Repository: knative/serving
Pull request #13618 (2023-01-19 08:51:23)

Refactor autoscaler TestContext
This is a follow up to https://github.com/knative/serving/pull/13587

<!-- Please include the 'why' behind your changes if no issue exists -->
## Proposed Changes

* Reduce the number of parameters to [SetupSvc](https://github.com/knative/serving/compare/main...mgencur:serving-1:refactor_autoscaler_test?expand=1#diff-7ee6d6f89f5bc13c21578c9e4f10e9000770a3bb1759db3ce8ba9cacd9a94812R202) in autoscaling tests and making it more clear what parameters are passed
* Encapsulate Autoscaler parameters in its own type, better readability.
* Removing the testContext.logf as this is now redundant

**Release Note**

<!-- Enter your extended release note in the below block. If the PR requires
additional action from users switching to the new release, include the string
"action required". If no release note is required, write "NONE". -->

```release-note

```


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/13618#" title="Author self-approved">mgencur</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign chaodaig for approval by writing `/assign @chaodaig` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[test/OWNERS](https://github.com/knative/serving/blob/main/test/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["chaodaig"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
Base: **86.14**% // Head: **86.13**% // Decreases project coverage by **`-0.02%`** :warning:
> Coverage data is based on head [(`51d0ade`)](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) compared to base [(`6b7e09a`)](https://codecov.io/gh/knative/serving/commit/6b7e09ac25e8fa2a43f9af7acbbf216b8cb3a715?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).
> Patch has no changes to coverable lines.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main   #13618      +/-   ##
==========================================
- Coverage   86.14%   86.13%   -0.02%     
==========================================
  Files         197      197              
  Lines       14672    14672              
==========================================
- Hits        12639    12637       -2     
- Misses       1732     1733       +1     
- Partials      301      302       +1     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | Coverage Δ | |
|---|---|---|
| [pkg/autoscaler/statforwarder/processor.go](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2F1dG9zY2FsZXIvc3RhdGZvcndhcmRlci9wcm9jZXNzb3IuZ28=) | `88.00% <0.00%> (-6.00%)` | :arrow_down: |
| [pkg/autoscaler/statforwarder/forwarder.go](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2F1dG9zY2FsZXIvc3RhdGZvcndhcmRlci9mb3J3YXJkZXIuZ28=) | `90.66% <0.00%> (-5.34%)` | :arrow_down: |
| [pkg/autoscaler/statserver/server.go](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2F1dG9zY2FsZXIvc3RhdHNlcnZlci9zZXJ2ZXIuZ28=) | `77.37% <0.00%> (+1.45%)` | :arrow_up: |
| [pkg/reconciler/revision/reconcile\_resources.go](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvcmV2aXNpb24vcmVjb25jaWxlX3Jlc291cmNlcy5nbw==) | `68.87% <0.00%> (+1.98%)` | :arrow_up: |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)

</details>

[:umbrella: View full report at Codecov](https://codecov.io/gh/knative/serving/pull/13618?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).

knative-prow[bot]: @mgencur: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
istio-latest-no-mesh_serving_main | c0a2246561ef947042c5b378e5313db680689dac | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/13618/istio-latest-no-mesh_serving_main/1616003833190682624) | true | `/test istio-latest-no-mesh`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/pkg/apis/serving/k8s_validation.go b/pkg/apis/serving/k8s_validation.go
index 4a9606770..55ae1173f 100644
--- a/pkg/apis/serving/k8s_validation.go
+++ b/pkg/apis/serving/k8s_validation.go
@@ -341,6 +341,17 @@ func ValidatePodSpec(ctx context.Context, ps corev1.PodSpec) *apis.FieldError {
 
 	errs = errs.Also(ValidatePodSecurityContext(ctx, ps.SecurityContext).ViaField("securityContext"))
 
+	for i := range ps.Containers {
+		errs = errs.Also(
+			warnDefaultContainerSecurityContext(ctx, ps.SecurityContext, ps.Containers[i].SecurityContext).
+				ViaField("securityContext").ViaFieldIndex("containers", i))
+	}
+	for i := range ps.InitContainers {
+		errs = errs.Also(
+			warnDefaultContainerSecurityContext(ctx, ps.SecurityContext, ps.InitContainers[i].SecurityContext).
+				ViaField("securityContext").ViaFieldIndex("initContainers", i))
+	}
+
 	volumes, err := ValidateVolumes(ctx, ps.Volumes, AllMountedVolumes(append(ps.InitContainers, ps.Containers...)))
 	errs = errs.Also(err.ViaField("volumes"))
 
@@ -872,6 +883,59 @@ func ValidatePodSecurityContext(ctx context.Context, sc *corev1.PodSecurityConte
 	return errs
 }
 
+// warnDefaultContainerSecurityContext warns about Kubernetes default
+// SecurityContext values which are unset and thus insecure (i.e. the
+// "restricted" profile forbids these values). Because securityContext values
+// may also be set at the Pod level, the container-level settings need to be
+// considered alongside the Pod-level settings.
+//
+// Note that this **explicitly** does not warn on dangerous SecurityContext
+// settings, the purpose is to avoid accidentally-insecure settings, not to
+// block deliberate use of dangerous settings.
+func warnDefaultContainerSecurityContext(_ context.Context, psc *corev1.PodSecurityContext, sc *corev1.SecurityContext) *apis.FieldError {
+	if sc == nil {
+		sc = &corev1.SecurityContext{}
+	}
+	if psc == nil {
+		psc = &corev1.PodSecurityContext{}
+	}
+
+	insecureDefault := func(fieldPath string) *apis.FieldError {
+		return apis.ErrGeneric("Kubernetes default value is insecure, Knative may default this to secure in a future release", fieldPath).At(apis.WarningLevel)
+	}
+
+	var errs *apis.FieldError
+	if psc.RunAsNonRoot == nil && sc.RunAsNonRoot == nil {
+		errs = errs.Also(insecureDefault("runAsNonRoot"))
+	}
+
+	if sc.AllowPrivilegeEscalation == nil {
+		errs = errs.Also(insecureDefault("allowPrivilegeEscalation"))
+	}
+
+	if sc.SeccompProfile == nil && psc.SeccompProfile == nil {
+		errs = errs.Also(insecureDefault("seccompProfile"))
+	} else {
+		pscIsDefault := psc.SeccompProfile == nil || psc.SeccompProfile.Type == ""
+		scIsDefault := sc.SeccompProfile == nil || sc.SeccompProfile.Type == ""
+		if pscIsDefault && scIsDefault {
+			errs = errs.Also(insecureDefault("seccompProfile.type"))
+		}
+	}
+
+	if sc.Capabilities == nil {
+		errs = errs.Also(insecureDefault("capabilities"))
+	} else {
+		if sc.Capabilities.Drop == nil {
+			errs = errs.Also(insecureDefault("capabilities.drop"))
+		} else if len(sc.Capabilities.Drop) > 0 && sc.Capabilities.Drop[0] == "all" {
+			// Sometimes, people mis-spell "ALL" as "all", which does nothing.
+			errs = errs.Also(apis.ErrInvalidValue("all", "capabilities.drop", "Must be spelled as 'ALL'").At(apis.WarningLevel))
+		}
+	}
+	return errs
+}
+
 // This is attached to contexts as they are passed down through a user container
 // being validated.
 type userContainer struct{}
diff --git a/pkg/reconciler/domainmapping/resources/certificate.go b/pkg/reconciler/domainmapping/resources/certificate.go
index 58084b478..777ccbeb1 100644
--- a/pkg/reconciler/domainmapping/resources/certificate.go
+++ b/pkg/reconciler/domainmapping/resources/certificate.go
@@ -32,5 +32,5 @@ import (
 func MakeCertificate(dm *v1alpha1.DomainMapping, certClass string) *networkingv1alpha1.Certificate {
 	certName := kmeta.ChildName(dm.GetName(), "")
 	return routeresources.MakeCertificate(
-		dm, serving.DomainMappingUIDLabelKey, dm.Name, certName, certClass)
+		dm, serving.DomainMappingUIDLabelKey, dm.Name, certName, certClass, dm.Name)
 }
diff --git a/pkg/reconciler/route/resources/certificate.go b/pkg/reconciler/route/resources/certificate.go
index b514999e4..959ad17a8 100644
--- a/pkg/reconciler/route/resources/certificate.go
+++ b/pkg/reconciler/route/resources/certificate.go
@@ -34,7 +34,8 @@ import (
 // MakeCertificate creates a Certificate, inheriting the certClass
 // annotations from the owner, as well as the namespaces. If owner
 // does not have a certClass, use the provided `certClass` parameter.
-func MakeCertificate(owner kmeta.OwnerRefableAccessor, ownerLabelKey string, dnsName string, certName string, certClass string) *networkingv1alpha1.Certificate {
+// baseDomain is the top level domain for the cert. It should be a suffix of dnsName.
+func MakeCertificate(owner kmeta.OwnerRefableAccessor, ownerLabelKey string, dnsName string, certName string, certClass string, baseDomain string) *networkingv1alpha1.Certificate {
 	return &networkingv1alpha1.Certificate{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:            certName,
@@ -49,6 +50,7 @@ func MakeCertificate(owner kmeta.OwnerRefableAccessor, ownerLabelKey string, dns
 		},
 		Spec: networkingv1alpha1.CertificateSpec{
 			DNSNames:   []string{dnsName},
+			Domain:     baseDomain,
 			SecretName: certName,
 		},
 	}
@@ -57,8 +59,10 @@ func MakeCertificate(owner kmeta.OwnerRefableAccessor, ownerLabelKey string, dns
 // MakeCertificates creates an array of Certificate for the Route to request TLS certificates.
 // domainTagMap is an one-to-one mapping between domain and tag, for major domain (tag-less),
 // the value is an empty string
+// domain is the base domain to be used for the route. It should be a suffix of
+// the domains in domainTagMap
 // Returns one certificate for each domain
-func MakeCertificates(route *v1.Route, domainTagMap map[string]string, certClass string) []*networkingv1alpha1.Certificate {
+func MakeCertificates(route *v1.Route, domainTagMap map[string]string, certClass string, domain string) []*networkingv1alpha1.Certificate {
 	order := make(sort.StringSlice, 0, len(domainTagMap))
 	for dnsName := range domainTagMap {
 		order = append(order, dnsName)
@@ -78,7 +82,7 @@ func MakeCertificates(route *v1.Route, domainTagMap map[string]string, certClass
 		if tag != "" {
 			certName += fmt.Sprint("-", adler32.Checksum([]byte(tag)))
 		}
-		certs = append(certs, MakeCertificate(route, serving.RouteLabelKey, dnsName, certName, certClass))
+		certs = append(certs, MakeCertificate(route, serving.RouteLabelKey, dnsName, certName, certClass, domain))
 	}
 	return certs
 }
diff --git a/pkg/reconciler/route/route.go b/pkg/reconciler/route/route.go
index 3022c22c8..fdadcd0b6 100644
--- a/pkg/reconciler/route/route.go
+++ b/pkg/reconciler/route/route.go
@@ -209,8 +209,12 @@ func (c *Reconciler) tls(ctx context.Context, host string, r *v1.Route, traffic
 		return nil, nil, err
 	}
 
+	domainConfig := config.FromContext(ctx).Domain
+	rLabels := r.Labels
+	domain := domainConfig.LookupDomainForLabels(rLabels)
+
 	acmeChallenges := []netv1alpha1.HTTP01Challenge{}
-	desiredCerts := resources.MakeCertificates(r, domainToTagMap, certClass(ctx, r))
+	desiredCerts := resources.MakeCertificates(r, domainToTagMap, certClass(ctx, r), domain)
 	for _, desiredCert := range desiredCerts {
 		dnsNames := sets.NewString(desiredCert.Spec.DNSNames...)
 		// Look for a matching wildcard cert before provisioning a new one. This saves the


Test patch:
diff --git a/pkg/apis/serving/k8s_validation_test.go b/pkg/apis/serving/k8s_validation_test.go
index e09aaeed6..a6dc07407 100644
--- a/pkg/apis/serving/k8s_validation_test.go
+++ b/pkg/apis/serving/k8s_validation_test.go
@@ -173,10 +173,11 @@ func withPodSpecDNSConfigEnabled() configOption {
 
 func TestPodSpecValidation(t *testing.T) {
 	tests := []struct {
-		name    string
-		ps      corev1.PodSpec
-		cfgOpts []configOption
-		want    *apis.FieldError
+		name     string
+		ps       corev1.PodSpec
+		cfgOpts  []configOption
+		want     *apis.FieldError
+		errLevel apis.DiagnosticLevel
 	}{{
 		name: "valid",
 		ps: corev1.PodSpec{
@@ -625,6 +626,111 @@ func TestPodSpecValidation(t *testing.T) {
 				}},
 			}},
 		cfgOpts: []configOption{withPodSpecPersistentVolumeClaimEnabled(), withPodSpecPersistentVolumeWriteEnabled()},
+	}, {
+		name: "insecure security context default struct",
+		ps: corev1.PodSpec{
+			Containers: []corev1.Container{{
+				Image: "busybox",
+			}},
+		},
+		want: &apis.FieldError{
+			Message: "Kubernetes default value is insecure, Knative may default this to secure in a future release",
+			Paths: []string{
+				"containers[0].securityContext.allowPrivilegeEscalation",
+				"containers[0].securityContext.capabilities",
+				"containers[0].securityContext.runAsNonRoot",
+				"containers[0].securityContext.seccompProfile",
+			},
+			Level: apis.WarningLevel,
+		},
+		errLevel: apis.WarningLevel,
+	}, {
+		name: "insecure security context default values",
+		ps: corev1.PodSpec{
+			Containers: []corev1.Container{{
+				Image: "busybox",
+				SecurityContext: &corev1.SecurityContext{
+					Capabilities: &corev1.Capabilities{},
+				},
+			}},
+			SecurityContext: &corev1.PodSecurityContext{
+				SeccompProfile: &corev1.SeccompProfile{},
+			},
+		},
+		want: &apis.FieldError{
+			Message: "Kubernetes default value is insecure, Knative may default this to secure in a future release",
+			Paths: []string{
+				"containers[0].securityContext.allowPrivilegeEscalation",
+				"containers[0].securityContext.capabilities.drop",
+				"containers[0].securityContext.runAsNonRoot",
+				"containers[0].securityContext.seccompProfile.type",
+			},
+			Level: apis.WarningLevel,
+		},
+		errLevel: apis.WarningLevel,
+	}, {
+		// We don't warn about explicitly insecure values, because they were
+		// presumably chosen intentionally.
+		name: "explicitly dangerous security context values",
+		ps: corev1.PodSpec{
+			Containers: []corev1.Container{{
+				Image: "busybox",
+				SecurityContext: &corev1.SecurityContext{
+					AllowPrivilegeEscalation: ptr.Bool(true),
+					RunAsNonRoot:             ptr.Bool(false),
+					Capabilities: &corev1.Capabilities{
+						Drop: []corev1.Capability{},
+					},
+					SeccompProfile: &corev1.SeccompProfile{
+						Type: corev1.SeccompProfileTypeUnconfined,
+					},
+				},
+			}},
+		},
+		errLevel: apis.WarningLevel,
+	}, {
+		name: "explicitly dangerous pod security context values",
+		ps: corev1.PodSpec{
+			Containers: []corev1.Container{{
+				Image: "busybox",
+			}},
+			SecurityContext: &corev1.PodSecurityContext{
+				RunAsNonRoot: ptr.Bool(true),
+				SeccompProfile: &corev1.SeccompProfile{
+					Type: corev1.SeccompProfileTypeUnconfined,
+				},
+			},
+		},
+		want: &apis.FieldError{
+			Message: "Kubernetes default value is insecure, Knative may default this to secure in a future release",
+			Paths: []string{
+				"containers[0].securityContext.allowPrivilegeEscalation",
+				"containers[0].securityContext.capabilities",
+			},
+			Level: apis.WarningLevel,
+		},
+		errLevel: apis.WarningLevel,
+	}, {
+		name: "misspelled drop all doesn't drop ALL",
+		ps: corev1.PodSpec{
+			Containers: []corev1.Container{{
+				Image: "busybox",
+				SecurityContext: &corev1.SecurityContext{
+					AllowPrivilegeEscalation: ptr.Bool(false),
+					Capabilities: &corev1.Capabilities{
+						Drop: []corev1.Capability{"all"},
+					},
+				},
+			}},
+			SecurityContext: &corev1.PodSecurityContext{
+				RunAsNonRoot: ptr.Bool(true),
+				SeccompProfile: &corev1.SeccompProfile{
+					Type: corev1.SeccompProfileTypeRuntimeDefault,
+				},
+			},
+		},
+		want:     apis.ErrInvalidValue("all", "containers[0].securityContext.capabilities.drop", "Must be spelled as 'ALL'").At(apis.WarningLevel),
+		errLevel: apis.WarningLevel,
 	}}
 
 	for _, test := range tests {
@@ -638,6 +744,7 @@ func TestPodSpecValidation(t *testing.T) {
 				ctx = config.ToContext(ctx, cfg)
 			}
 			got := ValidatePodSpec(ctx, test.ps)
+			got = got.Filter(test.errLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidatePodSpec (-want, +got): \n%s", diff)
 			}
@@ -1018,6 +1125,7 @@ func TestPodSpecMultiContainerValidation(t *testing.T) {
 				ctx = config.ToContext(ctx, cfg)
 			}
 			got := ValidatePodSpec(ctx, test.ps)
+			got = got.Filter(apis.ErrorLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidatePodSpec (-want, +got): \n%s", diff)
 			}
@@ -1033,6 +1141,7 @@ func TestPodSpecFeatureValidation(t *testing.T) {
 		featureSpec corev1.PodSpec
 		cfgOpts     []configOption
 		err         *apis.FieldError
+		errLevel    apis.DiagnosticLevel
 	}{{
 		name: "Affinity",
 		featureSpec: corev1.PodSpec{
@@ -1234,6 +1343,7 @@ func TestPodSpecFeatureValidation(t *testing.T) {
 					}}
 				}
 				got := ValidatePodSpec(ctx, obj)
+				got = got.Filter(featureData.errLevel)
 				if diff := cmp.Diff(want.Error(), got.Error()); diff != "" {
 					t.Errorf("ValidatePodSpec (-want, +got): \n%s", diff)
 				}
@@ -1244,10 +1354,11 @@ func TestPodSpecFeatureValidation(t *testing.T) {
 
 func TestPodSpecFieldRefValidation(t *testing.T) {
 	tests := []struct {
-		name    string
-		ps      corev1.PodSpec
-		cfgOpts []configOption
-		want    *apis.FieldError
+		name     string
+		ps       corev1.PodSpec
+		cfgOpts  []configOption
+		want     *apis.FieldError
+		errLevel apis.DiagnosticLevel
 	}{{
 		name: "flag disabled: fieldRef not present",
 		ps: corev1.PodSpec{
@@ -1348,6 +1459,7 @@ func TestPodSpecFieldRefValidation(t *testing.T) {
 				ctx = config.ToContext(ctx, cfg)
 			}
 			got := ValidatePodSpec(ctx, test.ps)
+			got = got.Filter(test.errLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidatePodSpec (-want, +got): \n%s", diff)
 			}
@@ -1792,6 +1904,7 @@ func TestContainerValidation(t *testing.T) {
 			port, err := validateContainersPorts([]corev1.Container{test.c})
 
 			got := err.Also(ValidateContainer(ctx, test.c, test.volumes, port))
+			got = got.Filter(apis.ErrorLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidateContainer (-want, +got): \n%s", diff)
 			}
@@ -1885,6 +1998,7 @@ func TestInitContainerValidation(t *testing.T) {
 				ctx = config.ToContext(ctx, cfg)
 			}
 			got := validateInitContainer(ctx, test.c, test.volumes)
+			got = got.Filter(apis.ErrorLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidateInitContainer (-want, +got): \n%s", diff)
 			}
@@ -2307,10 +2421,11 @@ func getCommonContainerValidationTestCases() []containerValidationTestCase {
 
 func TestVolumeValidation(t *testing.T) {
 	tests := []struct {
-		name    string
-		v       corev1.Volume
-		want    *apis.FieldError
-		cfgOpts []configOption
+		name     string
+		v        corev1.Volume
+		want     *apis.FieldError
+		cfgOpts  []configOption
+		errLevel apis.DiagnosticLevel
 	}{{
 		name: "just name",
 		v: corev1.Volume{
@@ -2615,6 +2730,7 @@ func TestVolumeValidation(t *testing.T) {
 				ctx = config.ToContext(ctx, cfg)
 			}
 			got := validateVolume(ctx, test.v)
+			got = got.Filter(test.errLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("validateVolume (-want, +got): \n%s", diff)
 			}
@@ -2624,9 +2740,10 @@ func TestVolumeValidation(t *testing.T) {
 
 func TestObjectReferenceValidation(t *testing.T) {
 	tests := []struct {
-		name string
-		r    *corev1.ObjectReference
-		want *apis.FieldError
+		name     string
+		r        *corev1.ObjectReference
+		want     *apis.FieldError
+		errLevel apis.DiagnosticLevel
 	}{{
 		name: "nil",
 	}, {
@@ -2709,6 +2826,7 @@ func TestObjectReferenceValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := ValidateNamespacedObjectReference(test.r)
+			got = got.Filter(test.errLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidateNamespacedObjectReference (-want, +got): \n%s", diff)
 			}
@@ -2719,9 +2837,10 @@ func TestObjectReferenceValidation(t *testing.T) {
 func TestPodSpecSecurityContextValidation(t *testing.T) {
 	// Note the feature flag is always enabled on this test
 	tests := []struct {
-		name string
-		sc   *corev1.PodSecurityContext
-		want *apis.FieldError
+		name     string
+		sc       *corev1.PodSecurityContext
+		want     *apis.FieldError
+		errLevel apis.DiagnosticLevel
 	}{{
 		name: "nil",
 	}, {
@@ -2792,6 +2911,7 @@ func TestPodSpecSecurityContextValidation(t *testing.T) {
 
 		t.Run(test.name, func(t *testing.T) {
 			got := ValidatePodSecurityContext(ctx, test.sc)
+			got.Filter(test.errLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("ValidatePodSecurityContext(-want, +got): \n%s", diff)
 			}
diff --git a/pkg/apis/serving/v1/configuration_validation_test.go b/pkg/apis/serving/v1/configuration_validation_test.go
index 59c17e9f2..37bc27827 100644
--- a/pkg/apis/serving/v1/configuration_validation_test.go
+++ b/pkg/apis/serving/v1/configuration_validation_test.go
@@ -262,6 +262,7 @@ func TestConfigurationValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := test.c.Validate(context.Background())
+			got = got.Filter(apis.ErrorLevel)
 			if !cmp.Equal(test.want.Error(), got.Error()) {
 				t.Errorf("Validate (-want, +got) = %v",
 					cmp.Diff(test.want.Error(), got.Error()))
@@ -403,6 +404,7 @@ func TestConfigurationLabelValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := test.c.Validate(context.Background())
+			got = got.Filter(apis.ErrorLevel)
 			if !cmp.Equal(test.want.Error(), got.Error()) {
 				t.Errorf("Validate (-want, +got) = %v",
 					cmp.Diff(test.want.Error(), got.Error()))
@@ -585,6 +587,7 @@ func TestImmutableConfigurationFields(t *testing.T) {
 			ctx := context.Background()
 			ctx = apis.WithinUpdate(ctx, test.old)
 			got := test.new.Validate(ctx)
+			got = got.Filter(apis.ErrorLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("Validate (-want, +got) = %v\nwant: %v\ngot: %v",
 					diff, test.want, got)
@@ -692,6 +695,7 @@ func TestConfigurationSubresourceUpdate(t *testing.T) {
 			ctx := context.Background()
 			ctx = apis.WithinSubResourceUpdate(ctx, test.config, test.subresource)
 			got := test.config.Validate(ctx)
+			got = got.Filter(apis.ErrorLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Error("Validate (-want, +got) =", diff)
 			}
@@ -878,7 +882,7 @@ func TestConfigurationAnnotationUpdate(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			ctx := context.Background()
 			ctx = apis.WithinUpdate(ctx, test.prev)
-			if diff := cmp.Diff(test.want.Error(), test.this.Validate(ctx).Error()); diff != "" {
+			if diff := cmp.Diff(test.want.Error(), test.this.Validate(ctx).Filter(apis.ErrorLevel).Error()); diff != "" {
 				t.Error("Validate (-want, +got) =", diff)
 			}
 		})
diff --git a/pkg/apis/serving/v1/revision_validation_test.go b/pkg/apis/serving/v1/revision_validation_test.go
index 916662f60..ea42c2986 100644
--- a/pkg/apis/serving/v1/revision_validation_test.go
+++ b/pkg/apis/serving/v1/revision_validation_test.go
@@ -82,6 +82,7 @@ func TestRevisionValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := test.r.Validate(context.Background())
+			got = got.Filter(apis.ErrorLevel)
 			if got, want := got.Error(), test.want.Error(); !cmp.Equal(got, want) {
 				t.Errorf("Validate (-want, +got): \n%s", cmp.Diff(want, got))
 			}
@@ -238,6 +239,7 @@ func TestRevisionLabelAnnotationValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := test.r.Validate(context.Background())
+			got = got.Filter(apis.ErrorLevel)
 			if got, want := got.Error(), test.want.Error(); !cmp.Equal(got, want) {
 				t.Errorf("Validate (-want, +got): \n%s", cmp.Diff(want, got))
 			}
@@ -277,6 +279,7 @@ func TestContainerConcurrencyValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := serving.ValidateContainerConcurrency(context.Background(), &test.cc)
+			got = got.Filter(apis.ErrorLevel)
 			if got, want := got.Error(), test.want.Error(); !cmp.Equal(got, want) {
 				t.Errorf("Validate (-want, +got): \n%s", cmp.Diff(want, got))
 			}
@@ -482,6 +485,7 @@ func TestRevisionSpecValidation(t *testing.T) {
 				ctx = test.wc(ctx)
 			}
 			got := test.rs.Validate(ctx)
+			got = got.Filter(apis.ErrorLevel)
 			if got, want := got.Error(), test.want.Error(); !cmp.Equal(got, want) {
 				t.Errorf("Validate (-want, +got): \n%s", cmp.Diff(want, got))
 			}
@@ -769,6 +773,7 @@ func TestImmutableFields(t *testing.T) {
 				ctx = test.wc(ctx)
 			}
 			got := test.new.Validate(ctx)
+			got = got.Filter(apis.ErrorLevel)
 			if got, want := got.Error(), test.want.Error(); got != want {
 				t.Errorf("Validate got: %s, want: %s, diff:(-want, +got)=\n%v", got, want, cmp.Diff(got, want))
 			}
@@ -1070,6 +1075,7 @@ func TestRevisionTemplateSpecValidation(t *testing.T) {
 			})
 
 			got := test.rts.Validate(ctx)
+			got = got.Filter(apis.ErrorLevel)
 			if got, want := got.Error(), test.want.Error(); !cmp.Equal(got, want) {
 				t.Errorf("Validate (-want, +got):\n%s", cmp.Diff(want, got))
 			}
diff --git a/pkg/apis/serving/v1/service_validation_test.go b/pkg/apis/serving/v1/service_validation_test.go
index be855f03e..f4c1a0c2d 100644
--- a/pkg/apis/serving/v1/service_validation_test.go
+++ b/pkg/apis/serving/v1/service_validation_test.go
@@ -280,6 +280,7 @@ func TestServiceValidation(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got := test.r.Validate(context.Background())
+			got = got.Filter(apis.ErrorLevel)
 			if !cmp.Equal(test.wantErr.Error(), got.Error()) {
 				t.Errorf("Validate (-want, +got) = %v",
 					cmp.Diff(test.wantErr.Error(), got.Error()))
@@ -527,6 +528,7 @@ func TestImmutableServiceFields(t *testing.T) {
 			ctx := context.Background()
 			ctx = apis.WithinUpdate(ctx, test.old)
 			got := test.new.Validate(ctx)
+			got = got.Filter(apis.ErrorLevel)
 			if diff := cmp.Diff(test.want.Error(), got.Error()); diff != "" {
 				t.Errorf("Validate (-want, +got) = %v\nwant: %v\ngot: %v",
 					diff, test.want, got)
@@ -666,7 +668,7 @@ func TestServiceSubresourceUpdate(t *testing.T) {
 			ctx := context.Background()
 			ctx = apis.WithinUpdate(ctx, test.service)
 			ctx = apis.WithinSubResourceUpdate(ctx, test.service, test.subresource)
-			if diff := cmp.Diff(test.want.Error(), test.service.Validate(ctx).Error()); diff != "" {
+			if diff := cmp.Diff(test.want.Error(), test.service.Validate(ctx).Filter(apis.ErrorLevel).Error()); diff != "" {
 				t.Error("Validate (-want, +got) =", diff)
 			}
 		})
@@ -782,7 +784,7 @@ func TestServiceAnnotationUpdate(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			ctx := context.Background()
 			ctx = apis.WithinUpdate(ctx, test.prev)
-			if diff := cmp.Diff(test.want.Error(), test.this.Validate(ctx).Error()); diff != "" {
+			if diff := cmp.Diff(test.want.Error(), test.this.Validate(ctx).Filter(apis.ErrorLevel).Error()); diff != "" {
 				t.Error("Validate (-want, +got) =", diff)
 			}
 		})
diff --git a/pkg/reconciler/domainmapping/resources/certificate_test.go b/pkg/reconciler/domainmapping/resources/certificate_test.go
index d26ebd3c5..820c56e20 100644
--- a/pkg/reconciler/domainmapping/resources/certificate_test.go
+++ b/pkg/reconciler/domainmapping/resources/certificate_test.go
@@ -62,6 +62,7 @@ func TestMakeCertificate(t *testing.T) {
 				},
 			},
 			Spec: networkingv1alpha1.CertificateSpec{
+				Domain: "mapping.com",
 				DNSNames: []string{
 					"mapping.com",
 				},
@@ -99,6 +100,7 @@ func TestMakeCertificate(t *testing.T) {
 				},
 			},
 			Spec: networkingv1alpha1.CertificateSpec{
+				Domain: "mapping.com",
 				DNSNames: []string{
 					"mapping.com",
 				},
diff --git a/pkg/reconciler/domainmapping/table_test.go b/pkg/reconciler/domainmapping/table_test.go
index 2b4f9a0d8..c5e3911d1 100644
--- a/pkg/reconciler/domainmapping/table_test.go
+++ b/pkg/reconciler/domainmapping/table_test.go
@@ -969,6 +969,7 @@ func TestReconcileTLSEnabled(t *testing.T) {
 					},
 				},
 				Spec: netv1alpha1.CertificateSpec{
+					Domain:     "becomes.ready.run",
 					DNSNames:   []string{"becomes.ready.run"},
 					SecretName: "becomes.ready.run",
 				},
@@ -1115,6 +1116,7 @@ func TestReconcileTLSEnabled(t *testing.T) {
 					},
 				},
 				Spec: netv1alpha1.CertificateSpec{
+					Domain:     "challenged.com",
 					DNSNames:   []string{"challenged.com"},
 					SecretName: "challenged.com",
 				},
diff --git a/pkg/reconciler/route/resources/certificate_test.go b/pkg/reconciler/route/resources/certificate_test.go
index 9d0f7c1e4..ab86deb6d 100644
--- a/pkg/reconciler/route/resources/certificate_test.go
+++ b/pkg/reconciler/route/resources/certificate_test.go
@@ -37,7 +37,8 @@ var (
 		"v1.default.example.com":         "",
 		"v1-current.default.example.com": "current",
 	}
-	route = Route("default", "route", WithRouteUID("12345"))
+	domain = "example.com"
+	route  = Route("default", "route", WithRouteUID("12345"))
 )
 
 func TestMakeCertificates(t *testing.T) {
@@ -56,6 +57,7 @@ func TestMakeCertificates(t *testing.T) {
 			},
 			Spec: netv1alpha1.CertificateSpec{
 				DNSNames:   []string{"v1-current.default.example.com"},
+				Domain:     domain,
 				SecretName: "route-12345-200999684",
 			},
 		},
@@ -73,11 +75,12 @@ func TestMakeCertificates(t *testing.T) {
 			},
 			Spec: netv1alpha1.CertificateSpec{
 				DNSNames:   []string{"v1.default.example.com"},
+				Domain:     domain,
 				SecretName: "route-12345",
 			},
 		},
 	}
-	got := MakeCertificates(route, dnsNameTagMap, "foo-cert")
+	got := MakeCertificates(route, dnsNameTagMap, "foo-cert", domain)
 	if diff := cmp.Diff(want, got); diff != "" {
 		t.Error("MakeCertificate (-want, +got) =", diff)
 	}
@@ -101,6 +104,7 @@ func TestMakeCertificates_FilterLastAppliedAnno(t *testing.T) {
 			},
 			Spec: netv1alpha1.CertificateSpec{
 				DNSNames:   []string{"v1-current.default.example.com"},
+				Domain:     domain,
 				SecretName: "route-12345-200999684",
 			},
 		},
@@ -118,11 +122,12 @@ func TestMakeCertificates_FilterLastAppliedAnno(t *testing.T) {
 			},
 			Spec: netv1alpha1.CertificateSpec{
 				DNSNames:   []string{"v1.default.example.com"},
+				Domain:     domain,
 				SecretName: "route-12345",
 			},
 		},
 	}
-	got := MakeCertificates(orgRoute, dnsNameTagMap, "default-cert")
+	got := MakeCertificates(orgRoute, dnsNameTagMap, "default-cert", domain)
 	if diff := cmp.Diff(want, got); diff != "" {
 		t.Error("MakeCertificate (-want, +got) =", diff)
 	}
diff --git a/pkg/reconciler/route/table_test.go b/pkg/reconciler/route/table_test.go
index 279a5c6d9..eff5454be 100644
--- a/pkg/reconciler/route/table_test.go
+++ b/pkg/reconciler/route/table_test.go
@@ -2407,7 +2407,7 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 		},
 		WantCreates: []runtime.Object{
 			resources.MakeCertificates(Route("default", "becomes-ready", WithConfigTarget("config"), WithURL, WithRouteUID("12-34")),
-				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName)[0],
+				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName, "example.com")[0],
 			ingressWithTLS(
 				Route("default", "becomes-ready", WithConfigTarget("config"), WithURL,
 					WithRouteUID("12-34")),
@@ -2457,7 +2457,7 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 				WithConfigGeneration(1), WithLatestCreated("config-00001"), WithLatestReady("config-00001")),
 			rev("default", "config", 1, MarkRevisionReady, WithRevName("config-00001")),
 			certificateWithStatus(resources.MakeCertificates(Route("default", "becomes-ready", WithConfigTarget("config"), WithURL, WithRouteUID("12-34")),
-				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName)[0], readyCertStatus()),
+				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName, "example.com")[0], readyCertStatus()),
 		},
 		WantCreates: []runtime.Object{
 			ingressWithTLS(
@@ -2564,7 +2564,7 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 		},
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: certificateWithStatus(resources.MakeCertificates(Route("default", "becomes-ready", WithConfigTarget("config"), WithURL, WithRouteUID("12-34")),
-				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName)[0], readyCertStatus()),
+				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName, "example.com")[0], readyCertStatus()),
 		}},
 		WantStatusUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: Route("default", "becomes-ready", WithConfigTarget("config"),
@@ -2692,7 +2692,7 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 		},
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: certificateWithStatus(resources.MakeCertificates(Route("default", "becomes-ready", WithConfigTarget("config"), WithURL, WithRouteUID("12-34")),
-				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName)[0], readyCertStatus()),
+				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName, "example.com")[0], readyCertStatus()),
 		}},
 		WantStatusUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: Route("default", "becomes-ready", WithConfigTarget("config"),
@@ -2745,6 +2745,7 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 				},
 				Spec: netv1alpha1.CertificateSpec{
 					DNSNames:   []string{"becomes-ready.default.example.com"},
+					Domain:     "example.com", //Need this to pass, otherwise extra event updating the Cert with missing Domain will cause test to fail
 					SecretName: "route-12-34",
 				},
 				Status: netv1alpha1.CertificateStatus{
@@ -2914,7 +2915,7 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 		},
 		WantUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: certificateWithStatus(resources.MakeCertificates(Route("default", "becomes-ready", WithConfigTarget("config"), WithURL, WithRouteUID("12-34")),
-				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName)[0], notReadyCertStatus()),
+				map[string]string{"becomes-ready.default.example.com": ""}, netcfg.CertManagerCertificateClassName, "example.com")[0], notReadyCertStatus()),
 		}},
 		WantStatusUpdates: []clientgotesting.UpdateActionImpl{{
 			Object: Route("default", "becomes-ready", WithConfigTarget("config"),
diff --git a/test/e2e/autoscale.go b/test/e2e/autoscale.go
index a746b1a41..c000ed1ca 100644
--- a/test/e2e/autoscale.go
+++ b/test/e2e/autoscale.go
@@ -26,8 +26,6 @@ import (
 	"testing"
 	"time"
 
-	"knative.dev/pkg/test/logging"
-
 	"github.com/davecgh/go-spew/spew"
 	vegeta "github.com/tsenart/vegeta/v12/lib"
 	"golang.org/x/sync/errgroup"
@@ -61,14 +59,19 @@ const (
 
 // TestContext includes context for autoscaler testing.
 type TestContext struct {
-	t                 *testing.T
-	logf              logging.FormatLogger
-	clients           *test.Clients
-	names             *test.ResourceNames
-	resources         *v1test.ResourceObjects
-	targetUtilization float64
-	targetValue       int
-	metric            string
+	t          *testing.T
+	clients    *test.Clients
+	names      *test.ResourceNames
+	resources  *v1test.ResourceObjects
+	autoscaler *AutoscalerOptions
+}
+
+// AutoscalerOptions holds autoscaling parameters for knative service.
+type AutoscalerOptions struct {
+	Class             string
+	Metric            string
+	TargetUtilization float64
+	Target            int
 }
 
 // Clients returns the clients of the TestContext.
@@ -96,11 +99,6 @@ func (ctx *TestContext) SetNames(names *test.ResourceNames) {
 	ctx.names = names
 }
 
-// SetLogger sets the logger of the TestContext.
-func (ctx *TestContext) SetLogger(logf logging.FormatLogger) {
-	ctx.logf = logf
-}
-
 func getVegetaTarget(kubeClientset kubernetes.Interface, domain, endpointOverride string, resolvable bool, paramName string, paramValue int) (vegeta.Target, error) {
 	if resolvable {
 		return vegeta.Target{
@@ -142,7 +140,7 @@ func generateTraffic(
 	for {
 		select {
 		case <-stopChan:
-			ctx.logf("Stopping generateTraffic")
+			ctx.t.Logf("Stopping generateTraffic")
 			successRate := float64(1)
 			if totalRequests > 0 {
 				successRate = float64(successfulRequests) / float64(totalRequests)
@@ -155,8 +153,8 @@ func generateTraffic(
 		case res := <-results:
 			totalRequests++
 			if res.Code != http.StatusOK {
-				ctx.logf("Status = %d, want: 200", res.Code)
-				ctx.logf("URL: %s Start: %s End: %s Duration: %v Error: %s Body:\n%s",
+				ctx.t.Logf("Status = %d, want: 200", res.Code)
+				ctx.t.Logf("URL: %s Start: %s End: %s Duration: %v Error: %s Body:\n%s",
 					res.URL, res.Timestamp.Format(time.RFC3339), res.End().Format(time.RFC3339), res.Latency, res.Error, string(res.Body))
 				continue
 			}
@@ -177,7 +175,7 @@ func generateTrafficAtFixedConcurrency(ctx *TestContext, concurrency int, stopCh
 		return fmt.Errorf("error creating vegeta target: %w", err)
 	}
 
-	ctx.logf("Maintaining %d concurrent requests.", concurrency)
+	ctx.t.Logf("Maintaining %d concurrent requests.", concurrency)
 	return generateTraffic(ctx, attacker, pacer, stopChan, target)
 }
 
@@ -190,7 +188,7 @@ func generateTrafficAtFixedRPS(ctx *TestContext, rps int, stopChan chan struct{}
 		return fmt.Errorf("error creating vegeta target: %w", err)
 	}
 
-	ctx.logf("Maintaining %v RPS.", rps)
+	ctx.t.Logf("Maintaining %v RPS.", rps)
 	return generateTraffic(ctx, attacker, pacer, stopChan, target)
 }
 
@@ -201,7 +199,7 @@ func toPercentageString(f float64) string {
 // SetupSvc creates a new service, with given service options.
 // It returns a TestContext that has resources, K8s clients and other needed
 // data points.
-func SetupSvc(t *testing.T, class, metric string, target int, targetUtilization float64, topts test.Options, fopts ...rtesting.ServiceOption) *TestContext {
+func SetupSvc(t *testing.T, aopts *AutoscalerOptions, topts test.Options, fopts ...rtesting.ServiceOption) *TestContext {
 	t.Helper()
 	clients := test.Setup(t, topts)
 
@@ -213,17 +211,18 @@ func SetupSvc(t *testing.T, class, metric string, target int, targetUtilization
 	resources, err := v1test.CreateServiceReady(t, clients, names,
 		append([]rtesting.ServiceOption{
 			rtesting.WithConfigAnnotations(map[string]string{
-				autoscaling.ClassAnnotationKey:             class,
-				autoscaling.MetricAnnotationKey:            metric,
-				autoscaling.TargetAnnotationKey:            strconv.Itoa(target),
-				autoscaling.TargetUtilizationPercentageKey: toPercentageString(targetUtilization),
+				autoscaling.ClassAnnotationKey:             aopts.Class,
+				autoscaling.MetricAnnotationKey:            aopts.Metric,
+				autoscaling.TargetAnnotationKey:            strconv.Itoa(aopts.Target),
+				autoscaling.TargetUtilizationPercentageKey: toPercentageString(aopts.TargetUtilization),
 				// Reduce the amount of historical data we need before scaling down to account for
 				// the fact that the chaosduck will only let a bucket leader live for ~30s.  This
 				// value still allows the chaosduck to make us failover, but is low enough that we
 				// should not need to survive multiple rounds of chaos in order to scale a
 				// revision down.
 				autoscaling.WindowAnnotationKey: "30s",
-			}), rtesting.WithResourceRequirements(corev1.ResourceRequirements{
+			}),
+			rtesting.WithResourceRequirements(corev1.ResourceRequirements{
 				Requests: corev1.ResourceList{
 					corev1.ResourceCPU:    resource.MustParse("30m"),
 					corev1.ResourceMemory: resource.MustParse("20Mi"),
@@ -248,14 +247,11 @@ func SetupSvc(t *testing.T, class, metric string, target int, targetUtilization
 	}
 
 	return &TestContext{
-		t:                 t,
-		logf:              t.Logf,
-		clients:           clients,
-		names:             names,
-		resources:         resources,
-		targetUtilization: targetUtilization,
-		targetValue:       target,
-		metric:            metric,
+		t:          t,
+		clients:    clients,
+		names:      names,
+		resources:  resources,
+		autoscaler: aopts,
 	}
 }
 
@@ -266,7 +262,7 @@ func assertScaleDown(ctx *TestContext) {
 	}
 
 	// Account for the case where scaling up uses all available pods.
-	ctx.logf("Wait for all pods to terminate.")
+	ctx.t.Logf("Wait for all pods to terminate.")
 
 	if err := pkgTest.WaitForPodListState(
 		context.Background(),
@@ -285,12 +281,12 @@ func assertScaleDown(ctx *TestContext) {
 		ctx.t.Fatalf("Waiting for Pod.List to have no non-Evicted pods of %q: %v", deploymentName, err)
 	}
 
-	ctx.logf("The Revision should remain ready after scaling to zero.")
+	ctx.t.Logf("The Revision should remain ready after scaling to zero.")
 	if err := v1test.CheckRevisionState(ctx.clients.ServingClient, ctx.names.Revision, v1test.IsRevisionReady); err != nil {
 		ctx.t.Fatalf("The Revision %s did not stay Ready after scaling down to zero: %v", ctx.names.Revision, err)
 	}
 
-	ctx.logf("Scaled down.")
+	ctx.t.Logf("Scaled down.")
 }
 
 func numberOfReadyPods(ctx *TestContext) (float64, *appsv1.Deployment, error) {
@@ -337,7 +333,7 @@ func checkPodScale(ctx *TestContext, targetPods, minPods, maxPods float64, done
 			}
 
 			mes := fmt.Sprintf("revision %q #replicas: %v, want at least: %v", ctx.resources.Revision.Name, got, minPods)
-			ctx.logf(mes)
+			ctx.t.Logf(mes)
 			// verify that the number of pods doesn't go down while we are scaling up.
 			if got < minPods {
 				return fmt.Errorf("interim scale didn't fulfill constraints: %s\ndeployment state: %s", mes, spew.Sdump(d))
@@ -345,7 +341,7 @@ func checkPodScale(ctx *TestContext, targetPods, minPods, maxPods float64, done
 			// A quick test succeeds when the number of pods scales up to `targetPods`
 			// (and, as an extra check, no more than `maxPods`).
 			if quick && got >= targetPods && got <= maxPods {
-				ctx.logf("Quick Mode: got %v >= %v", got, targetPods)
+				ctx.t.Logf("Quick Mode: got %v >= %v", got, targetPods)
 				return nil
 			}
 			if minPods < targetPods-1 {
@@ -369,7 +365,7 @@ func checkPodScale(ctx *TestContext, targetPods, minPods, maxPods float64, done
 			}
 
 			mes := fmt.Sprintf("revision %q #replicas: %v, want between [%v, %v]", ctx.resources.Revision.Name, got, targetPods-1, maxPods)
-			ctx.logf(mes)
+			ctx.t.Logf(mes)
 			if got < targetPods-1 || got > maxPods {
 				return fmt.Errorf("final scale didn't fulfill constraints: %s\ndeployment state: %s", mes, spew.Sdump(d))
 			}
@@ -399,17 +395,17 @@ func AutoscaleUpToNumPods(ctx *TestContext, curPods, targetPods float64, done <-
 	ctx.t.Helper()
 	// Relax the bounds to reduce the flakiness caused by sampling in the autoscaling algorithm.
 	// Also adjust the values by the target utilization values.
-	minPods := math.Floor(curPods/ctx.targetUtilization) - 1
-	maxPods := math.Ceil(math.Ceil(targetPods/ctx.targetUtilization) * 1.1)
+	minPods := math.Floor(curPods/ctx.autoscaler.TargetUtilization) - 1
+	maxPods := math.Ceil(math.Ceil(targetPods/ctx.autoscaler.TargetUtilization) * 1.1)
 
 	stopChan := make(chan struct{})
 	var grp errgroup.Group
 	grp.Go(func() error {
-		switch ctx.metric {
+		switch ctx.autoscaler.Metric {
 		case autoscaling.RPS:
-			return generateTrafficAtFixedRPS(ctx, int(targetPods*float64(ctx.targetValue)), stopChan)
+			return generateTrafficAtFixedRPS(ctx, int(targetPods*float64(ctx.autoscaler.Target)), stopChan)
 		default:
-			return generateTrafficAtFixedConcurrency(ctx, int(targetPods*float64(ctx.targetValue)), stopChan)
+			return generateTrafficAtFixedConcurrency(ctx, int(targetPods*float64(ctx.autoscaler.Target)), stopChan)
 		}
 	})
 
diff --git a/test/e2e/autoscale_hpa_test.go b/test/e2e/autoscale_hpa_test.go
index 8e7a6670d..d5a81e478 100644
--- a/test/e2e/autoscale_hpa_test.go
+++ b/test/e2e/autoscale_hpa_test.go
@@ -128,13 +128,14 @@ func setupHPASvc(t *testing.T, metric string, target int) *TestContext {
 	}
 
 	return &TestContext{
-		t:           t,
-		logf:        t.Logf,
-		clients:     clients,
-		names:       names,
-		resources:   resources,
-		targetValue: target,
-		metric:      metric,
+		t:         t,
+		clients:   clients,
+		names:     names,
+		resources: resources,
+		autoscaler: &AutoscalerOptions{
+			Metric: metric,
+			Target: target,
+		},
 	}
 }
 
@@ -188,7 +189,7 @@ func generateTrafficAtFixedConcurrencyWithLoad(ctx *TestContext, concurrency int
 		return fmt.Errorf("error creating vegeta target: %w", err)
 	}
 
-	ctx.logf("Maintaining %d concurrent requests.", concurrency)
+	ctx.t.Logf("Maintaining %d concurrent requests.", concurrency)
 	return generateTraffic(ctx, attacker, pacer, stopChan, target)
 }
 
@@ -197,7 +198,7 @@ func assertScaleDownToOne(ctx *TestContext) {
 	if err := waitForScaleToOne(ctx.t, deploymentName, ctx.clients); err != nil {
 		ctx.t.Fatalf("Unable to observe the Deployment named %s scaling down: %v", deploymentName, err)
 	}
-	ctx.logf("Wait for all pods to terminate.")
+	ctx.t.Logf("Wait for all pods to terminate.")
 
 	if err := pkgTest.WaitForPodListState(
 		context.Background(),
@@ -212,12 +213,12 @@ func assertScaleDownToOne(ctx *TestContext) {
 		ctx.t.Fatalf("Waiting for Pod.List to have no non-Evicted pods of %q: %v", deploymentName, err)
 	}
 
-	ctx.logf("The Revision should remain ready after scaling to one.")
+	ctx.t.Logf("The Revision should remain ready after scaling to one.")
 	if err := v1test.CheckRevisionState(ctx.clients.ServingClient, ctx.names.Revision, v1test.IsRevisionReady); err != nil {
 		ctx.t.Fatalf("The Revision %s did not stay Ready after scaling down to one: %v", ctx.names.Revision, err)
 	}
 
-	ctx.logf("Scaled down.")
+	ctx.t.Logf("Scaled down.")
 }
 
 func getDepPods(nsPods []corev1.Pod, deploymentName string) []corev1.Pod {
diff --git a/test/e2e/autoscale_test.go b/test/e2e/autoscale_test.go
index b32c524dc..1fa4f4cab 100644
--- a/test/e2e/autoscale_test.go
+++ b/test/e2e/autoscale_test.go
@@ -50,7 +50,14 @@ func TestAutoscaleUpDownUp(t *testing.T) {
 		algo := algo
 		t.Run("aggregation-"+algo, func(t *testing.T) {
 			t.Parallel()
-			ctx := SetupSvc(t, autoscaling.KPA, autoscaling.Concurrency, containerConcurrency, targetUtilization, test.Options{},
+			ctx := SetupSvc(t,
+				&AutoscalerOptions{
+					Class:             autoscaling.KPA,
+					Metric:            autoscaling.Concurrency,
+					Target:            containerConcurrency,
+					TargetUtilization: targetUtilization,
+				},
+				test.Options{},
 				rtesting.WithConfigAnnotations(map[string]string{
 					autoscaling.MetricAggregationAlgorithmKey: algo,
 				}))
@@ -81,7 +88,15 @@ func runAutoscaleUpCountPods(t *testing.T, class, metric string) {
 		target = rpsTarget
 	}
 
-	ctx := SetupSvc(t, class, metric, target, targetUtilization, test.Options{})
+	ctx := SetupSvc(t,
+		&AutoscalerOptions{
+			Class:             class,
+			Metric:            metric,
+			Target:            target,
+			TargetUtilization: targetUtilization,
+		},
+		test.Options{})
+
 	test.EnsureTearDown(t, ctx.Clients(), ctx.Names())
 
 	ctx.t.Log("The autoscaler spins up additional replicas when traffic increases.")
@@ -115,7 +130,14 @@ func TestAutoscaleSustaining(t *testing.T) {
 			// as long as the traffic sustains, despite whether it is switching modes between
 			// normal and panic.
 
-			ctx := SetupSvc(t, autoscaling.KPA, autoscaling.Concurrency, containerConcurrency, targetUtilization, test.Options{},
+			ctx := SetupSvc(t,
+				&AutoscalerOptions{
+					Class:             autoscaling.KPA,
+					Metric:            autoscaling.Concurrency,
+					Target:            containerConcurrency,
+					TargetUtilization: targetUtilization,
+				},
+				test.Options{},
 				rtesting.WithConfigAnnotations(map[string]string{
 					autoscaling.MetricAggregationAlgorithmKey: algo,
 				}))
@@ -134,7 +156,14 @@ func TestTargetBurstCapacity(t *testing.T) {
 	// Activator from the request path.
 	t.Parallel()
 
-	ctx := SetupSvc(t, autoscaling.KPA, autoscaling.Concurrency, 10 /* target concurrency*/, targetUtilization, test.Options{},
+	ctx := SetupSvc(t,
+		&AutoscalerOptions{
+			Class:             autoscaling.KPA,
+			Metric:            autoscaling.Concurrency,
+			Target:            10,
+			TargetUtilization: targetUtilization,
+		},
+		test.Options{},
 		rtesting.WithConfigAnnotations(map[string]string{
 			autoscaling.TargetBurstCapacityKey:                "7",
 			autoscaling.PanicThresholdPercentageAnnotationKey: "200", // makes panicking rare
@@ -209,7 +238,14 @@ func TestTargetBurstCapacity(t *testing.T) {
 func TestTargetBurstCapacityMinusOne(t *testing.T) {
 	t.Parallel()
 
-	ctx := SetupSvc(t, autoscaling.KPA, autoscaling.Concurrency, 10 /* target concurrency*/, targetUtilization, test.Options{},
+	ctx := SetupSvc(t,
+		&AutoscalerOptions{
+			Class:             autoscaling.KPA,
+			Metric:            autoscaling.Concurrency,
+			Target:            10,
+			TargetUtilization: targetUtilization,
+		},
+		test.Options{},
 		rtesting.WithConfigAnnotations(map[string]string{
 			autoscaling.TargetBurstCapacityKey: "-1",
 		}))
@@ -236,7 +272,14 @@ func TestTargetBurstCapacityMinusOne(t *testing.T) {
 func TestTargetBurstCapacityZero(t *testing.T) {
 	t.Parallel()
 
-	ctx := SetupSvc(t, autoscaling.KPA, autoscaling.Concurrency, 10 /* target concurrency*/, targetUtilization, test.Options{},
+	ctx := SetupSvc(t,
+		&AutoscalerOptions{
+			Class:             autoscaling.KPA,
+			Metric:            autoscaling.Concurrency,
+			Target:            10,
+			TargetUtilization: targetUtilization,
+		},
+		test.Options{},
 		rtesting.WithConfigAnnotations(map[string]string{
 			autoscaling.TargetBurstCapacityKey: "0",
 			autoscaling.WindowAnnotationKey:    "10s", // scale faster
@@ -267,7 +310,14 @@ func TestTargetBurstCapacityZero(t *testing.T) {
 func TestFastScaleToZero(t *testing.T) {
 	t.Parallel()
 
-	ctx := SetupSvc(t, autoscaling.KPA, autoscaling.Concurrency, containerConcurrency, targetUtilization, test.Options{},
+	ctx := SetupSvc(t,
+		&AutoscalerOptions{
+			Class:             autoscaling.KPA,
+			Metric:            autoscaling.Concurrency,
+			Target:            containerConcurrency,
+			TargetUtilization: targetUtilization,
+		},
+		test.Options{},
 		rtesting.WithConfigAnnotations(map[string]string{
 			autoscaling.TargetBurstCapacityKey: "-1",
 			autoscaling.WindowAnnotationKey:    autoscaling.WindowMin.String(),
diff --git a/test/e2e/grpc_test.go b/test/e2e/grpc_test.go
index cab0aa22d..80e5856b2 100644
--- a/test/e2e/grpc_test.go
+++ b/test/e2e/grpc_test.go
@@ -116,7 +116,6 @@ func autoscaleTest(ctx *TestContext, host, domain string) {
 	ctx.t.Helper()
 	ctx.t.Logf("Connecting to grpc-ping using host %q and authority %q", host, domain)
 
-	ctx.targetUtilization = targetUtilization
 	assertGRPCAutoscaleUpToNumPods(ctx, 1, 2, 60*time.Second, host, domain)
 	assertScaleDown(ctx)
 	assertGRPCAutoscaleUpToNumPods(ctx, 0, 2, 60*time.Second, host, domain)
@@ -139,8 +138,6 @@ func loadBalancingTest(ctx *TestContext, host, domain string) {
 		timer       = time.Tick(1 * time.Second)
 	)
 
-	ctx.targetUtilization = targetUtilization
-
 	countKeys := func() int {
 		count := 0
 		uniqueHosts.Range(func(k, v interface{}) bool {
@@ -251,14 +248,14 @@ func assertGRPCAutoscaleUpToNumPods(ctx *TestContext, curPods, targetPods float6
 	// Relax the bounds to reduce the flakiness caused by sampling in the autoscaling algorithm.
 	// Also adjust the values by the target utilization values.
 
-	minPods := math.Floor(curPods/ctx.targetUtilization) - 1
-	maxPods := math.Ceil(targetPods/ctx.targetUtilization) + 1
+	minPods := math.Floor(curPods/ctx.autoscaler.TargetUtilization) - 1
+	maxPods := math.Ceil(targetPods/ctx.autoscaler.TargetUtilization) + 1
 
 	stopChan := make(chan struct{})
 	var grp errgroup.Group
 
 	grp.Go(func() error {
-		return generateGRPCTraffic(ctx, int(targetPods*grpcContainerConcurrency), host, domain, stopChan)
+		return generateGRPCTraffic(ctx, int(targetPods*float64(ctx.autoscaler.Target)), host, domain, stopChan)
 	})
 
 	grp.Go(func() error {
@@ -383,7 +380,6 @@ func testGRPC(t *testing.T, f grpcTest, fopts ...rtesting.ServiceOption) {
 
 	f(&TestContext{
 		t:         t,
-		logf:      t.Logf,
 		clients:   clients,
 		names:     names,
 		resources: resources,
@@ -427,14 +423,18 @@ func TestGRPCStreamingPingViaActivator(t *testing.T) {
 }
 
 func TestGRPCAutoscaleUpDownUp(t *testing.T) {
+	aOpts := &AutoscalerOptions{
+		TargetUtilization: targetUtilization,
+		Target:            grpcContainerConcurrency,
+	}
 	testGRPC(t,
 		func(ctx *TestContext, host, domain string) {
+			ctx.autoscaler = aOpts
 			autoscaleTest(ctx, host, domain)
-
 		},
 		rtesting.WithConfigAnnotations(map[string]string{
-			autoscaling.TargetUtilizationPercentageKey: toPercentageString(targetUtilization),
-			autoscaling.TargetAnnotationKey:            strconv.Itoa(grpcContainerConcurrency),
+			autoscaling.TargetUtilizationPercentageKey: toPercentageString(aOpts.TargetUtilization),
+			autoscaling.TargetAnnotationKey:            strconv.Itoa(aOpts.Target),
 			autoscaling.TargetBurstCapacityKey:         "-1",
 			autoscaling.WindowAnnotationKey:            "10s",
 		}),
@@ -446,13 +446,18 @@ func TestGRPCAutoscaleUpDownUp(t *testing.T) {
 }
 
 func TestGRPCLoadBalancing(t *testing.T) {
+	aOpts := &AutoscalerOptions{
+		TargetUtilization: targetUtilization,
+		Target:            grpcContainerConcurrency,
+	}
 	testGRPC(t,
 		func(ctx *TestContext, host, domain string) {
+			ctx.autoscaler = aOpts
 			loadBalancingTest(ctx, host, domain)
 		},
 		rtesting.WithConfigAnnotations(map[string]string{
-			autoscaling.TargetUtilizationPercentageKey: toPercentageString(targetUtilization),
-			autoscaling.TargetAnnotationKey:            strconv.Itoa(grpcContainerConcurrency),
+			autoscaling.TargetUtilizationPercentageKey: toPercentageString(aOpts.TargetUtilization),
+			autoscaling.TargetAnnotationKey:            strconv.Itoa(aOpts.Target),
 			autoscaling.MinScaleAnnotationKey:          strconv.Itoa(grpcMinScale),
 			autoscaling.TargetBurstCapacityKey:         "-1",
 		}),
diff --git a/test/e2e/service_to_service_test.go b/test/e2e/service_to_service_test.go
index 3ebc8609f..5787bcac4 100644
--- a/test/e2e/service_to_service_test.go
+++ b/test/e2e/service_to_service_test.go
@@ -273,7 +273,6 @@ func testSvcToSvcCallViaActivator(t *testing.T, clients *test.Clients, injectA b
 	// Wait for the activator endpoints to equalize.
 	if err := waitForActivatorEndpoints(&TestContext{
 		t:         t,
-		logf:      t.Logf,
 		resources: resources,
 		clients:   clients,
 	}); err != nil {
diff --git a/test/e2e/websocket_test.go b/test/e2e/websocket_test.go
index d6396cad4..e242b1b8f 100644
--- a/test/e2e/websocket_test.go
+++ b/test/e2e/websocket_test.go
@@ -149,7 +149,6 @@ func TestWebSocketViaActivator(t *testing.T) {
 	// Wait for the activator endpoints to equalize.
 	if err := waitForActivatorEndpoints(&TestContext{
 		t:         t,
-		logf:      t.Logf,
 		resources: resources,
 		clients:   clients,
 	}); err != nil {
diff --git a/test/ha/autoscaler_test.go b/test/ha/autoscaler_test.go
index 793dd417f..82b771d5a 100644
--- a/test/ha/autoscaler_test.go
+++ b/test/ha/autoscaler_test.go
@@ -47,7 +47,14 @@ const (
 )
 
 func TestAutoscalerHA(t *testing.T) {
-	ctx := e2e.SetupSvc(t, autoscaling.KPA, autoscaling.RPS, target, targetUtilization, test.Options{},
+	ctx := e2e.SetupSvc(t,
+		&e2e.AutoscalerOptions{
+			Class:             autoscaling.KPA,
+			Metric:            autoscaling.RPS,
+			Target:            target,
+			TargetUtilization: targetUtilization,
+		},
+		test.Options{},
 		rtesting.WithConfigAnnotations(map[string]string{
 			autoscaling.WindowAnnotationKey:    autoscaling.WindowMin.String(), // Make sure we scale to zero quickly.
 			autoscaling.TargetBurstCapacityKey: "-1",
diff --git a/test/upgrade/autoscaler.go b/test/upgrade/autoscaler.go
index 0bfa066a5..9cd5784ad 100644
--- a/test/upgrade/autoscaler.go
+++ b/test/upgrade/autoscaler.go
@@ -46,7 +46,13 @@ func AutoscaleSustainingTest() pkgupgrade.BackgroundOperation {
 	return pkgupgrade.NewBackgroundVerification("AutoscaleSustainingTest",
 		// Setup
 		func(c pkgupgrade.Context) {
-			ctx = e2e.SetupSvc(c.T, autoscaling.KPA, autoscaling.Concurrency, containerConcurrency, targetUtilization,
+			ctx = e2e.SetupSvc(c.T,
+				&e2e.AutoscalerOptions{
+					Class:             autoscaling.KPA,
+					Metric:            autoscaling.Concurrency,
+					Target:            containerConcurrency,
+					TargetUtilization: targetUtilization,
+				},
 				test.Options{DisableLogStream: true},
 				rtesting.WithServiceName("autoscale-sustaining"),
 				rtesting.WithConfigAnnotations(map[string]string{
@@ -84,7 +90,13 @@ func AutoscaleSustainingWithTBCTest() pkgupgrade.BackgroundOperation {
 	return pkgupgrade.NewBackgroundVerification("AutoscaleSustainingWithTBCTest",
 		// Setup
 		func(c pkgupgrade.Context) {
-			ctx = e2e.SetupSvc(c.T, autoscaling.KPA, autoscaling.Concurrency, containerConcurrency, targetUtilization,
+			ctx = e2e.SetupSvc(c.T,
+				&e2e.AutoscalerOptions{
+					Class:             autoscaling.KPA,
+					Metric:            autoscaling.Concurrency,
+					Target:            containerConcurrency,
+					TargetUtilization: targetUtilization,
+				},
 				test.Options{DisableLogStream: true},
 				rtesting.WithServiceName("autoscale-sus-tbc"),
 				rtesting.WithConfigAnnotations(map[string]string{
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 4ccf2e7a2..b22ab1965 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,7 +19,7 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
@@ -52,7 +52,7 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
@@ -93,7 +93,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 
@@ -119,7 +119,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 data:
@@ -168,7 +168,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -182,7 +182,7 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230116-93414b3a"
+        app.kubernetes.io/version: "20230120-9843fa01"
         app.kubernetes.io/name: knative-serving
     spec:
       serviceAccountName: controller
@@ -190,7 +190,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:050692e03cf5a106b7c733a7804a148b15e669d9852e4877a2e00b90e5be4755
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:3d2048981550a706a8203b53c1e2f7d98b76629f6aa86cc89b5ddb0a0b3dc2a3
           resources:
             requests:
               cpu: 30m
@@ -229,7 +229,7 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
@@ -268,7 +268,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -283,7 +283,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230116-93414b3a"
+        app.kubernetes.io/version: "20230120-9843fa01"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
     spec:
@@ -292,7 +292,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:3a93429b2c34aca62a907a84118339a837360ed92aca82de9de0b5086d3cd9df
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:cc144218d76b56101ec29f453416fcbd87da34b2c29f0823a8f7486913c2be1a
           resources:
             requests:
               cpu: 20m
@@ -314,6 +314,10 @@ spec:
               value: knative.dev/net-certmanager
             - name: WEBHOOK_NAME
               value: net-certmanager-webhook
+            # If you change WEBHOOK_PORT, you will also need to change the
+            # containerPort "https-webhook" to the same value.
+            - name: WEBHOOK_PORT
+              value: "8443"
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -352,7 +356,7 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230116-93414b3a"
+    app.kubernetes.io/version: "20230120-9843fa01"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -360,13 +364,13 @@ spec:
     # Define metrics and profiling for them to be accessible within service meshes.
     - name: http-metrics
       port: 9090
-      targetPort: 9090
+      targetPort: metrics
     - name: http-profiling
       port: 8008
-      targetPort: 8008
+      targetPort: profiling
     - name: https-webhook
       port: 443
-      targetPort: 8443
+      targetPort: https-webhook
   selector:
     app: net-certmanager-webhook
 
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 9c1df38da..3240a7a04 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230117-9a671deb"
+    app.kubernetes.io/version: "20230120-9d028044"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,7 +38,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230117-9a671deb"
+    app.kubernetes.io/version: "20230120-9d028044"
 data:
   _example: |
     ################################
@@ -95,7 +95,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230117-9a671deb"
+    app.kubernetes.io/version: "20230120-9d028044"
 spec:
   replicas: 1
   selector:
@@ -107,14 +107,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230117-9a671deb"
+        app.kubernetes.io/version: "20230120-9d028044"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:54de49c6e0ccb2f76883a9f3622d98887abf22db4e00e2a02a9ef2f99a2e90b9
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:7a53775b1a5611fb92e02665308d484c05e8c1b88135ef832a4ee382a7367499
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/gateway-api-latest/istio-gateway.yaml b/third_party/gateway-api-latest/istio-gateway.yaml
index 4f5b06631..a74923664 100644
--- a/third_party/gateway-api-latest/istio-gateway.yaml
+++ b/third_party/gateway-api-latest/istio-gateway.yaml
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230118-3090431d"
+    app.kubernetes.io/version: "20230120-e4a469ef"
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
   type: ClusterIP
diff --git a/third_party/gateway-api-latest/net-gateway-api.yaml b/third_party/gateway-api-latest/net-gateway-api.yaml
index 703320626..d5660461a 100644
--- a/third_party/gateway-api-latest/net-gateway-api.yaml
+++ b/third_party/gateway-api-latest/net-gateway-api.yaml
@@ -5204,7 +5204,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230118-3090431d"
+    app.kubernetes.io/version: "20230120-e4a469ef"
 aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
@@ -5220,7 +5220,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230118-3090431d"
+    app.kubernetes.io/version: "20230120-e4a469ef"
 rules:
   - apiGroups: ["gateway.networking.k8s.io"]
     resources: ["httproutes", "referencegrants", "referencepolicies"]
@@ -5253,7 +5253,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230118-3090431d"
+    app.kubernetes.io/version: "20230120-e4a469ef"
 data:
   _example: |
     ################################
@@ -5307,7 +5307,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
-    app.kubernetes.io/version: "20230118-3090431d"
+    app.kubernetes.io/version: "20230120-e4a469ef"
     app.kubernetes.io/name: knative-serving
 spec:
   replicas: 1
@@ -5334,7 +5334,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:3ce1a6cbbb7d8b0602fac6d1272e7903dc9237971d28a94ea3602a5107eeac4d
+          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:b0ca135dab242a6b8faaf829d77b15aa3aeeedaecbf440d86107f4c638d3c152
           resources:
             requests:
               cpu: 100m
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index 2f8c00877..c49b625b8 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -20,7 +20,7 @@ metadata:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -45,7 +45,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 data:
   envoy-bootstrap.yaml: |
@@ -132,7 +132,10 @@ data:
                       port_value: 18000
           type: STRICT_DNS
     admin:
-      access_log_path: "/dev/stdout"
+      access_log:
+      - name: envoy.access_loggers.stdout
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
       address:
         pipe:
           path: /tmp/envoy.admin
@@ -165,7 +168,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 data:
   _example: |
@@ -248,7 +251,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -258,7 +261,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -290,7 +293,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -324,7 +327,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -342,7 +345,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:96681b9ee243350190054a8f1b300bdc99c65613f64f1bd4534be342062d23ce
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:b505ede1893729933b6343563a77d2661c826bd9b014ee8ffff5b5a8d4fcc6f8
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -386,7 +389,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -421,7 +424,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -508,7 +511,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -532,7 +535,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230116-1e99fa59"
+    app.kubernetes.io/version: "20230120-d52387a2"
     app.kubernetes.io/name: knative-serving
 spec:
   ports: