySpec{
 						DeliverySpec:  deliverySpec(broker, trigger),
 						Ordering:      deliveryOrdering,
@@ -155,32 +184,45 @@ func (r Reconciler) reconcileConsumerGroup(ctx context.Context, broker *eventing
 		},
 	}
 
+	// TODO: make keda annotation values configurable and maybe unexposed
+	expectedCg.Annotations = kedafunc.SetAutoscalingAnnotations(trigger.Annotations)
+
+	if secret != nil {
+		expectedCg.Spec.Template.Spec.Auth = &internalscg.Auth{
+			AuthSpec: &v1alpha1.Auth{
+				Secret: &v1alpha1.Secret{
+					Ref: &v1alpha1.SecretReference{
+						Name: secret.Name,
+					},
+				},
+			},
+		}
+	}
+
 	cg, err := r.ConsumerGroupLister.ConsumerGroups(trigger.GetNamespace()).Get(string(trigger.UID)) //Get by consumer group name
 	if err != nil && !apierrors.IsNotFound(err) {
 		return nil, err
 	}
-
 	if apierrors.IsNotFound(err) {
-		cg, err := r.InternalsClient.InternalV1alpha1().ConsumerGroups(newcg.GetNamespace()).Create(ctx, newcg, metav1.CreateOptions{})
+		cg, err := r.InternalsClient.InternalV1alpha1().ConsumerGroups(expectedCg.GetNamespace()).Create(ctx, expectedCg, metav1.CreateOptions{})
 		if err != nil && !apierrors.IsAlreadyExists(err) {
-			return nil, fmt.Errorf("failed to create consumer group %s/%s: %w", newcg.GetNamespace(), newcg.GetName(), err)
-		}
-		if apierrors.IsAlreadyExists(err) {
-			return newcg, nil
+			return nil, fmt.Errorf("failed to create consumer group %s/%s: %w", expectedCg.GetNamespace(), expectedCg.GetName(), err)
 		}
 		return cg, nil
 	}
 
-	if equality.Semantic.DeepDerivative(newcg.Spec, cg.Spec) {
+	if equality.Semantic.DeepDerivative(expectedCg.Spec, cg.Spec) && equality.Semantic.DeepDerivative(expectedCg.Annotations, cg.Annotations) {
 		return cg, nil
 	}
 
 	newCg := &internalscg.ConsumerGroup{
 		TypeMeta:   cg.TypeMeta,
 		ObjectMeta: cg.ObjectMeta,
-		Spec:       newcg.Spec,
+		Spec:       expectedCg.Spec,
 		Status:     cg.Status,
 	}
+	newCg.Annotations = expectedCg.Annotations
+
 	if cg, err = r.InternalsClient.InternalV1alpha1().ConsumerGroups(cg.GetNamespace()).Update(ctx, newCg, metav1.UpdateOptions{}); err != nil {
 		return nil, fmt.Errorf("failed to update consumer group %s/%s: %w", newCg.GetNamespace(), newCg.GetName(), err)
 	}
@@ -212,9 +254,13 @@ func propagateConsumerGroupStatus(cg *internalscg.ConsumerGroup, trigger *eventi
 
 	trigger.Status.DeadLetterSinkURI = cg.Status.DeadLetterSinkURI
 	trigger.Status.MarkDeadLetterSinkResolvedSucceeded()
+
+	trigger.Status.PropagateSubscriptionCondition(&apis.Condition{
+		Status: corev1.ConditionTrue,
+	})
 }
 
-func isKnativeKafkaBroker(broker *eventing.Broker) (bool, string) {
+func (r *Reconciler) hasRelevantBrokerClass(broker *eventing.Broker) (bool, string) {
 	brokerClass := broker.GetAnnotations()[eventing.BrokerClassAnnotationKey]
 	return brokerClass == kafka.BrokerClass, brokerClass
 }
diff --git a/data-plane/config/broker/500-dispatcher.yaml b/data-plane/config/broker/500-dispatcher.yaml
index 9a81e6a53..173d1141f 100644
--- a/data-plane/config/broker/500-dispatcher.yaml
+++ b/data-plane/config/broker/500-dispatcher.yaml
@@ -141,8 +141,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-kafka-broker-data-plane
           configMap:
diff --git a/data-plane/config/broker/500-receiver.yaml b/data-plane/config/broker/500-receiver.yaml
index 859f90d20..4ba55f5a9 100644
--- a/data-plane/config/broker/500-receiver.yaml
+++ b/data-plane/config/broker/500-receiver.yaml
@@ -144,8 +144,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: kafka-broker-brokers-triggers
           configMap:
diff --git a/data-plane/config/brokerv2/500-dispatcher.yaml b/data-plane/config/brokerv2/500-dispatcher.yaml
index 89e0af6b4..72a847c84 100644
--- a/data-plane/config/brokerv2/500-dispatcher.yaml
+++ b/data-plane/config/brokerv2/500-dispatcher.yaml
@@ -70,7 +70,7 @@ spec:
             - mountPath: /tmp
               name: cache
             - mountPath: /etc/logging
-              name: kafka-broker-config-logging
+              name: kafka-config-logging
               readOnly: true
             - mountPath: /etc/tracing
               name: config-tracing
@@ -93,7 +93,7 @@ spec:
             - name: WEBCLIENT_CONFIG_FILE_PATH
               value: /etc/config/config-kafka-broker-webclient.properties
             - name: DATA_PLANE_CONFIG_FILE_PATH
-              value: /etc/brokers-triggers/data
+              value: /etc/contract-resources/data
             - name: EGRESSES_INITIAL_CAPACITY
               value: "20"
             - name: INSTANCE_ID
@@ -118,6 +118,7 @@ spec:
               value: "8"
             - name: JAVA_TOOL_OPTIONS
               value: "-XX:+CrashOnOutOfMemoryError -XX:InitialRAMPercentage=70.0 -XX:MinRAMPercentage=70.0 -XX:MaxRAMPercentage=70.0"
+
           resources:
             requests:
               cpu: 1000m
@@ -149,15 +150,19 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-kafka-broker-data-plane
           configMap:
             name: config-kafka-broker-data-plane
         - name: cache
           emptyDir: { }
-        - name: kafka-broker-config-logging
+        - name: kafka-config-logging
           configMap:
             name: kafka-config-logging
         - name: config-tracing
diff --git a/data-plane/config/channel/500-dispatcher.yaml b/data-plane/config/channel/500-dispatcher.yaml
index 024ac4761..e5825d297 100644
--- a/data-plane/config/channel/500-dispatcher.yaml
+++ b/data-plane/config/channel/500-dispatcher.yaml
@@ -141,8 +141,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-kafka-channel-data-plane
           configMap:
diff --git a/data-plane/config/channel/500-receiver.yaml b/data-plane/config/channel/500-receiver.yaml
index 4f348c76d..92699ad98 100644
--- a/data-plane/config/channel/500-receiver.yaml
+++ b/data-plane/config/channel/500-receiver.yaml
@@ -144,8 +144,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: kafka-channel-channels-subscriptions
           configMap:
diff --git a/data-plane/config/channelv2/500-dispatcher.yaml b/data-plane/config/channelv2/500-dispatcher.yaml
index 22e496677..318d83159 100644
--- a/data-plane/config/channelv2/500-dispatcher.yaml
+++ b/data-plane/config/channelv2/500-dispatcher.yaml
@@ -150,8 +150,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-kafka-channel-data-plane
           configMap:
diff --git a/data-plane/config/sink/500-receiver.yaml b/data-plane/config/sink/500-receiver.yaml
index 5412f3dc3..10c1cd783 100644
--- a/data-plane/config/sink/500-receiver.yaml
+++ b/data-plane/config/sink/500-receiver.yaml
@@ -144,8 +144,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: kafka-sink-sinks
           configMap:
diff --git a/data-plane/config/source/500-dispatcher.yaml b/data-plane/config/source/500-dispatcher.yaml
index 1c104a8bd..215ab722c 100644
--- a/data-plane/config/source/500-dispatcher.yaml
+++ b/data-plane/config/source/500-dispatcher.yaml
@@ -150,8 +150,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-kafka-source-data-plane
           configMap:


Test patch:
diff --git a/control-plane/pkg/reconciler/testing/objects_broker.go b/control-plane/pkg/reconciler/testing/objects_broker.go
index 51c821832..cb3404deb 100644
--- a/control-plane/pkg/reconciler/testing/objects_broker.go
+++ b/control-plane/pkg/reconciler/testing/objects_broker.go
@@ -54,6 +54,10 @@ const (
 	TriggerNamespace = "test-namespace"
 )
 
+var (
+	BrokerTopics = []string{fmt.Sprintf("%s%s-%s", TopicPrefix, BrokerNamespace, BrokerName)}
+)
+
 func BrokerTopic() string {
 	return fmt.Sprintf("%s%s-%s", TopicPrefix, BrokerNamespace, BrokerName)
 }
@@ -190,6 +194,20 @@ func WithBootstrapServerStatusAnnotation(servers string) reconcilertesting.Broke
 	}
 }
 
+func WithAutoscalingAnnotationsTrigger() reconcilertesting.TriggerOption {
+	return func(trigger *eventing.Trigger) {
+		if trigger.Annotations == nil {
+			trigger.Annotations = make(map[string]string)
+		}
+
+		for k, v := range ConsumerGroupAnnotations {
+			if _, ok := trigger.Annotations[k]; !ok {
+				trigger.Annotations[k] = v
+			}
+		}
+	}
+}
+
 type CMOption func(cm *corev1.ConfigMap)
 
 func BrokerConfig(bootstrapServers string, numPartitions, replicationFactor int, options ...CMOption) *corev1.ConfigMap {
diff --git a/control-plane/pkg/reconciler/trigger/v2/triggerv2_test.go b/control-plane/pkg/reconciler/trigger/v2/triggerv2_test.go
index 5f66ca8ec..a800c1754 100644
--- a/control-plane/pkg/reconciler/trigger/v2/triggerv2_test.go
+++ b/control-plane/pkg/reconciler/trigger/v2/triggerv2_test.go
@@ -38,6 +38,7 @@ import (
 	triggerreconciler "knative.dev/eventing/pkg/client/injection/reconciler/eventing/v1/trigger"
 	reconcilertesting "knative.dev/eventing/pkg/reconciler/testing/v1"
 	"knative.dev/pkg/apis"
+	kubeclient "knative.dev/pkg/client/injection/kube/client"
 	"knative.dev/pkg/controller"
 	"knative.dev/pkg/kmeta"
 	"knative.dev/pkg/logging"
@@ -58,11 +59,11 @@ const (
 )
 
 var DefaultEnv = &config.Env{
-	DataPlaneConfigMapNamespace: "knative-eventing",
-	ContractConfigMapName:       "kafka-broker-brokers-triggers",
-	ContractConfigMapFormat:     base.Json,
-	GeneralConfigMapName:        "kafka-broker-config",
-	SystemNamespace:             "knative-eventing",
+	DataPlaneConfigMapNamespace:  "knative-eventing",
+	DataPlaneConfigConfigMapName: "config-kafka-broker-data-plane",
+	ContractConfigMapFormat:      base.Json,
+	GeneralConfigMapName:         "kafka-broker-config",
+	SystemNamespace:              "knative-eventing",
 }
 
 var (
@@ -91,7 +92,7 @@ func TestReconcileKind(t *testing.T) {
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
 				newTrigger(),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 			},
@@ -104,8 +105,9 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
+							ConsumerBootstrapServersConfig(bootstrapServers),
 							ConsumerGroupIdConfig(TriggerUUID),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
@@ -118,6 +120,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -135,7 +138,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -149,9 +152,10 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(
 							internals.Unordered,
@@ -169,6 +173,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -185,7 +190,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(reconcilertesting.WithAnnotation(deliveryOrderAnnotation, string(internals.Ordered))),
@@ -199,9 +204,10 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Ordered, ConsumerInitialOffset(sources.OffsetLatest))),
 						ConsumerFilters(NewConsumerSpecFilters()),
@@ -213,6 +219,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -230,7 +237,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(reconcilertesting.WithAnnotation(deliveryOrderAnnotation, string(internals.Unordered))),
@@ -244,9 +251,10 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 						ConsumerFilters(NewConsumerSpecFilters()),
@@ -258,6 +266,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -275,7 +284,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(reconcilertesting.WithAnnotation(deliveryOrderAnnotation, "invalid")),
@@ -311,7 +320,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -335,9 +344,10 @@ func TestReconcileKind(t *testing.T) {
 						WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 						WithConsumerGroupLabels(ConsumerTriggerLabel),
 						ConsumerGroupConsumerSpec(NewConsumerSpec(
-							ConsumerTopics(),
+							ConsumerTopics(BrokerTopics[0]),
 							ConsumerConfigs(
 								ConsumerGroupIdConfig(TriggerUUID),
+								ConsumerBootstrapServersConfig(bootstrapServers),
 							),
 							ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 							ConsumerFilters(NewConsumerSpecFilters()),
@@ -351,6 +361,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyReady(),
@@ -359,6 +370,68 @@ func TestReconcileKind(t *testing.T) {
 				},
 			},
 		},
+		{
+			Name: "Reconciled normal - existing cg with autoscaling annotations",
+			Objects: []runtime.Object{
+				NewBroker(
+					BrokerReady,
+					WithTopicStatusAnnotation(BrokerTopic()),
+					WithBootstrapServerStatusAnnotation(bootstrapServers),
+				),
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
+					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
+				),
+				newTrigger(
+					WithAutoscalingAnnotationsTrigger(),
+				),
+				NewConsumerGroup(
+					WithConsumerGroupName(TriggerUUID),
+					WithConsumerGroupNamespace(triggerNamespace),
+					WithConsumerGroupOwnerRef(kmeta.NewControllerRef(newTrigger())),
+					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
+					WithConsumerGroupLabels(ConsumerTriggerLabel),
+					ConsumerGroupReady,
+				),
+			},
+			Key:         testKey,
+			WantCreates: []runtime.Object{},
+			WantUpdates: []clientgotesting.UpdateActionImpl{
+				{
+					Object: NewConsumerGroup(
+						WithConsumerGroupName(TriggerUUID),
+						WithConsumerGroupNamespace(triggerNamespace),
+						WithConsumerGroupOwnerRef(kmeta.NewControllerRef(newTrigger())),
+						WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
+						WithConsumerGroupLabels(ConsumerTriggerLabel),
+						WithConsumerGroupAnnotations(ConsumerGroupAnnotations),
+						ConsumerGroupConsumerSpec(NewConsumerSpec(
+							ConsumerTopics(BrokerTopics[0]),
+							ConsumerConfigs(
+								ConsumerGroupIdConfig(TriggerUUID),
+								ConsumerBootstrapServersConfig(bootstrapServers),
+							),
+							ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
+							ConsumerFilters(NewConsumerSpecFilters()),
+							ConsumerReply(ConsumerTopicReply()),
+						)),
+						ConsumerGroupReady,
+					),
+				},
+			},
+			WantStatusUpdates: []clientgotesting.UpdateActionImpl{
+				{
+					Object: newTrigger(
+						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
+						reconcilertesting.WithTriggerBrokerReady(),
+						withTriggerSubscriberResolvedSucceeded(),
+						reconcilertesting.WithTriggerDependencyReady(),
+						withDeadLetterSinkURI(""),
+						WithAutoscalingAnnotationsTrigger(),
+					),
+				},
+			},
+		},
 		{
 			Name: "Reconciled normal - existing cg with update but not ready",
 			Objects: []runtime.Object{
@@ -367,7 +440,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -390,9 +463,10 @@ func TestReconcileKind(t *testing.T) {
 						WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 						WithConsumerGroupLabels(ConsumerTriggerLabel),
 						ConsumerGroupConsumerSpec(NewConsumerSpec(
-							ConsumerTopics(),
+							ConsumerTopics(BrokerTopics[0]),
 							ConsumerConfigs(
 								ConsumerGroupIdConfig(TriggerUUID),
+								ConsumerBootstrapServersConfig(bootstrapServers),
 							),
 							ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 							ConsumerFilters(NewConsumerSpecFilters()),
@@ -405,6 +479,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -421,7 +496,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -431,16 +506,19 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupOwnerRef(kmeta.NewControllerRef(newTrigger())),
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
+					WithConsumerGroupAnnotations(ConsumerGroupAnnotations),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 						ConsumerFilters(NewConsumerSpecFilters()),
 						ConsumerReply(ConsumerTopicReply()),
 					)),
 					ConsumerGroupReady,
+					ConsumerGroupReplicas(1),
 				),
 			},
 			Key: testKey,
@@ -448,6 +526,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyReady(),
@@ -464,7 +543,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -474,15 +553,18 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupOwnerRef(kmeta.NewControllerRef(newTrigger())),
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
+					WithConsumerGroupAnnotations(ConsumerGroupAnnotations),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 						ConsumerFilters(NewConsumerSpecFilters()),
 						ConsumerReply(ConsumerTopicReply()),
 					)),
+					ConsumerGroupReplicas(1),
 				),
 			},
 			Key: testKey,
@@ -490,6 +572,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -506,7 +589,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -516,16 +599,19 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupOwnerRef(kmeta.NewControllerRef(newTrigger())),
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
+					WithConsumerGroupAnnotations(ConsumerGroupAnnotations),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 						ConsumerFilters(NewConsumerSpecFilters()),
 						ConsumerReply(ConsumerTopicReply()),
 					)),
 					WithConsumerGroupFailed("failed", "failed"),
+					ConsumerGroupReplicas(1),
 				),
 			},
 			Key: testKey,
@@ -533,6 +619,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyFailed("failed", "failed"),
@@ -549,7 +636,7 @@ func TestReconcileKind(t *testing.T) {
 					WithTopicStatusAnnotation(BrokerTopic()),
 					WithBootstrapServerStatusAnnotation(bootstrapServers),
 				),
-				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.ContractConfigMapName, brokerreconciler.ConsumerConfigKey,
+				DataPlaneConfigMap(env.DataPlaneConfigMapNamespace, env.DataPlaneConfigConfigMapName, brokerreconciler.ConsumerConfigKey,
 					DataPlaneConfigInitialOffset(brokerreconciler.ConsumerConfigKey, sources.OffsetLatest),
 				),
 				newTrigger(),
@@ -560,15 +647,17 @@ func TestReconcileKind(t *testing.T) {
 					WithConsumerGroupMetaLabels(OwnerAsTriggerLabel),
 					WithConsumerGroupLabels(ConsumerTriggerLabel),
 					ConsumerGroupConsumerSpec(NewConsumerSpec(
-						ConsumerTopics(),
+						ConsumerTopics(BrokerTopics[0]),
 						ConsumerConfigs(
 							ConsumerGroupIdConfig(TriggerUUID),
+							ConsumerBootstrapServersConfig(bootstrapServers),
 						),
 						ConsumerDelivery(NewConsumerSpecDelivery(internals.Unordered, ConsumerInitialOffset(sources.OffsetLatest))),
 						ConsumerFilters(NewConsumerSpecFilters()),
 						ConsumerReply(ConsumerTopicReply()),
 					)),
 					WithDeadLetterSinkURI(url.String()),
+					ConsumerGroupReplicas(1),
 				),
 			},
 			Key: testKey,
@@ -576,6 +665,7 @@ func TestReconcileKind(t *testing.T) {
 				{
 					Object: newTrigger(
 						reconcilertesting.WithInitTriggerConditions,
+						reconcilertesting.WithTriggerSubscribed(),
 						reconcilertesting.WithTriggerBrokerReady(),
 						withTriggerSubscriberResolvedSucceeded(),
 						reconcilertesting.WithTriggerDependencyUnknown("failed to reconcile consumer group", "consumer group is not ready"),
@@ -665,7 +755,6 @@ func TestReconcileKind(t *testing.T) {
 	}
 
 	table.Test(t, NewFactory(env, func(ctx context.Context, listers *Listers, env *config.Env, row *TableRow) controller.Reconciler {
-
 		logger := logging.FromContext(ctx)
 
 		reconciler := &Reconciler{
@@ -675,6 +764,8 @@ func TestReconcileKind(t *testing.T) {
 			Env:                 env,
 			ConsumerGroupLister: listers.GetConsumerGroupLister(),
 			InternalsClient:     fakeconsumergroupinformer.Get(ctx),
+			SecretLister:        listers.GetSecretLister(),
+			KubeClient:          kubeclient.Get(ctx),
 		}
 
 		return triggerreconciler.NewReconciler(
diff --git a/test/config/cm-watcher-broker.yaml b/test/config/cm-watcher-broker.yaml
index 83a552f88..6d0e7dc70 100644
--- a/test/config/cm-watcher-broker.yaml
+++ b/test/config/cm-watcher-broker.yaml
@@ -73,8 +73,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-logging
           configMap:
diff --git a/test/config/cm-watcher-channel.yaml b/test/config/cm-watcher-channel.yaml
index fd48971a5..fc9c6693d 100644
--- a/test/config/cm-watcher-channel.yaml
+++ b/test/config/cm-watcher-channel.yaml
@@ -73,8 +73,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-logging
           configMap:
diff --git a/test/config/cm-watcher-sink.yaml b/test/config/cm-watcher-sink.yaml
index 6d6250921..39243edd9 100644
--- a/test/config/cm-watcher-sink.yaml
+++ b/test/config/cm-watcher-sink.yaml
@@ -73,8 +73,12 @@ spec:
           terminationMessagePath: /dev/temination-log
           securityContext:
             allowPrivilegeEscalation: false
-            privileged: false
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-logging
           configMap:
diff --git a/third_party/eventing-latest/eventing-core.yaml b/third_party/eventing-latest/eventing-core.yaml
index d051d4437..b5ef59373 100644
--- a/third_party/eventing-latest/eventing-core.yaml
+++ b/third_party/eventing-latest/eventing-core.yaml
@@ -16,8 +16,8 @@ kind: Namespace
 metadata:
   name: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 
 ---
@@ -41,8 +41,8 @@ metadata:
   name: eventing-controller
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -50,8 +50,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -67,8 +67,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -84,8 +84,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-source-observer
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -101,8 +101,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-sources-controller
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -118,8 +118,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-manipulator
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -151,8 +151,8 @@ metadata:
   name: pingsource-mt-adapter
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -160,8 +160,8 @@ kind: ClusterRoleBinding
 metadata:
   name: knative-eventing-pingsource-mt-adapter
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -193,8 +193,8 @@ metadata:
   name: eventing-webhook
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -202,8 +202,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-webhook
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -220,8 +220,8 @@ metadata:
   namespace: knative-eventing
   name: eventing-webhook
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -237,8 +237,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-webhook-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -254,8 +254,8 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-webhook-podspecable-binding
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -287,8 +287,8 @@ metadata:
   name: config-br-default-channel
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 data:
   channel-template-spec: |
@@ -316,8 +316,8 @@ metadata:
   name: config-br-defaults
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 data:
   # Configures the default for any Broker that does not specify a spec.config or Broker class.
@@ -354,8 +354,8 @@ metadata:
   name: default-ch-webhook
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 data:
   # Configuration for defaulting channels that do not specify CRD implementations.
@@ -389,10 +389,10 @@ metadata:
   name: config-ping-defaults
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
   annotations:
     knative.dev/example-checksum: "9185c153"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 data:
   _example: |
@@ -436,10 +436,10 @@ metadata:
   name: config-features
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 data:
   # ALPHA feature: The kreference-group allows you to use the Group field in KReferences.
@@ -483,7 +483,7 @@ metadata:
   name: config-kreference-mapping
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
   annotations:
@@ -532,8 +532,8 @@ metadata:
   name: config-leader-election
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "f7948630"
@@ -594,10 +594,10 @@ metadata:
   name: config-logging
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 data:
   # Common configuration for all Knative codebase
@@ -648,10 +648,10 @@ metadata:
   name: config-observability
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "f46cf09d"
@@ -725,8 +725,8 @@ metadata:
   name: config-sugar
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "62dfac6f"
@@ -783,10 +783,10 @@ metadata:
   name: config-tracing
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "0492ceb0"
@@ -841,10 +841,10 @@ metadata:
   name: eventing-controller
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/high-availability: "true"
     app.kubernetes.io/component: eventing-controller
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   selector:
@@ -854,9 +854,9 @@ spec:
     metadata:
       labels:
         app: eventing-controller
-        eventing.knative.dev/release: "v20221019-0fe923cd8"
+        eventing.knative.dev/release: "v20221020-98dfb5be7"
         app.kubernetes.io/component: eventing-controller
-        app.kubernetes.io/version: "20221019-0fe923cd8"
+        app.kubernetes.io/version: "20221020-98dfb5be7"
         app.kubernetes.io/name: knative-eventing
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
@@ -874,7 +874,7 @@ spec:
       containers:
         - name: eventing-controller
           terminationMessagePolicy: FallbackToLogsOnError
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller@sha256:0826d50456b43d1c3caaf4a84d650762671e39dd7d9f393260c074c70d1cbe92
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller@sha256:9715b6ef8ed2b6542488e9b085cc534582e0daf2d37f57b8a06cadf45c7d607a
           resources:
             requests:
               cpu: 100m
@@ -892,7 +892,7 @@ spec:
               value: knative.dev/eventing
             # APIServerSource
             - name: APISERVER_RA_IMAGE
-              value: gcr.io/knative-nightly/knative.dev/eventing/cmd/apiserver_receive_adapter@sha256:b2649ba6efd1b1d271977cad024299316b6ef07980028e8b8bd0666dba47db84
+              value: gcr.io/knative-nightly/knative.dev/eventing/cmd/apiserver_receive_adapter@sha256:54adda146e9295a01f06b67d279b7450a1bcb6518f63619b839e67ed7c253be2
             - name: POD_NAME
               valueFrom:
                 fieldRef:
@@ -961,9 +961,9 @@ metadata:
   name: pingsource-mt-adapter
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     app.kubernetes.io/component: pingsource-mt-adapter
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   # when set to 0 (and only 0) will be set to 1 when the first PingSource is created.
@@ -976,9 +976,9 @@ spec:
     metadata:
       labels:
         !!merge <<: *labels
-        eventing.knative.dev/release: "v20221019-0fe923cd8"
+        eventing.knative.dev/release: "v20221020-98dfb5be7"
         app.kubernetes.io/component: pingsource-mt-adapter
-        app.kubernetes.io/version: "20221019-0fe923cd8"
+        app.kubernetes.io/version: "20221020-98dfb5be7"
         app.kubernetes.io/name: knative-eventing
     spec:
       affinity:
@@ -992,7 +992,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: dispatcher
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/mtping@sha256:16bf80c1fb01404b40aac5fd2135e9f3d3ac7f68836e54f4b1fb135400dcba65
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/mtping@sha256:b7180d124d23a857e4ef6770e799357563b36f9c6814ef4614e911362206eb35
           env:
             - name: SYSTEM_NAMESPACE
               value: ''
@@ -1065,9 +1065,9 @@ metadata:
   name: eventing-webhook
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   scaleTargetRef:
@@ -1091,9 +1091,9 @@ metadata:
   name: eventing-webhook
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   minAvailable: 80%
@@ -1122,9 +1122,9 @@ metadata:
   name: eventing-webhook
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   selector:
@@ -1135,9 +1135,9 @@ spec:
     metadata:
       labels:
         !!merge <<: *labels
-        eventing.knative.dev/release: "v20221019-0fe923cd8"
+        eventing.knative.dev/release: "v20221020-98dfb5be7"
         app.kubernetes.io/component: eventing-webhook
-        app.kubernetes.io/version: "20221019-0fe923cd8"
+        app.kubernetes.io/version: "20221020-98dfb5be7"
         app.kubernetes.io/name: knative-eventing
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
@@ -1157,7 +1157,7 @@ spec:
           terminationMessagePolicy: FallbackToLogsOnError
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/webhook@sha256:05953a2dda3ea0af2c1492c437835fde7ca3a8549ad8e8bb84a5d95d0dc2eb61
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/webhook@sha256:ac021f502882b580d76f81126e3bc37eeb761bb942c9584b81c53bc24aa5c26b
           resources:
             requests:
               # taken from serving.
@@ -1228,10 +1228,10 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     role: eventing-webhook
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   name: eventing-webhook
   namespace: knative-eventing
@@ -1263,11 +1263,11 @@ kind: CustomResourceDefinition
 metadata:
   creationTimestamp: null
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schemas and descriptions
@@ -1479,10 +1479,10 @@ kind: CustomResourceDefinition
 metadata:
   name: brokers.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -1646,11 +1646,11 @@ kind: CustomResourceDefinition
 metadata:
   name: channels.messaging.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     messaging.knative.dev/subscribable: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -1921,11 +1921,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   name: containersources.sources.knative.dev
 spec:
@@ -2075,9 +2075,9 @@ kind: CustomResourceDefinition
 metadata:
   name: eventtypes.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -2204,10 +2204,10 @@ kind: CustomResourceDefinition
 metadata:
   name: parallels.flows.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -2459,11 +2459,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schemas and descriptions
@@ -2650,10 +2650,10 @@ kind: CustomResourceDefinition
 metadata:
   name: sequences.flows.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -2970,12 +2970,12 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     duck.knative.dev/binding: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   name: sinkbindings.sources.knative.dev
 spec:
@@ -3162,9 +3162,9 @@ kind: CustomResourceDefinition
 metadata:
   name: subscriptions.messaging.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -3374,9 +3374,9 @@ kind: CustomResourceDefinition
 metadata:
   name: triggers.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -3560,8 +3560,8 @@ kind: ClusterRole
 metadata:
   name: addressable-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -3574,9 +3574,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: service-addressable-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -3594,9 +3594,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: serving-addressable-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -3617,9 +3617,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: channel-addressable-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -3644,9 +3644,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: broker-addressable-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -3665,9 +3665,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: flows-addressable-resolver
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -3703,8 +3703,8 @@ kind: ClusterRole
 metadata:
   name: eventing-broker-filter
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -3730,8 +3730,8 @@ kind: ClusterRole
 metadata:
   name: eventing-broker-ingress
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -3748,8 +3748,8 @@ kind: ClusterRole
 metadata:
   name: eventing-config-reader
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -3782,8 +3782,8 @@ kind: ClusterRole
 metadata:
   name: channelable-manipulator
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -3796,9 +3796,9 @@ kind: ClusterRole
 metadata:
   name: meta-channelable-manipulator
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/channelable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "channelable-manipulator" role.
 rules:
@@ -3836,9 +3836,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-eventing-namespaced-admin
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["eventing.knative.dev"]
@@ -3850,9 +3850,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-messaging-namespaced-admin
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["messaging.knative.dev"]
@@ -3864,9 +3864,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-flows-namespaced-admin
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["flows.knative.dev"]
@@ -3878,9 +3878,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-sources-namespaced-admin
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["sources.knative.dev"]
@@ -3892,9 +3892,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-bindings-namespaced-admin
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["bindings.knative.dev"]
@@ -3907,8 +3907,8 @@ metadata:
   name: knative-eventing-namespaced-edit
   labels:
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["eventing.knative.dev", "messaging.knative.dev", "sources.knative.dev", "flows.knative.dev", "bindings.knative.dev"]
@@ -3921,8 +3921,8 @@ metadata:
   name: knative-eventing-namespaced-view
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["eventing.knative.dev", "messaging.knative.dev", "sources.knative.dev", "flows.knative.dev", "bindings.knative.dev"]
@@ -3949,8 +3949,8 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-controller
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -4085,8 +4085,8 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-pingsource-mt-adapter
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -4153,8 +4153,8 @@ kind: ClusterRole
 metadata:
   name: podspecable-binding
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -4167,9 +4167,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: builtin-podspecable-binding
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/podspecable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "podspecable-binding role.
 rules:
@@ -4215,8 +4215,8 @@ kind: ClusterRole
 metadata:
   name: source-observer
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -4229,9 +4229,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: eventing-sources-source-observer
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     duck.knative.dev/source: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "source-observer" role.
 rules:
@@ -4267,8 +4267,8 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-sources-controller
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -4354,8 +4354,8 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-webhook
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   # For watching logging configuration and getting certs.
@@ -4454,8 +4454,8 @@ metadata:
   namespace: knative-eventing
   name: knative-eventing-webhook
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 rules:
   # For manipulating certs into secrets.
@@ -4491,8 +4491,8 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
@@ -4529,8 +4529,8 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
@@ -4563,8 +4563,8 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: validation.webhook.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
@@ -4598,8 +4598,8 @@ metadata:
   name: eventing-webhook-certs
   namespace: knative-eventing
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 # The data is populated at install time.
 
@@ -4623,8 +4623,8 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: sinkbindings.webhook.sources.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
diff --git a/third_party/eventing-latest/eventing-crds.yaml b/third_party/eventing-latest/eventing-crds.yaml
index c032ef0e2..49ee8b136 100644
--- a/third_party/eventing-latest/eventing-crds.yaml
+++ b/third_party/eventing-latest/eventing-crds.yaml
@@ -17,11 +17,11 @@ kind: CustomResourceDefinition
 metadata:
   creationTimestamp: null
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schemas and descriptions
@@ -233,10 +233,10 @@ kind: CustomResourceDefinition
 metadata:
   name: brokers.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -400,11 +400,11 @@ kind: CustomResourceDefinition
 metadata:
   name: channels.messaging.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     messaging.knative.dev/subscribable: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -675,11 +675,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   name: containersources.sources.knative.dev
 spec:
@@ -829,9 +829,9 @@ kind: CustomResourceDefinition
 metadata:
   name: eventtypes.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -958,10 +958,10 @@ kind: CustomResourceDefinition
 metadata:
   name: parallels.flows.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -1213,11 +1213,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schemas and descriptions
@@ -1404,10 +1404,10 @@ kind: CustomResourceDefinition
 metadata:
   name: sequences.flows.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -1724,12 +1724,12 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     duck.knative.dev/binding: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
   name: sinkbindings.sources.knative.dev
 spec:
@@ -1916,9 +1916,9 @@ kind: CustomResourceDefinition
 metadata:
   name: subscriptions.messaging.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -2128,9 +2128,9 @@ kind: CustomResourceDefinition
 metadata:
   name: triggers.eventing.knative.dev
   labels:
-    eventing.knative.dev/release: "v20221019-0fe923cd8"
+    eventing.knative.dev/release: "v20221020-98dfb5be7"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20221019-0fe923cd8"
+    app.kubernetes.io/version: "20221020-98dfb5be7"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev