Repository: knative/serving
Pull request #10529 (2021-01-12 14:54:52)

swap support dates with tcnghia
Swapping support weeks with @tcnghia 

knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10529#" title="Author self-approved">dprotaso</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative/serving/blob/master/OWNERS)~~ [dprotaso]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
knative-prow-robot: @dprotaso: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
knative-prow-robot: @dprotaso: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-unit-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-unit-tests/1349006969687511040) | `/test pull-knative-serving-unit-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10529). [Your PR dashboard](https://gubernator.knative.dev/pr/dprotaso).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @dprotaso: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-unit-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-unit-tests/1349006969687511040) | `/test pull-knative-serving-unit-tests`
pull-knative-serving-istio-stable-no-mesh-tls | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh-tls/1349006969746231296) | `/test pull-knative-serving-istio-stable-no-mesh-tls`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10529). [Your PR dashboard](https://gubernator.knative.dev/pr/dprotaso).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @dprotaso: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-unit-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-unit-tests/1349006969687511040) | `/test pull-knative-serving-unit-tests`
pull-knative-serving-istio-stable-no-mesh-tls | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh-tls/1349006969746231296) | `/test pull-knative-serving-istio-stable-no-mesh-tls`
pull-knative-serving-istio-stable-no-mesh | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh/1349006969725259776) | `/test pull-knative-serving-istio-stable-no-mesh`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10529). [Your PR dashboard](https://gubernator.knative.dev/pr/dprotaso).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @dprotaso: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-unit-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-unit-tests/1349006969687511040) | `/test pull-knative-serving-unit-tests`
pull-knative-serving-istio-stable-no-mesh-tls | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh-tls/1349006969746231296) | `/test pull-knative-serving-istio-stable-no-mesh-tls`
pull-knative-serving-istio-stable-no-mesh | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh/1349006969725259776) | `/test pull-knative-serving-istio-stable-no-mesh`
pull-knative-serving-upgrade-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-upgrade-tests/1349006969708482560) | `/test pull-knative-serving-upgrade-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10529). [Your PR dashboard](https://gubernator.knative.dev/pr/dprotaso).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @dprotaso: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-unit-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-unit-tests/1349006969687511040) | `/test pull-knative-serving-unit-tests`
pull-knative-serving-istio-stable-no-mesh-tls | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh-tls/1349006969746231296) | `/test pull-knative-serving-istio-stable-no-mesh-tls`
pull-knative-serving-istio-stable-no-mesh | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-istio-stable-no-mesh/1349006969725259776) | `/test pull-knative-serving-istio-stable-no-mesh`
pull-knative-serving-upgrade-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-upgrade-tests/1349006969708482560) | `/test pull-knative-serving-upgrade-tests`
pull-knative-serving-build-tests | f1e347eab387454f03abc7cf25c810a47cb77a16 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10529/pull-knative-serving-build-tests/1349006969674928128) | `/test pull-knative-serving-build-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10529). [Your PR dashboard](https://gubernator.knative.dev/pr/dprotaso).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
dprotaso: /assign @tcnghia 
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=h1) Report
> Merging [#10529](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=desc) (846a1f4) into [master](https://codecov.io/gh/knative/serving/commit/560a4f678dd78c5c66d2d09a542cfbbb9fbeb9e7?el=desc) (560a4f6) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/10529/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui)](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master   #10529   +/-   ##
=======================================
  Coverage   88.08%   88.08%           
=======================================
  Files         187      187           
  Lines        8865     8865           
=======================================
  Hits         7809     7809           
  Misses        816      816           
  Partials      240      240           
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/autoscaling/kpa/scaler.go](https://codecov.io/gh/knative/serving/pull/10529/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcva3BhL3NjYWxlci5nbw==) | `88.57% <0.00%> (-1.43%)` | :arrow_down: |
| [pkg/reconciler/configuration/configuration.go](https://codecov.io/gh/knative/serving/pull/10529/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvY29uZmlndXJhdGlvbi9jb25maWd1cmF0aW9uLmdv) | `88.28% <0.00%> (+1.56%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=footer). Last update [560a4f6...f22738f](https://codecov.io/gh/knative/serving/pull/10529?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/cmd/queue/main.go b/cmd/queue/main.go
index 5ec844878..3da8cab99 100644
--- a/cmd/queue/main.go
+++ b/cmd/queue/main.go
@@ -23,8 +23,6 @@ import (
 	"fmt"
 	"net"
 	"net/http"
-	"net/http/httputil"
-	"net/url"
 	"os"
 	"strconv"
 	"time"
@@ -266,22 +264,19 @@ func buildProbe(logger *zap.SugaredLogger, probeJSON string) *readiness.Probe {
 
 func buildServer(ctx context.Context, env config, healthState *health.State, rp *readiness.Probe, stats *network.RequestStats,
 	logger *zap.SugaredLogger) *http.Server {
-	target := &url.URL{
-		Scheme: "http",
-		Host:   net.JoinHostPort("127.0.0.1", env.UserPort),
-	}
 
 	maxIdleConns := 1000 // TODO: somewhat arbitrary value for CC=0, needs experimental validation.
 	if env.ContainerConcurrency > 0 {
 		maxIdleConns = env.ContainerConcurrency
 	}
 
-	httpProxy := httputil.NewSingleHostReverseProxy(target)
+	target := net.JoinHostPort("127.0.0.1", env.UserPort)
+
+	httpProxy := activatorutil.NewHeaderPruningReverseProxy(target)
 	httpProxy.Transport = buildTransport(env, logger, maxIdleConns)
 	httpProxy.ErrorHandler = pkgnet.ErrorHandler(logger)
 	httpProxy.BufferPool = network.NewBufferPool()
 	httpProxy.FlushInterval = network.FlushInterval
-	activatorutil.SetupHeaderPruning(httpProxy)
 
 	breaker := buildBreaker(logger, env)
 	metricsSupported := supportsMetrics(ctx, logger, env)
diff --git a/go.mod b/go.mod
index 2f95dc1ab..15efcb28e 100644
--- a/go.mod
+++ b/go.mod
@@ -34,8 +34,8 @@ require (
 	k8s.io/code-generator v0.18.12
 	k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29
 	knative.dev/caching v0.0.0-20210107021736-1ee47505018d
-	knative.dev/hack v0.0.0-20201214230143-4ed1ecb8db24
-	knative.dev/networking v0.0.0-20210107024535-ecb89ced52d9
-	knative.dev/pkg v0.0.0-20210107022335-51c72e24c179
+	knative.dev/hack v0.0.0-20210112093330-d946d2557383
+	knative.dev/networking v0.0.0-20210112144630-4c4c2378e90e
+	knative.dev/pkg v0.0.0-20210112143930-acbf2af596cf
 	sigs.k8s.io/yaml v1.2.0
 )
diff --git a/go.sum b/go.sum
index 4a7e8aaec..c44ec1c4d 100644
--- a/go.sum
+++ b/go.sum
@@ -1227,12 +1227,14 @@ knative.dev/caching v0.0.0-20210107021736-1ee47505018d h1:C5JgxpCO4Dv+pqUHxIS+e+
 knative.dev/caching v0.0.0-20210107021736-1ee47505018d/go.mod h1:N3jOlbf/CWZsEcfEpthv5b+LB9e+TqiDTVLH/Ti+vWE=
 knative.dev/hack v0.0.0-20201214230143-4ed1ecb8db24 h1:kIztWfvnIFV8Lhlea02K3YO2mIzcDyQNzrBLn0Oq9sA=
 knative.dev/hack v0.0.0-20201214230143-4ed1ecb8db24/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20210107024535-ecb89ced52d9 h1:7SXik2ulHr7URICeDYHPVdnyuT72RW9GouJ97XRkWbo=
-knative.dev/networking v0.0.0-20210107024535-ecb89ced52d9/go.mod h1:N123KICErXy+bPo1oBszM6TVYGG0Za2wMmnEqX4MlFg=
+knative.dev/hack v0.0.0-20210112093330-d946d2557383 h1:YDYKfHaplhMelgOVP8eRvHlYf5elgZveo36GBDFfDqA=
+knative.dev/hack v0.0.0-20210112093330-d946d2557383/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
+knative.dev/networking v0.0.0-20210112144630-4c4c2378e90e h1:+dPBT1mkby4DjnYDAH6vu+6rlZ7dsNy5cjxx4CHPso4=
+knative.dev/networking v0.0.0-20210112144630-4c4c2378e90e/go.mod h1:N123KICErXy+bPo1oBszM6TVYGG0Za2wMmnEqX4MlFg=
 knative.dev/pkg v0.0.0-20201224024804-27db5ac24cfb h1:XVcmpSvfDMZ5Z+1pebSm5Msq5sQey/V4NHF2+dFNU1o=
 knative.dev/pkg v0.0.0-20201224024804-27db5ac24cfb/go.mod h1:hckgW978SdzPA2H5EDvRPY8xsnPuDZLJLbPf8Jte7Q0=
-knative.dev/pkg v0.0.0-20210107022335-51c72e24c179 h1:lkrgrv69iUk2qhOG9symy15kJUaJZmMybSloi7C3gIw=
-knative.dev/pkg v0.0.0-20210107022335-51c72e24c179/go.mod h1:hckgW978SdzPA2H5EDvRPY8xsnPuDZLJLbPf8Jte7Q0=
+knative.dev/pkg v0.0.0-20210112143930-acbf2af596cf h1:6/VyHMk6pa395xWho0KLfVj+7NNrmlO7Ki9jLbVjoaI=
+knative.dev/pkg v0.0.0-20210112143930-acbf2af596cf/go.mod h1:hckgW978SdzPA2H5EDvRPY8xsnPuDZLJLbPf8Jte7Q0=
 modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
 modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
diff --git a/pkg/activator/handler/handler.go b/pkg/activator/handler/handler.go
index e7c9d627e..485bd2f6d 100644
--- a/pkg/activator/handler/handler.go
+++ b/pkg/activator/handler/handler.go
@@ -21,7 +21,6 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httputil"
-	"net/url"
 
 	"go.opencensus.io/plugin/ochttp"
 	"go.opencensus.io/trace"
@@ -81,10 +80,7 @@ func (a *activationHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		if tracingEnabled {
 			proxyCtx, proxySpan = trace.StartSpan(r.Context(), "activator_proxy")
 		}
-		a.proxyRequest(logger, w, r.WithContext(proxyCtx), &url.URL{
-			Scheme: "http",
-			Host:   dest,
-		}, tracingEnabled)
+		a.proxyRequest(logger, w, r.WithContext(proxyCtx), dest, tracingEnabled)
 		proxySpan.End()
 
 		return nil
@@ -103,12 +99,12 @@ func (a *activationHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func (a *activationHandler) proxyRequest(logger *zap.SugaredLogger, w http.ResponseWriter, r *http.Request, target *url.URL, tracingEnabled bool) {
+func (a *activationHandler) proxyRequest(logger *zap.SugaredLogger, w http.ResponseWriter, r *http.Request, target string, tracingEnabled bool) {
 	network.RewriteHostIn(r)
 	r.Header.Set(network.ProxyHeaderName, activator.Name)
 
 	// Set up the reverse proxy.
-	proxy := httputil.NewSingleHostReverseProxy(target)
+	proxy := util.NewHeaderPruningReverseProxy(target)
 	proxy.BufferPool = a.bufferPool
 	proxy.Transport = a.transport
 	if tracingEnabled {
@@ -116,7 +112,6 @@ func (a *activationHandler) proxyRequest(logger *zap.SugaredLogger, w http.Respo
 	}
 	proxy.FlushInterval = network.FlushInterval
 	proxy.ErrorHandler = pkgnet.ErrorHandler(logger)
-	util.SetupHeaderPruning(proxy)
 
 	proxy.ServeHTTP(w, r)
 }
diff --git a/pkg/activator/handler/probe_handler.go b/pkg/activator/handler/probe_handler.go
index aebb9b535..80bdbad81 100644
--- a/pkg/activator/handler/probe_handler.go
+++ b/pkg/activator/handler/probe_handler.go
@@ -18,6 +18,7 @@ package handler
 
 import (
 	"fmt"
+	"html"
 	"io"
 	"net/http"
 
@@ -35,7 +36,7 @@ func (h *ProbeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// probing the network, respond with a 200 and our component name.
 	if val := r.Header.Get(network.ProbeHeaderName); val != "" {
 		if val != activator.Name {
-			http.Error(w, fmt.Sprintf("unexpected probe header value: %q", val), http.StatusBadRequest)
+			http.Error(w, fmt.Sprintf("unexpected probe header value: %q", html.EscapeString(val)), http.StatusBadRequest)
 			return
 		}
 		io.WriteString(w, activator.Name)
diff --git a/pkg/activator/util/header.go b/pkg/activator/util/header.go
index fc4cf9e56..90ec176f1 100644
--- a/pkg/activator/util/header.go
+++ b/pkg/activator/util/header.go
@@ -28,16 +28,24 @@ var headersToRemove = []string{
 	activator.RevisionHeaderNamespace,
 }
 
-// SetupHeaderPruning will cause the http.ReverseProxy
-// to not forward activator headers.
-func SetupHeaderPruning(p *httputil.ReverseProxy) {
-	// Director is never nil - otherwise ServeHTTP panics.
-	orig := p.Director
-	p.Director = func(r *http.Request) {
-		orig(r)
-
-		for _, h := range headersToRemove {
-			r.Header.Del(h)
-		}
+// NewHeaderPruningReverseProxy returns a httputil.ReverseProxy that proxies
+// requests to the given targetHost.  The returned reverse proxy strips
+// activator-specific headers that should not reach the user container.
+func NewHeaderPruningReverseProxy(targetHost string) *httputil.ReverseProxy {
+	return &httputil.ReverseProxy{
+		Director: func(req *http.Request) {
+			req.URL.Scheme = "http"
+			req.URL.Host = targetHost
+
+			// Copied from httputil.NewSingleHostReverseProxy.
+			if _, ok := req.Header["User-Agent"]; !ok {
+				// explicitly disable User-Agent so it's not set to default value
+				req.Header.Set("User-Agent", "")
+			}
+
+			for _, h := range headersToRemove {
+				req.Header.Del(h)
+			}
+		},
 	}
 }
diff --git a/pkg/reconciler/autoscaling/kpa/kpa.go b/pkg/reconciler/autoscaling/kpa/kpa.go
index ae5c75fff..167b176d0 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa.go
@@ -233,11 +233,7 @@ func reportMetrics(pa *pav1alpha1.PodAutoscaler, pc podCounts) {
 //    | -1   | >= min | >0    | active     | active     |
 func computeActiveCondition(ctx context.Context, pa *pav1alpha1.PodAutoscaler, pc podCounts) {
 	minReady := activeThreshold(ctx, pa)
-	// In pre-0.17 we could have scaled down normally without ever setting ScaleTargetInitialized.
-	// In this case we'll be in the NoTraffic/inactive state.
-	// TODO(taragu): remove after 0.19
-	alreadyScaledDownSuccessfully := minReady > 0 && pa.Status.GetCondition(pav1alpha1.PodAutoscalerConditionActive).GetReason() == noTrafficReason
-	if (pc.ready >= minReady || alreadyScaledDownSuccessfully) && pa.Status.ServiceName != "" {
+	if pc.ready >= minReady && pa.Status.ServiceName != "" {
 		pa.Status.MarkScaleTargetInitialized()
 	}
 
diff --git a/pkg/reconciler/route/resources/ingress.go b/pkg/reconciler/route/resources/ingress.go
index 689c6a311..034fa35fb 100644
--- a/pkg/reconciler/route/resources/ingress.go
+++ b/pkg/reconciler/route/resources/ingress.go
@@ -271,7 +271,7 @@ func makeIngressRule(domains []string, ns string,
 	}
 }
 
-// `names` should not include `""` — the DefaultTarget.
+// `names` must not include `""` — the DefaultTarget.
 func makeTagBasedRoutingIngressPaths(ns string, tc *traffic.Config, ro *traffic.Rollout, names []string) []netv1alpha1.HTTPIngressPath {
 	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(names))
 
@@ -285,13 +285,14 @@ func makeTagBasedRoutingIngressPaths(ns string, tc *traffic.Config, ro *traffic.
 }
 
 func rolloutConfig(cfgName string, ros []*traffic.ConfigurationRollout) *traffic.ConfigurationRollout {
-	for _, ro := range ros {
-		if ro.ConfigurationName == cfgName {
-			return ro
-		}
-	}
+	idx := sort.Search(len(ros), func(i int) bool {
+		return ros[i].ConfigurationName >= cfgName
+	})
 	// Technically impossible with valid inputs.
-	return nil
+	if idx >= len(ros) {
+		return nil
+	}
+	return ros[idx]
 }
 
 func makeBaseIngressPath(ns string, targets traffic.RevisionTargets,
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index a7fa4d924..8ead05262 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -137,6 +137,10 @@ func (cur *Rollout) Validate() bool {
 		if c.Percent > 100 {
 			return false
 		}
+		// Ensure step size is valid.
+		if c.StepParams.StepSize < 0 || c.StepParams.StepSize > c.Percent {
+			return false
+		}
 		// If total % values in the revision do not add up — discard.
 		tot := 0
 		for _, r := range c.Revisions {
diff --git a/support/COMMUNITY_CONTACTS.md b/support/COMMUNITY_CONTACTS.md
index 62489277b..5f9dec1a7 100644
--- a/support/COMMUNITY_CONTACTS.md
+++ b/support/COMMUNITY_CONTACTS.md
@@ -81,8 +81,8 @@ rotation, feel free to send a PR to remove yourself.
 | 2020-02-08 | [JRBANCEL](https://github.com/JRBANCEL)             |
 | 2020-02-15 | [nak3](https://github.com/nak3)                     |
 | 2020-02-22 | [yanweiguo](https://github.com/yanweiguo)           |
-| 2020-03-01 | [tcnghia](https://github.com/tcnghia)               |
-| 2020-03-08 | [dprotaso](https://github.com/dprotaso)             |
+| 2020-03-01 | [dprotaso](https://github.com/dprotaso)             |
+| 2020-03-08 | [tcnghia](https://github.com/tcnghia)               |
 | 2020-03-15 | [mattmoor](https://github.com/mattmoor)             |
 | 2020-03-22 | [ZhiminXiang](https://github.com/ZhiminXiang)       |
 | 2020-03-29 | [yanweiguo](https://github.com/yanweiguo)           |
diff --git a/vendor/knative.dev/networking/config/config-network.yaml b/vendor/knative.dev/networking/config/config-network.yaml
index 3d25ace68..75f79ac24 100644
--- a/vendor/knative.dev/networking/config/config-network.yaml
+++ b/vendor/knative.dev/networking/config/config-network.yaml
@@ -20,7 +20,7 @@ metadata:
   labels:
     serving.knative.dev/release: devel
   annotations:
-    knative.dev/example-checksum: "eaf5fb3f"
+    knative.dev/example-checksum: "14cd8fa3"
 data:
   _example: |
     ################################
@@ -108,3 +108,14 @@ data:
     # rolloutDuration contains the minimal duration in seconds over which the
     # Configuration traffic targets are rolled out to the newest revision.
     rolloutDuration: "0"
+
+    # autocreateClusterDomainClaims controls whether ClusterDomainClaims should
+    # be automatically created (and deleted) as needed when DomainMappings are
+    # reconciled.
+    #
+    # If this is "false", the cluster administrator is responsible for creating
+    # ClusterDomainClaims and delegating them to namespaces via their
+    # spec.Namespace field. This is useful for multitenant environments
+    # which need to control which namespace can use a particular domain name in
+    # a domain mapping.
+    autocreateClusterDomainClaims: "true"
diff --git a/vendor/knative.dev/networking/pkg/network.go b/vendor/knative.dev/networking/pkg/network.go
index 86217cc98..e88fae04d 100644
--- a/vendor/knative.dev/networking/pkg/network.go
+++ b/vendor/knative.dev/networking/pkg/network.go
@@ -116,6 +116,10 @@ const (
 	// constructing the Knative Route's tag names.
 	DefaultTagTemplate = "{{.Tag}}-{{.Name}}"
 
+	// AutocreateClusterDomainClaimsKey is the key for the
+	// AutocreateClusterDomainClaims property.
+	AutocreateClusterDomainClaimsKey = "autocreateClusterDomainClaims"
+
 	// AutoTLSKey is the name of the configuration entry
 	// that specifies enabling auto-TLS or not.
 	AutoTLSKey = "autoTLS"
@@ -235,6 +239,13 @@ type Config struct {
 
 	// RolloutDurationSecs specifies the default duration for the rollout.
 	RolloutDurationSecs int
+
+	// AutocreateClusterDomainClaims specifies whether cluster-wide DomainClaims
+	// should be automatically created (and deleted) as needed when a
+	// DomainMapping is reconciled. If this is false, the
+	// cluster administrator is responsible for pre-creating ClusterDomainClaims
+	// and delegating them to namespaces via their spec.Namespace field.
+	AutocreateClusterDomainClaims bool
 }
 
 // HTTPProtocol indicates a type of HTTP endpoint behavior
@@ -254,12 +265,13 @@ const (
 
 func defaultConfig() *Config {
 	return &Config{
-		DefaultIngressClass:     IstioIngressClassName,
-		DefaultCertificateClass: CertManagerCertificateClassName,
-		DomainTemplate:          DefaultDomainTemplate,
-		TagTemplate:             DefaultTagTemplate,
-		AutoTLS:                 false,
-		HTTPProtocol:            HTTPEnabled,
+		DefaultIngressClass:           IstioIngressClassName,
+		DefaultCertificateClass:       CertManagerCertificateClassName,
+		DomainTemplate:                DefaultDomainTemplate,
+		TagTemplate:                   DefaultTagTemplate,
+		AutoTLS:                       false,
+		HTTPProtocol:                  HTTPEnabled,
+		AutocreateClusterDomainClaims: true,
 	}
 }
 
@@ -280,6 +292,7 @@ func NewConfigFromMap(data map[string]string) (*Config, error) {
 		cm.AsString(DomainTemplateKey, &nc.DomainTemplate),
 		cm.AsString(TagTemplateKey, &nc.TagTemplate),
 		cm.AsInt(RolloutDurationKey, &nc.RolloutDurationSecs),
+		cm.AsBool(AutocreateClusterDomainClaimsKey, &nc.AutocreateClusterDomainClaims),
 	); err != nil {
 		return nil, err
 	}
diff --git a/vendor/knative.dev/pkg/network/handlers/drain.go b/vendor/knative.dev/pkg/network/handlers/drain.go
index 75919578c..0ed37ba6d 100644
--- a/vendor/knative.dev/pkg/network/handlers/drain.go
+++ b/vendor/knative.dev/pkg/network/handlers/drain.go
@@ -47,7 +47,8 @@ var newTimer = func(d time.Duration) timer {
 }
 
 // Drainer wraps an inner http.Handler to support responding to kubelet
-// probes and KProbes with a "200 OK" until the handler is told to Drain.
+// probes and KProbes with a "200 OK" until the handler is told to Drain,
+// or Drainer will optionally run the HealthCheck if it is defined.
 // When the Drainer is told to Drain, it will immediately start to fail
 // probes with a "500 shutting down", and the call will block until no
 // requests have been received for QuietPeriod (defaults to
@@ -56,6 +57,10 @@ type Drainer struct {
 	// Mutex guards the initialization and resets of the timer
 	sync.RWMutex
 
+	// HealthCheck is an optional health check that is performed until the drain signal is received.
+	// When unspecified, a "200 OK" is returned, otherwise this function is invoked.
+	HealthCheck http.HandlerFunc
+
 	// Inner is the http.Handler to which we delegate actual requests.
 	Inner http.Handler
 
@@ -78,6 +83,8 @@ func (d *Drainer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if network.IsKubeletProbe(r) { // Respond to probes regardless of path.
 		if d.draining() {
 			http.Error(w, "shutting down", http.StatusServiceUnavailable)
+		} else if d.HealthCheck != nil {
+			d.HealthCheck(w, r)
 		} else {
 			w.WriteHeader(http.StatusOK)
 		}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 20fb2f499..00e85e374 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -984,11 +984,11 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/hack v0.0.0-20201214230143-4ed1ecb8db24
+# knative.dev/hack v0.0.0-20210112093330-d946d2557383
 ## explicit
 knative.dev/hack
 knative.dev/hack/shell
-# knative.dev/networking v0.0.0-20210107024535-ecb89ced52d9
+# knative.dev/networking v0.0.0-20210112144630-4c4c2378e90e
 ## explicit
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -1022,7 +1022,7 @@ knative.dev/networking/test/conformance/ingress
 knative.dev/networking/test/defaultsystem
 knative.dev/networking/test/test_images/grpc-ping/proto
 knative.dev/networking/test/types
-# knative.dev/pkg v0.0.0-20210107022335-51c72e24c179
+# knative.dev/pkg v0.0.0-20210112143930-acbf2af596cf
 ## explicit
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/pkg/activator/handler/handler_test.go b/pkg/activator/handler/handler_test.go
index 6c5a3efe1..37037f9ff 100644
--- a/pkg/activator/handler/handler_test.go
+++ b/pkg/activator/handler/handler_test.go
@@ -266,7 +266,7 @@ func TestActivationHandlerTraceSpans(t *testing.T) {
 
 func sendRequest(namespace, revName string, handler http.Handler, store *activatorconfig.Store) *httptest.ResponseRecorder {
 	resp := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, "http://example.com", nil)
+	req := httptest.NewRequest(http.MethodPost, "http://example.com/", nil)
 	ctx := store.ToContext(req.Context())
 	ctx = util.WithRevID(ctx, types.NamespacedName{Namespace: namespace, Name: revName})
 	handler.ServeHTTP(resp, req.WithContext(ctx))
diff --git a/pkg/activator/util/header_test.go b/pkg/activator/util/header_test.go
index 07d113cb7..8e8ae63cb 100644
--- a/pkg/activator/util/header_test.go
+++ b/pkg/activator/util/header_test.go
@@ -17,28 +17,21 @@ limitations under the License.
 package util
 
 import (
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"net/http/httputil"
 	"net/url"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
 	"knative.dev/serving/pkg/activator"
 )
 
-func TestHeaderPruning(t *testing.T) {
+func TestNewProxy(t *testing.T) {
 	var handler http.HandlerFunc = func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get(activator.RevisionHeaderName) != "" {
-			w.WriteHeader(http.StatusBadRequest)
-			return
+		if err := json.NewEncoder(w).Encode(r.Header); err != nil {
+			panic(err)
 		}
-
-		if r.Header.Get(activator.RevisionHeaderNamespace) != "" {
-			w.WriteHeader(http.StatusBadRequest)
-			return
-		}
-
-		w.WriteHeader(http.StatusOK)
 	}
 
 	server := httptest.NewServer(handler)
@@ -47,29 +40,54 @@ func TestHeaderPruning(t *testing.T) {
 	defer server.Close()
 
 	tests := []struct {
-		name   string
-		header string
+		name          string
+		url           string
+		header        http.Header
+		expectHeaders http.Header
 	}{{
-		name:   "revision name header",
-		header: activator.RevisionHeaderName,
+		name: "prunes activator headers, does not add user agent header",
+		url:  "http://example.com/",
+		header: http.Header{
+			"Header":                          []string{"value"},
+			activator.RevisionHeaderName:      []string{"some-value"},
+			activator.RevisionHeaderNamespace: []string{"some-value"},
+		},
+		expectHeaders: http.Header{
+			"Header": []string{"value"},
+		},
 	}, {
-		name:   "revision namespace header",
-		header: activator.RevisionHeaderNamespace,
+		name: "explicit user agent header not removed",
+		url:  "http://example.com/",
+		header: http.Header{
+			"User-Agent": []string{"gold"},
+		},
+		expectHeaders: http.Header{
+			"User-Agent": []string{"gold"},
+		},
 	}}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			proxy := httputil.NewSingleHostReverseProxy(serverURL)
-			SetupHeaderPruning(proxy)
+			proxy := NewHeaderPruningReverseProxy(serverURL.Host)
 
 			resp := httptest.NewRecorder()
-			req := httptest.NewRequest(http.MethodPost, "http://example.com", nil)
-			req.Header.Set(test.header, "some-value")
+			req := httptest.NewRequest(http.MethodPost, test.url, nil)
+			req.Header = test.header
 
 			proxy.ServeHTTP(resp, req)
 
-			if resp.Code != http.StatusOK {
-				t.Errorf("expected header %q to be filtered", test.header)
+			var proxiedHeaders http.Header
+			if err := json.NewDecoder(resp.Body).Decode(&proxiedHeaders); err != nil {
+				t.Fatalf("Decode = %v", err)
+			}
+
+			// Remove headers golang adds from consideration.
+			for _, k := range []string{"Accept-Encoding", "Content-Length", "X-Forwarded-For"} {
+				proxiedHeaders.Del(k)
+			}
+
+			if got, want := proxiedHeaders, test.expectHeaders; !cmp.Equal(want, got) {
+				t.Errorf("Got Headers=%v, want: %v; diff: %s", got, want, cmp.Diff(want, got))
 			}
 		})
 	}
diff --git a/pkg/reconciler/autoscaling/kpa/kpa_test.go b/pkg/reconciler/autoscaling/kpa/kpa_test.go
index 001891b68..80f80d0b4 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa_test.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa_test.go
@@ -1129,30 +1129,6 @@ func TestReconcile(t *testing.T) {
 				WithPAMetricsService(privateSvc), WithObservedGeneration(1),
 			),
 		}},
-	}, {
-		Name: "mark initial scale reached for an existing inactive PA",
-		Key:  key,
-		Ctx: context.WithValue(context.Background(), deciderKey{},
-			decider(testNamespace, testRevision, -1, /* desiredScale */
-				-42 /* ebc */, scaling.MinActivators)),
-		Objects: []runtime.Object{
-			kpa(testNamespace, testRevision, WithNoTraffic(noTrafficReason, "The target is not receiving traffic."),
-				withScales(0, -1), WithReachabilityReachable, WithPAStatusService(testRevision), WithPAMetricsService(privateSvc),
-				WithPASKSReady,
-			),
-			sks(testNamespace, testRevision, WithDeployRef(deployName), WithProxyMode, WithSKSReady),
-			metric(testNamespace, testRevision),
-			deploy(testNamespace, testRevision, func(d *appsv1.Deployment) {
-				d.Spec.Replicas = ptr.Int32(2)
-			}),
-		},
-		WantStatusUpdates: []clientgotesting.UpdateActionImpl{{
-			Object: kpa(testNamespace, testRevision, WithNoTraffic(noTrafficReason, "The target is not receiving traffic."),
-				WithPASKSReady, markScaleTargetInitialized,
-				withScales(0, -1), WithReachabilityReachable, WithPAStatusService(testRevision),
-				WithPAMetricsService(privateSvc), WithObservedGeneration(1),
-			),
-		}},
 	}}
 
 	table.Test(t, MakeFactory(func(ctx context.Context, listers *Listers, cmw configmap.Watcher) controller.Reconciler {
diff --git a/pkg/reconciler/route/traffic/rollout_test.go b/pkg/reconciler/route/traffic/rollout_test.go
index 948099806..6a83205a2 100644
--- a/pkg/reconciler/route/traffic/rollout_test.go
+++ b/pkg/reconciler/route/traffic/rollout_test.go
@@ -1273,6 +1273,36 @@ func TestValidateFailures(t *testing.T) {
 				}},
 			}},
 		},
+	}, {
+		name: "step larger than total",
+		r: &Rollout{
+			Configurations: []*ConfigurationRollout{{
+				ConfigurationName: "keith",
+				Percent:           71,
+				StepParams: RolloutParams{
+					StepSize: 75,
+				},
+				Revisions: []RevisionRollout{{
+					RevisionName: "black-on-blue",
+					Percent:      71,
+				}},
+			}},
+		},
+	}, {
+		name: "step negative",
+		r: &Rollout{
+			Configurations: []*ConfigurationRollout{{
+				ConfigurationName: "keith",
+				Percent:           71,
+				StepParams: RolloutParams{
+					StepSize: -1,
+				},
+				Revisions: []RevisionRollout{{
+					RevisionName: "black-on-blue",
+					Percent:      71,
+				}},
+			}},
+		},
 	}, {
 		name: "rev more than config",
 		r: &Rollout{
diff --git a/test/performance/benchmarks/rollout-probe/continuous/main.go b/test/performance/benchmarks/rollout-probe/continuous/main.go
index a5d1fd57a..8a394e5c0 100644
--- a/test/performance/benchmarks/rollout-probe/continuous/main.go
+++ b/test/performance/benchmarks/rollout-probe/continuous/main.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"flag"
 	"log"
+	"strings"
 	"time"
 
 	vegeta "github.com/tsenart/vegeta/v12/lib"
@@ -113,7 +114,7 @@ func main() {
 
 	// Start the attack!
 	results := attacker.Attack(targeter, rate, *duration, "rollout-test")
-	firstRev := ""
+	firstRev, secondRev := "", ""
 
 	// After a minute, update the Ksvc.
 	updateSvc := time.After(30 * time.Second)
@@ -152,6 +153,9 @@ LOOP:
 					_, err = sc.ServingV1().Services(namespace).Update(
 						context.Background(), restore, metav1.UpdateOptions{})
 					log.Printf("Restoring the service to initial minScale = %s, err: %#v", prev, err)
+					// Also remove the oldest revision, to keep the list of revisions short.
+					sc.ServingV1().Revisions(namespace).Delete(ctx, restore.Status.LatestReadyRevisionName,
+						metav1.DeleteOptions{})
 				}
 			}
 			svc.Spec.Template.Annotations["autoscaling.knative.dev/minScale"] = "1"
@@ -169,14 +173,33 @@ LOOP:
 			// Handle the result for this request.
 			metrics.HandleResult(q, *res, t.stat, ar)
 		case ds := <-deploymentStatus:
-			// Add a sample point for the deployment status.
-			q.AddSamplePoint(mako.XTime(ds.Time), map[string]float64{
-				"dp": float64(ds.DesiredReplicas),
-				"ap": float64(ds.ReadyReplicas),
-			})
+			// Ignore deployment updates until we get current one.
+			if firstRev == "" {
+				break LOOP
+			}
+			// Deployment name contains revision name.
+			// If it is the first one -- report it.
+			if strings.Contains(ds.DeploymentName, firstRev) {
+				// Add a sample point for the deployment status.
+				q.AddSamplePoint(mako.XTime(ds.Time), map[string]float64{
+					"dp": float64(ds.DesiredReplicas),
+					"ap": float64(ds.ReadyReplicas),
+				})
+			} else if secondRev != "" && strings.Contains(ds.DeploymentName, secondRev) {
+				// Otherwise eport the pods for the new deployment.
+				q.AddSamplePoint(mako.XTime(ds.Time), map[string]float64{
+					"dp2": float64(ds.DesiredReplicas),
+					"ap2": float64(ds.ReadyReplicas),
+				})
+				// Ignore all other revisions' deployments if there are, since
+				// they are from previous test run iterations and we don't care about
+				// their reported scale values (should be 0 & 100 depending on which
+				// one it is).
+			}
 		case rs := <-routeStatus:
 			if firstRev == "" {
 				firstRev = rs.Traffic[0].RevisionName
+				log.Println("Inferred first revision =", firstRev)
 			}
 			v := make(map[string]float64, 2)
 			if len(rs.Traffic) == 1 {
@@ -191,6 +214,10 @@ LOOP:
 			} else {
 				v["t1"] = float64(*rs.Traffic[0].Percent)
 				v["t2"] = float64(*rs.Traffic[1].Percent)
+				if secondRev == "" {
+					secondRev = rs.Traffic[1].RevisionName
+					log.Println("Inferred second revision =", secondRev)
+				}
 			}
 			q.AddSamplePoint(mako.XTime(rs.Time), v)
 		}
diff --git a/test/performance/benchmarks/rollout-probe/dev.config b/test/performance/benchmarks/rollout-probe/dev.config
index 643931d19..b3a8e8c96 100644
--- a/test/performance/benchmarks/rollout-probe/dev.config
+++ b/test/performance/benchmarks/rollout-probe/dev.config
@@ -71,6 +71,14 @@ metric_info_list: {
   value_key: "ap"
   label: "available-pods"
 }
+metric_info_list: {
+  value_key: "dp2"
+  label: "desired-pods-new"
+}
+metric_info_list: {
+  value_key: "ap2"
+  label: "available-pods-new"
+}
 metric_info_list: {
   value_key: "t1"
   label: "tarffic-old"
diff --git a/test/performance/metrics/runtime.go b/test/performance/metrics/runtime.go
index 7f0e0c2bb..295f85097 100644
--- a/test/performance/metrics/runtime.go
+++ b/test/performance/metrics/runtime.go
@@ -39,6 +39,7 @@ import (
 type DeploymentStatus struct {
 	DesiredReplicas int32
 	ReadyReplicas   int32
+	DeploymentName  string
 	// Time is the time when the status is fetched
 	Time time.Time
 }
@@ -112,6 +113,7 @@ func fetchStatusInternal(ctx context.Context, duration time.Duration,
 			ds := DeploymentStatus{
 				DesiredReplicas: *d.Spec.Replicas,
 				ReadyReplicas:   d.Status.ReadyReplicas,
+				DeploymentName:  d.ObjectMeta.Name,
 				Time:            t,
 			}
 			ch <- ds
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 5429a4a4c..28603a439 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
 webhooks:
   - admissionReviewVersions:
       - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,7 +168,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20210111-af85fbf"
+        serving.knative.dev/release: "v20210112-af85fbf"
     spec:
       serviceAccountName: controller
       containers:
@@ -213,7 +213,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -250,7 +250,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
 spec:
   selector:
     matchLabels:
@@ -263,7 +263,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20210111-af85fbf"
+        serving.knative.dev/release: "v20210112-af85fbf"
     spec:
       serviceAccountName: controller
       containers:
@@ -329,7 +329,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20210111-af85fbf"
+    serving.knative.dev/release: "v20210112-af85fbf"
 spec:
   ports:
     # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 5f0c124a0..98791f068 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -33,7 +33,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: contour
-    serving.knative.dev/release: "v20210111-0df7ed85"
+    serving.knative.dev/release: "v20210112-0df7ed85"
 data:
   _example: |
     ################################
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index fc44fb321..41d3cf81e 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -126,7 +126,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -141,7 +141,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -170,7 +170,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -206,7 +206,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -244,7 +244,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -268,7 +268,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -342,7 +342,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -358,7 +358,7 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20210111-9f0302e4"
+        serving.knative.dev/release: "v20210112-9f0302e4"
     spec:
       serviceAccountName: controller
       containers:
@@ -422,7 +422,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -436,7 +436,7 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20210111-9f0302e4"
+        serving.knative.dev/release: "v20210112-9f0302e4"
     spec:
       serviceAccountName: controller
       containers:
@@ -497,7 +497,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20210111-9f0302e4"
+    serving.knative.dev/release: "v20210112-9f0302e4"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
diff --git a/vendor/knative.dev/pkg/test/logstream/v2/stream.go b/vendor/knative.dev/pkg/test/logstream/v2/stream.go
index e22963115..b244fe8b7 100644
--- a/vendor/knative.dev/pkg/test/logstream/v2/stream.go
+++ b/vendor/knative.dev/pkg/test/logstream/v2/stream.go
@@ -102,7 +102,13 @@ func (s *namespaceSource) watchPods() error {
 					if ev.Object == nil || reflect.ValueOf(ev.Object).IsNil() {
 						continue
 					}
-					p := ev.Object.(*corev1.Pod)
+					p, ok := ev.Object.(*corev1.Pod)
+					if !ok {
+						// The Watch interface can return errors via the channel as *metav1.Status.
+						// Log those to get notified that loglines might be missing but don't crash.
+						s.handleGenericLine([]byte(fmt.Sprintf("unexpected event: %v", p)), "no-pod", "no-container")
+						continue
+					}
 					switch ev.Type {
 					case watch.Deleted:
 						watchedPods.Delete(p.Name)