Repository: knative/serving
Pull request #14018 (2023-05-26 14:34:41)

Add chainguard-dev/actions for creating kind cluster
Fixes #

<!-- Please include the 'why' behind your changes if no issue exists -->
## Proposed Changes

* Use chainguard-dev/actions to create kind 
*
*

**Release Note**

<!-- Enter your extended release note in the below block. If the PR requires
additional action from users switching to the new release, include the string
"action required". If no release note is required, write "NONE". -->

```release-note

```


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/14018#" title="Author self-approved">pradnyavmw</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative/serving/blob/main/OWNERS)~~ [pradnyavmw]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov[bot]: ## [Codecov](https://app.codecov.io/gh/knative/serving/pull/14018?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
Patch coverage has no change and project coverage change: **`+0.01`** :tada:
> Comparison is base [(`35cfd8f`)](https://app.codecov.io/gh/knative/serving/commit/35cfd8f2d6d894454861a8599402d36e29056f8c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.21% compared to head [(`bdc9c49`)](https://app.codecov.io/gh/knative/serving/pull/14018?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.22%.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main   #14018      +/-   ##
==========================================
+ Coverage   86.21%   86.22%   +0.01%     
==========================================
  Files         199      199              
  Lines       14759    14759              
==========================================
+ Hits        12724    12726       +2     
+ Misses       1733     1731       -2     
  Partials      302      302              
```


[see 1 file with indirect coverage changes](https://app.codecov.io/gh/knative/serving/pull/14018/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)


</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/knative/serving/pull/14018?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).

pradnyavmw: /retest
pradnyavmw: /retest
pradnyavmw: /retest

Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 9bf8cadb0..b47fefd4d 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -152,7 +152,7 @@ aliases:
   technical-oversight-committee:
   - dprotaso
   - dsimansk
-  - evankanderson
+  - kvmware
   - psschwei
   - zroubalik
   trademark-committee:
diff --git a/cmd/controller/main.go b/cmd/controller/main.go
index c4895f011..94dd13db9 100644
--- a/cmd/controller/main.go
+++ b/cmd/controller/main.go
@@ -20,7 +20,7 @@ import (
 	// The set of controllers this controller process runs.
 	"flag"
 
-	certificate "knative.dev/control-protocol/pkg/certificates/reconciler"
+	certificate "knative.dev/networking/pkg/certificates/reconciler"
 	"knative.dev/pkg/reconciler"
 	"knative.dev/pkg/signals"
 	"knative.dev/serving/pkg/reconciler/configuration"
diff --git a/config/core/300-resources/domain-mapping.yaml b/config/core/300-resources/domain-mapping.yaml
index 9e048d99b..8ea083587 100644
--- a/config/core/300-resources/domain-mapping.yaml
+++ b/config/core/300-resources/domain-mapping.yaml
@@ -25,7 +25,7 @@ spec:
   versions:
     - name: v1beta1
       served: true
-      storage: false
+      storage: true
       subresources:
         status: {}
       additionalPrinterColumns:
@@ -149,7 +149,9 @@ spec:
                   type: string
     - name: v1alpha1
       served: true
-      storage: true
+      storage: false
+      deprecated: true
+      deprecationWarning: The v1alpha1 version of DomainMapping has been deprecated and will be removed in a future release of the API. Please upgrade to v1beta1
       subresources:
         status: {}
       schema:
diff --git a/config/core/300-secret.yaml b/config/core/300-secret.yaml
index faeabb73f..abce97bd1 100644
--- a/config/core/300-secret.yaml
+++ b/config/core/300-secret.yaml
@@ -15,8 +15,8 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  # Do not drop -ctrl-ca suffix as control-protocol requires it.
-  # https://github.com/knative-sandbox/control-protocol/blob/main/pkg/certificates/reconciler/controller.go
+  # Do not drop -ctrl-ca suffix as certificate creation requires it
+  # https://github.com/knative/networking/blob/main/pkg/certificates/reconciler/controller.go#L38
   name: serving-certs-ctrl-ca
   namespace: knative-serving
   labels:
diff --git a/config/post-install/storage-version-migration.yaml b/config/post-install/storage-version-migration.yaml
index 887d7dfa9..b7b0c5708 100644
--- a/config/post-install/storage-version-migration.yaml
+++ b/config/post-install/storage-version-migration.yaml
@@ -47,6 +47,7 @@ spec:
           - "configurations.serving.knative.dev"
           - "revisions.serving.knative.dev"
           - "routes.serving.knative.dev"
+          - "domainmappings.serving.knative.dev"
         resources:
           requests:
             cpu: 100m
diff --git a/go.mod b/go.mod
index 2e035c5eb..5ad99473f 100644
--- a/go.mod
+++ b/go.mod
@@ -32,11 +32,10 @@ require (
 	k8s.io/code-generator v0.26.5
 	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
 	k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2
-	knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6
-	knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d
-	knative.dev/hack v0.0.0-20230530201435-5b7907fbe350
-	knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60
-	knative.dev/pkg v0.0.0-20230531073936-5671699f23d9
+	knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8
+	knative.dev/hack v0.0.0-20230606014732-a861c8e9da08
+	knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6
+	knative.dev/pkg v0.0.0-20230612155445-74c4be5e935e
 	sigs.k8s.io/yaml v1.3.0
 )
 
diff --git a/go.sum b/go.sum
index 2a4c18194..e864a8d6e 100644
--- a/go.sum
+++ b/go.sum
@@ -1194,16 +1194,14 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
 k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6 h1:kajORjwXlGzSPddhazNIE01i5Efgqo52iB8VdFou22g=
-knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6/go.mod h1:G3SAcfsMvSh0QeE0qybQ4G1J7v60XeH1DLaHGx12Ixk=
-knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d h1:UCorKZ+dKWmBesDNpocdKLsd/yo+qsCCvnlzj4+QNxs=
-knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d/go.mod h1:6IjiiR5I2DjCWdOsj0jLvrIjzDaKYaq4jUhT1ImrWwg=
-knative.dev/hack v0.0.0-20230530201435-5b7907fbe350 h1:lSV9uFTohrQd7i5OUhLnR87PwUHJplQKJSEiZgzP/VY=
-knative.dev/hack v0.0.0-20230530201435-5b7907fbe350/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
-knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60 h1:vErunGWa8pZNriLFaE4UbgdqNECKF7gJTYZE+DdOuOE=
-knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60/go.mod h1:ieNknBTSWl441656hZF1JNHbTXbab138w8qPEwuwC0Q=
-knative.dev/pkg v0.0.0-20230531073936-5671699f23d9 h1:xd7E2nuQ358cXR4jB7Y5+FH88Mm+SQTZty5pXa1TSfs=
-knative.dev/pkg v0.0.0-20230531073936-5671699f23d9/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
+knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8 h1:mcADzDjLLEfO+8pDQofp/HqP7Z4vwwVBRdH2rnsrF0Q=
+knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8/go.mod h1:PfSeGXb3BpXZRZlzpVhsDcWB0qCCw/+tKNMUYKhyvpo=
+knative.dev/hack v0.0.0-20230606014732-a861c8e9da08 h1:6DH2ktsj5KoKMAxPFmiDopMCVR1LzhxFNy3D/JCg7JE=
+knative.dev/hack v0.0.0-20230606014732-a861c8e9da08/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
+knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6 h1:m+CUC915l+Ey1DNmMlM/5bwzt/dPQOw43KD989xDdFI=
+knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6/go.mod h1:Z2HjQrktBjIbiqLf69ZrqbMjaJ1peSLJZhYwG+BjXno=
+knative.dev/pkg v0.0.0-20230612155445-74c4be5e935e h1:koM+NopG2Yw738NlJhQF3ZwpyS+HHznuLm294VYlUKg=
+knative.dev/pkg v0.0.0-20230612155445-74c4be5e935e/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
 pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/pkg/activator/certificate/cache.go b/pkg/activator/certificate/cache.go
index 699ace5cc..62f43e4f8 100644
--- a/pkg/activator/certificate/cache.go
+++ b/pkg/activator/certificate/cache.go
@@ -28,7 +28,7 @@ import (
 	v1 "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/tools/cache"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/controller"
 	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
@@ -103,7 +103,7 @@ func (cr *CertCache) updateCache(secret *corev1.Secret) {
 
 	cr.TLSConf.RootCAs = pool
 	cr.TLSConf.ServerName = certificates.LegacyFakeDnsName
-	cr.TLSConf.MinVersion = tls.VersionTLS12
+	cr.TLSConf.MinVersion = tls.VersionTLS13
 }
 
 func (cr *CertCache) handleCertificateUpdate(_, new interface{}) {
diff --git a/pkg/queue/sharedmain/main.go b/pkg/queue/sharedmain/main.go
index a28d88775..0400d4164 100644
--- a/pkg/queue/sharedmain/main.go
+++ b/pkg/queue/sharedmain/main.go
@@ -32,7 +32,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/types"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netstats "knative.dev/networking/pkg/http/stats"
 	pkglogging "knative.dev/pkg/logging"
 	"knative.dev/pkg/logging/logkey"
diff --git a/pkg/reconciler/autoscaling/kpa/kpa.go b/pkg/reconciler/autoscaling/kpa/kpa.go
index e155aa56b..013022d2d 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa.go
@@ -25,6 +25,7 @@ import (
 	"go.uber.org/zap"
 
 	nv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/logging"
 	pkgmetrics "knative.dev/pkg/metrics"
 	"knative.dev/pkg/ptr"
@@ -128,7 +129,7 @@ func (c *Reconciler) ReconcileKind(ctx context.Context, pa *autoscalingv1alpha1.
 	// When activator CA is enabled, force activator always in path.
 	// TODO: This is a temporary state and to be fixed.
 	// See also issues/11906 and issues/12797.
-	case config.FromContext(ctx).Network.InternalEncryption:
+	case config.FromContext(ctx).Network.DataplaneTrust != netcfg.TrustDisabled:
 		mode = nv1alpha1.SKSOperationModeProxy
 
 	// If the want == -1 and PA is inactive that implies the autoscaler
diff --git a/pkg/reconciler/revision/reconcile_resources.go b/pkg/reconciler/revision/reconcile_resources.go
index 1ff13b27a..4818c35b9 100644
--- a/pkg/reconciler/revision/reconcile_resources.go
+++ b/pkg/reconciler/revision/reconcile_resources.go
@@ -28,7 +28,7 @@ import (
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	"knative.dev/pkg/kmeta"
 	"knative.dev/pkg/kmp"
 	"knative.dev/pkg/logging"
diff --git a/pkg/reconciler/route/resources/ingress.go b/pkg/reconciler/route/resources/ingress.go
index 588a37cfe..64bb51020 100644
--- a/pkg/reconciler/route/resources/ingress.go
+++ b/pkg/reconciler/route/resources/ingress.go
@@ -29,6 +29,7 @@ import (
 
 	"knative.dev/networking/pkg/apis/networking"
 	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	netheader "knative.dev/networking/pkg/http/header"
 	ingress "knative.dev/networking/pkg/ingress"
 	"knative.dev/pkg/kmeta"
@@ -149,7 +150,7 @@ func makeIngressSpec(
 				return netv1alpha1.IngressSpec{}, err
 			}
 			rule := makeIngressRule(domains, r.Namespace,
-				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.InternalEncryption)
+				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.DataplaneTrust != netcfg.TrustDisabled)
 			if featuresConfig.TagHeaderBasedRouting == apicfg.Enabled {
 				if rule.HTTP.Paths[0].AppendHeaders == nil {
 					rule.HTTP.Paths[0].AppendHeaders = make(map[string]string, 1)
@@ -171,7 +172,7 @@ func makeIngressSpec(
 					// Since names are sorted `DefaultTarget == ""` is the first one,
 					// so just pass the subslice.
 					rule.HTTP.Paths = append(
-						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.InternalEncryption, names[1:]), rule.HTTP.Paths...)
+						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.DataplaneTrust != netcfg.TrustDisabled, names[1:]), rule.HTTP.Paths...)
 				} else {
 					// If a request is routed by a tag-attached hostname instead of the tag header,
 					// the request may not have the tag header "Knative-Serving-Tag",
diff --git a/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE b/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE
deleted file mode 100644
index 261eeb9e9..000000000
--- a/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/knative.dev/control-protocol/LICENSE b/vendor/knative.dev/control-protocol/LICENSE
deleted file mode 100644
index 261eeb9e9..000000000
--- a/vendor/knative.dev/control-protocol/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
index 8d9530844..35787c8d5 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
@@ -29,7 +29,7 @@ func (c *Certificate) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates CertificateSpec object.
-func (spec *CertificateSpec) Validate(ctx context.Context) (all *apis.FieldError) {
+func (spec *CertificateSpec) Validate(_ context.Context) (all *apis.FieldError) {
 	// Spec must have at least one DNS Name.
 	if len(spec.DNSNames) == 0 {
 		all = all.Also(apis.ErrMissingField("dnsNames"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
index a0cec0126..1d3ff93c8 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
@@ -28,5 +28,5 @@ func (d *Domain) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in DomainSpec
-func (*DomainSpec) SetDefaults(ctx context.Context) {
+func (*DomainSpec) SetDefaults(_ context.Context) {
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
index d2434e234..85d556972 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
@@ -50,7 +50,7 @@ func (ds *DomainSpec) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-func (lb *LoadBalancerIngressSpec) Validate(ctx context.Context) *apis.FieldError {
+func (lb *LoadBalancerIngressSpec) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if lb.Domain == "" && lb.DomainInternal == "" && lb.IP == "" && !lb.MeshOnly {
 		return all.Also(apis.ErrMissingOneOf("domain", "domainInternal", "ip", "meshOnly"))
@@ -58,7 +58,7 @@ func (lb *LoadBalancerIngressSpec) Validate(ctx context.Context) *apis.FieldErro
 	return all
 }
 
-func (cfg *IngressConfig) Validate(ctx context.Context) *apis.FieldError {
+func (cfg *IngressConfig) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if cfg.Name == "" {
 		all = all.Also(apis.ErrMissingField("name"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
index 890717dd6..6cfc08524 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
@@ -38,7 +38,7 @@ func (is *IngressSpec) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in IngressTLS
-func (t *IngressTLS) SetDefaults(ctx context.Context) {}
+func (t *IngressTLS) SetDefaults(_ context.Context) {}
 
 // SetDefaults populates default values in IngressRule
 func (r *IngressRule) SetDefaults(ctx context.Context) {
@@ -56,7 +56,7 @@ func (h *HTTPIngressRuleValue) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in HTTPIngressPath
-func (h *HTTPIngressPath) SetDefaults(ctx context.Context) {
+func (h *HTTPIngressPath) SetDefaults(_ context.Context) {
 	// If only one split is specified, we default to 100.
 	if len(h.Splits) == 1 && h.Splits[0].Percent == 0 {
 		h.Splits[0].Percent = 100
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
index ed708d420..2a49acddb 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
@@ -152,7 +152,7 @@ func (b IngressBackend) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates IngressTLS object.
-func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
+func (t *IngressTLS) Validate(_ context.Context) *apis.FieldError {
 	// Provided TLS setting must not be empty.
 	if equality.Semantic.DeepEqual(t, &IngressTLS{}) {
 		return apis.ErrMissingField(apis.CurrentField)
@@ -168,7 +168,7 @@ func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-func (t HTTPOption) Validate(ctx context.Context) (all *apis.FieldError) {
+func (t HTTPOption) Validate(_ context.Context) (all *apis.FieldError) {
 	switch t {
 	case "", HTTPOptionEnabled, HTTPOptionRedirected:
 		break
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
index 85d7c41f1..5614104be 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
@@ -28,5 +28,5 @@ func (r *Realm) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in RealmSpec
-func (*RealmSpec) SetDefaults(ctx context.Context) {
+func (*RealmSpec) SetDefaults(_ context.Context) {
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
index 7137499d7..93caf7016 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
@@ -28,7 +28,7 @@ func (r *Realm) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates RealmSpec object.
-func (rs *RealmSpec) Validate(ctx context.Context) *apis.FieldError {
+func (rs *RealmSpec) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if rs.External == "" && rs.Internal == "" {
 		all = all.Also(apis.ErrMissingOneOf("external", "internal"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
index 884754d09..cb358ad90 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
@@ -24,6 +24,6 @@ func (ss *ServerlessService) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults sets default values on the ServerlessServiceSpec.
-func (*ServerlessServiceSpec) SetDefaults(ctx context.Context) {
+func (*ServerlessServiceSpec) SetDefaults(_ context.Context) {
 	// Nothing is defaultable so far.
 }
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/certs.go b/vendor/knative.dev/networking/pkg/certificates/certs.go
similarity index 71%
rename from vendor/knative.dev/control-protocol/pkg/certificates/certs.go
rename to vendor/knative.dev/networking/pkg/certificates/certs.go
index 68cb4f125..16cca6047 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/certs.go
+++ b/vendor/knative.dev/networking/pkg/certificates/certs.go
@@ -23,13 +23,9 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"math/big"
 	"time"
-
-	"go.uber.org/zap"
-	"knative.dev/pkg/logging"
 )
 
 var randReader = rand.Reader
@@ -39,7 +35,7 @@ var serialNumberLimit = new(big.Int).Lsh(big.NewInt(1), 128)
 func createCertTemplate(expirationInterval time.Duration, sans []string) (*x509.Certificate, error) {
 	serialNumber, err := rand.Int(randReader, serialNumberLimit)
 	if err != nil {
-		return nil, errors.New("failed to generate serial number: " + err.Error())
+		return nil, fmt.Errorf("failed to generate serial number: %w", err)
 	}
 
 	tmpl := x509.Certificate{
@@ -83,12 +79,12 @@ func createTransportCertTemplate(expirationInterval time.Duration, sans []string
 	return cert, err
 }
 
-func createCert(template, parent *x509.Certificate, pub, parentPriv interface{}) (cert *x509.Certificate, certPEM *pem.Block, err error) {
+func createCert(template, parent *x509.Certificate, pub, parentPriv interface{}) (certPEM *pem.Block, err error) {
 	certDER, err := x509.CreateCertificate(rand.Reader, template, parent, pub, parentPriv)
 	if err != nil {
 		return
 	}
-	cert, err = x509.ParseCertificate(certDER)
+	_, err = x509.ParseCertificate(certDER)
 	if err != nil {
 		return
 	}
@@ -97,24 +93,20 @@ func createCert(template, parent *x509.Certificate, pub, parentPriv interface{})
 }
 
 // CreateCACerts generates the root CA cert
-func CreateCACerts(ctx context.Context, expirationInterval time.Duration) (*KeyPair, error) {
-	logger := logging.FromContext(ctx)
+func CreateCACerts(expirationInterval time.Duration) (*KeyPair, error) {
 	caKeyPair, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		logger.Errorw("error generating random key", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating random key: %w", err)
 	}
 
 	rootCertTmpl, err := createCACertTemplate(expirationInterval)
 	if err != nil {
-		logger.Errorw("error generating CA cert", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating CA cert: %w", err)
 	}
 
-	_, caCertPem, err := createCert(rootCertTmpl, rootCertTmpl, &caKeyPair.PublicKey, caKeyPair)
+	caCertPem, err := createCert(rootCertTmpl, rootCertTmpl, &caKeyPair.PublicKey, caKeyPair)
 	if err != nil {
-		logger.Errorw("error signing the CA cert", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error signing the CA cert: %w", err)
 	}
 	caPrivateKeyPem := &pem.Block{
 		Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(caKeyPair),
@@ -123,37 +115,33 @@ func CreateCACerts(ctx context.Context, expirationInterval time.Duration) (*KeyP
 }
 
 // Deprecated: CreateControlPlaneCert generates the certificate for the client
-func CreateControlPlaneCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
-	return CreateCert(ctx, caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
+func CreateControlPlaneCert(_ context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
+	return CreateCert(caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
 }
 
 // Deprecated: CreateDataPlaneCert generates the certificate for the server
-func CreateDataPlaneCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
-	return CreateCert(ctx, caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
+func CreateDataPlaneCert(_ context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
+	return CreateCert(caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
 }
 
 // CreateCert generates the certificate for use by client and server
-func CreateCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration, sans ...string) (*KeyPair, error) {
-	logger := logging.FromContext(ctx)
+func CreateCert(caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration, sans ...string) (*KeyPair, error) {
 
 	// Then create the private key for the serving cert
 	keyPair, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		logger.Errorw("error generating random key", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating random key: %w", err)
 	}
 
 	certTemplate, err := createTransportCertTemplate(expirationInterval, sans)
 	if err != nil {
-		logger.Errorw("failed to create the certificate template", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("failed to create the certificate template: %w", err)
 	}
 
 	// create a certificate which wraps the public key, sign it with the CA private key
-	_, certPEM, err := createCert(certTemplate, caCertificate, &keyPair.PublicKey, caKey)
+	certPEM, err := createCert(certTemplate, caCertificate, &keyPair.PublicKey, caKey)
 	if err != nil {
-		logger.Errorw("error signing certificate template", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error signing certificate template: %w", err)
 	}
 
 	privateKeyPEM := &pem.Block{
@@ -187,9 +175,9 @@ func ParseCert(certPemBytes []byte, privateKeyPemBytes []byte) (*x509.Certificat
 	return cert, pk, err
 }
 
-// ValidateCert checks the expiration of the certificate
-func ValidateCert(cert *x509.Certificate, rotationThreshold time.Duration) error {
-	if !cert.NotAfter.After(time.Now().Add(rotationThreshold)) {
+// CheckExpiry checks the expiration of the certificate
+func CheckExpiry(cert *x509.Certificate, rotationThreshold time.Duration) error {
+	if time.Now().Add(rotationThreshold).After(cert.NotAfter) {
 		return fmt.Errorf("certificate is going to expire %v", cert.NotAfter)
 	}
 	return nil
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/constants.go b/vendor/knative.dev/networking/pkg/certificates/constants.go
similarity index 75%
rename from vendor/knative.dev/control-protocol/pkg/certificates/constants.go
rename to vendor/knative.dev/networking/pkg/certificates/constants.go
index cfb125e33..04a1d7747 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/constants.go
+++ b/vendor/knative.dev/networking/pkg/certificates/constants.go
@@ -19,9 +19,12 @@ package certificates
 import "strings"
 
 const (
-	Organization           = "knative.dev"
-	LegacyFakeDnsName      = "data-plane." + Organization
-	FakeDnsName            = LegacyFakeDnsName // Deprecated
+	Organization = "knative.dev"
+	//nolint:all
+	LegacyFakeDnsName = "data-plane." + Organization
+	//nolint:all
+	// Deprecated: FakeDnsName is deprecated. Please use the DataPlaneRoutingName or DataPlaneUserName function.
+	FakeDnsName            = LegacyFakeDnsName
 	dataPlaneUserPrefix    = "kn-user-"
 	dataPlaneRoutingPrefix = "kn-routing-"
 	ControlPlaneName       = "kn-control"
@@ -33,18 +36,21 @@ const (
 	PrivateKeyName = "tls.key"
 
 	//These should be able to be deprecated some time in the future when the new names are fully adopted
+	// #nosec
 	SecretCaCertKey = "ca-cert.pem"
-	SecretCertKey   = "public-cert.pem"
-	SecretPKKey     = "private-key.pem"
+	// #nosec
+	SecretCertKey = "public-cert.pem"
+	// #nosec
+	SecretPKKey = "private-key.pem"
 )
 
 // DataPlaneRoutingName constructs a san for a data-plane-routing certificate
 // Accepts a routingId  - a unique identifier used as part of the san (default is "0" used when an empty routingId is provided)
-func DataPlaneRoutingName(routingId string) string {
-	if routingId == "" {
-		routingId = "0"
+func DataPlaneRoutingName(routingID string) string {
+	if routingID == "" {
+		routingID = "0"
 	}
-	return dataPlaneRoutingPrefix + strings.ToLower(routingId)
+	return dataPlaneRoutingPrefix + strings.ToLower(routingID)
 }
 
 // DataPlaneUserName constructs a san for a data-plane-user certificate
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/key_pair.go b/vendor/knative.dev/networking/pkg/certificates/key_pair.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/key_pair.go
rename to vendor/knative.dev/networking/pkg/certificates/key_pair.go
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
similarity index 86%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
index c6687a81b..8a4ced724 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go
+++ b/vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
@@ -17,6 +17,7 @@ limitations under the License.
 package sample
 
 import (
+	"bytes"
 	"context"
 	"crypto/rsa"
 	"crypto/x509"
@@ -34,7 +35,7 @@ import (
 	pkgreconciler "knative.dev/pkg/reconciler"
 	"knative.dev/pkg/system"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 )
 
 const (
@@ -89,14 +90,14 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 		r.logger.Errorf("Error accessing CA certificate secret %q %q: %v", system.Namespace(), r.caSecretName, err)
 		return err
 	}
-	caCert, caPk, err := parseAndValidateSecret(caSecret, false)
+	caCert, caPk, err := parseAndValidateSecret(caSecret, nil)
 	if err != nil {
 		r.logger.Infof("CA cert invalid: %v", err)
 
 		// We need to generate a new CA cert, then shortcircuit the reconciler
-		keyPair, err := certificates.CreateCACerts(ctx, caExpirationInterval)
+		keyPair, err := certificates.CreateCACerts(caExpirationInterval)
 		if err != nil {
-			return fmt.Errorf("cannot generate the CA cert: %v", err)
+			return fmt.Errorf("cannot generate the CA cert: %w", err)
 		}
 		return r.commitUpdatedSecret(ctx, caSecret, keyPair, nil)
 	}
@@ -107,8 +108,8 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 	case controlPlaneSecretType:
 		sans = []string{certificates.ControlPlaneName, certificates.LegacyFakeDnsName}
 	case dataPlaneRoutingSecretType:
-		routingId := secret.Labels[secretRoutingId]
-		san := certificates.DataPlaneRoutingName(routingId)
+		routingID := secret.Labels[secretRoutingID]
+		san := certificates.DataPlaneRoutingName(routingID)
 		sans = []string{san, certificates.LegacyFakeDnsName}
 	case dataPlaneUserSecretType:
 		sans = []string{certificates.DataPlaneUserName(secret.Namespace), certificates.LegacyFakeDnsName}
@@ -118,15 +119,15 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 		return fmt.Errorf("unknown cert type: %v", r.secretTypeLabelName)
 	}
 
-	cert, _, err := parseAndValidateSecret(secret, true, sans...)
+	cert, _, err := parseAndValidateSecret(secret, caSecret.Data[certificates.SecretCertKey], sans...)
 	if err != nil {
 		r.logger.Infof("Secret invalid: %v", err)
 		// Check the secret to reconcile type
 
 		var keyPair *certificates.KeyPair
-		keyPair, err = certificates.CreateCert(ctx, caPk, caCert, expirationInterval, sans...)
+		keyPair, err = certificates.CreateCert(caPk, caCert, expirationInterval, sans...)
 		if err != nil {
-			return fmt.Errorf("cannot generate the cert: %v", err)
+			return fmt.Errorf("cannot generate the cert: %w", err)
 		}
 		err = r.commitUpdatedSecret(ctx, secret, keyPair, caSecret.Data[certificates.SecretCertKey])
 		if err != nil {
@@ -144,7 +145,7 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 }
 
 // All sans provided are required to be lower case
-func parseAndValidateSecret(secret *corev1.Secret, shouldContainCaCert bool, sans ...string) (*x509.Certificate, *rsa.PrivateKey, error) {
+func parseAndValidateSecret(secret *corev1.Secret, caCert []byte, sans ...string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	certBytes, ok := secret.Data[certificates.SecretCertKey]
 	if !ok {
 		return nil, nil, fmt.Errorf("missing cert bytes")
@@ -153,17 +154,21 @@ func parseAndValidateSecret(secret *corev1.Secret, shouldContainCaCert bool, san
 	if !ok {
 		return nil, nil, fmt.Errorf("missing pk bytes")
 	}
-	if shouldContainCaCert {
-		if _, ok := secret.Data[certificates.SecretCaCertKey]; !ok {
+	if caCert != nil {
+		ca, ok := secret.Data[certificates.SecretCaCertKey]
+		if !ok {
 			return nil, nil, fmt.Errorf("missing ca cert bytes")
 		}
+		if !bytes.Equal(ca, caCert) {
+			return nil, nil, fmt.Errorf("ca cert bytes changed")
+		}
 	}
 
 	cert, caPk, err := certificates.ParseCert(certBytes, pkBytes)
 	if err != nil {
 		return nil, nil, err
 	}
-	if err := certificates.ValidateCert(cert, rotationThreshold); err != nil {
+	if err := certificates.CheckExpiry(cert, rotationThreshold); err != nil {
 		return nil, nil, err
 	}
 
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
similarity index 98%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
index 88bac5a21..dab349547 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go
+++ b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
@@ -38,7 +38,7 @@ import (
 const (
 	caSecretNamePostfix    = "-ctrl-ca"
 	secretLabelNamePostfix = "-ctrl"
-	secretRoutingId        = "routing-id"
+	secretRoutingID        = "routing-id"
 )
 
 // NewControllerFactory generates a ControllerConstructor for the control certificates reconciler.
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller_impl.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller_impl.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller_impl.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/controller_impl.go
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/reconciler.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/reconciler.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/reconciler.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/reconciler.go
diff --git a/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go b/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go
index 491c13f1f..1f6ee8264 100644
--- a/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go
+++ b/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go
@@ -23,6 +23,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+
 	"knative.dev/pkg/apis/duck/ducktypes"
 
 	"knative.dev/pkg/apis"
@@ -41,6 +42,7 @@ type KRShaped interface {
 // Asserts KResource conformance with KRShaped
 var _ KRShaped = (*KResource)(nil)
 
+// +genduck
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // KResource is a skeleton type wrapping Conditions in the manner we expect
@@ -54,6 +56,11 @@ type KResource struct {
 	Status Status `json:"status"`
 }
 
+// GetFullType implements duck.Implementable
+func (*KResource) GetFullType() ducktypes.Populatable {
+	return &KResource{}
+}
+
 // Populate implements duck.Populatable
 func (t *KResource) Populate() {
 	t.Status.ObservedGeneration = 42
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go
index b50fcf8f4..ba50005d7 100644
--- a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go
@@ -46,13 +46,6 @@ func NewAdmissionController(
 	callbacks ...map[schema.GroupVersionKind]Callback,
 ) *controller.Impl {
 
-	client := kubeclient.Get(ctx)
-	mwhInformer := mwhinformer.Get(ctx)
-	secretInformer := secretinformer.Get(ctx)
-	options := webhook.GetOptions(ctx)
-
-	key := types.NamespacedName{Name: name}
-
 	// This not ideal, we are using a variadic argument to effectively make callbacks optional
 	// This allows this addition to be non-breaking to consumers of /pkg
 	// TODO: once all sub-repos have adopted this, we might move this back to a traditional param.
@@ -66,6 +59,34 @@ func NewAdmissionController(
 		panic("NewAdmissionController may not be called with multiple callback maps")
 	}
 
+	opts := []OptionFunc{
+		WithPath(path),
+		WithTypes(handlers),
+		WithWrapContext(wc),
+		WithCallbacks(unwrappedCallbacks),
+	}
+
+	if disallowUnknownFields {
+		opts = append(opts, WithDisallowUnknownFields())
+	}
+
+	return newController(ctx, name, opts...)
+}
+
+func newController(ctx context.Context, name string, optsFunc ...OptionFunc) *controller.Impl {
+	client := kubeclient.Get(ctx)
+	mwhInformer := mwhinformer.Get(ctx)
+	secretInformer := secretinformer.Get(ctx)
+
+	opts := &options{}
+	wopts := webhook.GetOptions(ctx)
+
+	for _, f := range optsFunc {
+		f(opts)
+	}
+
+	key := types.NamespacedName{Name: name}
+
 	wh := &reconciler{
 		LeaderAwareFuncs: pkgreconciler.LeaderAwareFuncs{
 			// Have this reconciler enqueue our singleton whenever it becomes leader.
@@ -76,13 +97,13 @@ func NewAdmissionController(
 		},
 
 		key:       key,
-		path:      path,
-		handlers:  handlers,
-		callbacks: unwrappedCallbacks,
+		path:      opts.path,
+		handlers:  opts.types,
+		callbacks: opts.callbacks,
 
-		withContext:           wc,
-		disallowUnknownFields: disallowUnknownFields,
-		secretName:            options.SecretName,
+		withContext:           opts.wc,
+		disallowUnknownFields: opts.disallowUnknownFields,
+		secretName:            wopts.SecretName,
 
 		client:       client,
 		mwhlister:    mwhInformer.Lister(),
@@ -90,8 +111,12 @@ func NewAdmissionController(
 	}
 
 	logger := logging.FromContext(ctx)
-	const queueName = "DefaultingWebhook"
-	c := controller.NewContext(ctx, wh, controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)})
+	controllerOptions := wopts.ControllerOptions
+	if controllerOptions == nil {
+		const queueName = "DefaultingWebhook"
+		controllerOptions = &controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)}
+	}
+	c := controller.NewContext(ctx, wh, *controllerOptions)
 
 	// Reconcile when the named MutatingWebhookConfiguration changes.
 	mwhInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/options.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/options.go
new file mode 100644
index 000000000..deb04945a
--- /dev/null
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/options.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package defaulting
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"knative.dev/pkg/webhook/resourcesemantics"
+)
+
+type options struct {
+	path                  string
+	types                 map[schema.GroupVersionKind]resourcesemantics.GenericCRD
+	wc                    func(context.Context) context.Context
+	disallowUnknownFields bool
+	callbacks             map[schema.GroupVersionKind]Callback
+}
+
+type OptionFunc func(*options)
+
+func WithCallbacks(callbacks map[schema.GroupVersionKind]Callback) OptionFunc {
+	return func(o *options) {
+		o.callbacks = callbacks
+	}
+}
+
+func WithPath(path string) OptionFunc {
+	return func(o *options) {
+		o.path = path
+	}
+}
+
+func WithTypes(types map[schema.GroupVersionKind]resourcesemantics.GenericCRD) OptionFunc {
+	return func(o *options) {
+		o.types = types
+	}
+}
+
+func WithWrapContext(f func(context.Context) context.Context) OptionFunc {
+	return func(o *options) {
+		o.wc = f
+	}
+}
+
+func WithDisallowUnknownFields() OptionFunc {
+	return func(o *options) {
+		o.disallowUnknownFields = true
+	}
+}
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go
index 8e8e008e6..eee6105b4 100644
--- a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go
@@ -45,10 +45,31 @@ func NewAdmissionControllerWithConfig(
 	disallowUnknownFields bool,
 	callbacks map[schema.GroupVersionKind]Callback,
 ) *controller.Impl {
+
+	opts := []OptionFunc{
+		WithPath(path),
+		WithTypes(handlers),
+		WithWrapContext(wc),
+		WithCallbacks(callbacks),
+	}
+
+	if disallowUnknownFields {
+		opts = append(opts, WithDisallowUnknownFields())
+	}
+	return newController(ctx, name, opts...)
+}
+
+func newController(ctx context.Context, name string, optsFunc ...OptionFunc) *controller.Impl {
 	client := kubeclient.Get(ctx)
 	vwhInformer := vwhinformer.Get(ctx)
 	secretInformer := secretinformer.Get(ctx)
-	options := webhook.GetOptions(ctx)
+	woptions := webhook.GetOptions(ctx)
+
+	opts := &options{}
+
+	for _, f := range optsFunc {
+		f(opts)
+	}
 
 	wh := &reconciler{
 		LeaderAwareFuncs: pkgreconciler.LeaderAwareFuncs{
@@ -62,13 +83,13 @@ func NewAdmissionControllerWithConfig(
 		key: types.NamespacedName{
 			Name: name,
 		},
-		path:      path,
-		handlers:  handlers,
-		callbacks: callbacks,
+		path:      opts.path,
+		handlers:  opts.types,
+		callbacks: opts.callbacks,
 
-		withContext:           wc,
-		disallowUnknownFields: disallowUnknownFields,
-		secretName:            options.SecretName,
+		withContext:           opts.wc,
+		disallowUnknownFields: opts.DisallowUnknownFields(),
+		secretName:            woptions.SecretName,
 
 		client:       client,
 		vwhlister:    vwhInformer.Lister(),
@@ -76,8 +97,13 @@ func NewAdmissionControllerWithConfig(
 	}
 
 	logger := logging.FromContext(ctx)
-	const queueName = "ValidationWebhook"
-	c := controller.NewContext(ctx, wh, controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)})
+
+	controllerOptions := woptions.ControllerOptions
+	if woptions.ControllerOptions == nil {
+		const queueName = "ValidationWebhook"
+		controllerOptions = &controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)}
+	}
+	c := controller.NewContext(ctx, wh, *controllerOptions)
 
 	// Reconcile when the named ValidatingWebhookConfiguration changes.
 	vwhInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/options.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/options.go
new file mode 100644
index 000000000..108453b6e
--- /dev/null
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/options.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"knative.dev/pkg/webhook/resourcesemantics"
+)
+
+type options struct {
+	path                  string
+	types                 map[schema.GroupVersionKind]resourcesemantics.GenericCRD
+	wc                    func(context.Context) context.Context
+	disallowUnknownFields bool
+	callbacks             map[schema.GroupVersionKind]Callback
+}
+
+type OptionFunc func(*options)
+
+func WithCallbacks(callbacks map[schema.GroupVersionKind]Callback) OptionFunc {
+	return func(o *options) {
+		o.callbacks = callbacks
+	}
+}
+
+func WithPath(path string) OptionFunc {
+	return func(o *options) {
+		o.path = path
+	}
+}
+
+func WithTypes(types map[schema.GroupVersionKind]resourcesemantics.GenericCRD) OptionFunc {
+	return func(o *options) {
+		o.types = types
+	}
+}
+
+func WithWrapContext(f func(context.Context) context.Context) OptionFunc {
+	return func(o *options) {
+		o.wc = f
+	}
+}
+
+func WithDisallowUnknownFields() OptionFunc {
+	return func(o *options) {
+		o.disallowUnknownFields = true
+	}
+}
+
+func (o *options) DisallowUnknownFields() bool {
+	return o.disallowUnknownFields
+}
diff --git a/vendor/knative.dev/pkg/webhook/webhook.go b/vendor/knative.dev/pkg/webhook/webhook.go
index 80bd8c2be..92dd01ae3 100644
--- a/vendor/knative.dev/pkg/webhook/webhook.go
+++ b/vendor/knative.dev/pkg/webhook/webhook.go
@@ -29,6 +29,7 @@ import (
 
 	// Injection stuff
 
+	"knative.dev/pkg/controller"
 	kubeinformerfactory "knative.dev/pkg/injection/clients/namespacedkube/informers/factory"
 	"knative.dev/pkg/network/handlers"
 
@@ -69,6 +70,10 @@ type Options struct {
 	// GracePeriod is how long to wait after failing readiness probes
 	// before shutting down.
 	GracePeriod time.Duration
+
+	// ControllerOptions encapsulates options for creating a new controller,
+	// including throttling and stats behavior.
+	ControllerOptions *controller.ControllerOptions
 }
 
 // Operation is the verb being operated on
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 1c981b28a..14291b751 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1243,7 +1243,7 @@ k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/strings/slices
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6
+# knative.dev/caching v0.0.0-20230606020828-6d4828eeb3b8
 ## explicit; go 1.18
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -1264,20 +1264,18 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d
-## explicit; go 1.18
-knative.dev/control-protocol/pkg/certificates
-knative.dev/control-protocol/pkg/certificates/reconciler
-# knative.dev/hack v0.0.0-20230530201435-5b7907fbe350
+# knative.dev/hack v0.0.0-20230606014732-a861c8e9da08
 ## explicit; go 1.18
 knative.dev/hack
 knative.dev/hack/shell
-# knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60
+# knative.dev/networking v0.0.0-20230606132626-14a2bd466ad6
 ## explicit; go 1.18
 knative.dev/networking/config
 knative.dev/networking/pkg
 knative.dev/networking/pkg/apis/networking
 knative.dev/networking/pkg/apis/networking/v1alpha1
+knative.dev/networking/pkg/certificates
+knative.dev/networking/pkg/certificates/reconciler
 knative.dev/networking/pkg/client/clientset/versioned
 knative.dev/networking/pkg/client/clientset/versioned/fake
 knative.dev/networking/pkg/client/clientset/versioned/scheme
@@ -1309,7 +1307,7 @@ knative.dev/networking/pkg/http/stats
 knative.dev/networking/pkg/ingress
 knative.dev/networking/pkg/k8s
 knative.dev/networking/pkg/prober
-# knative.dev/pkg v0.0.0-20230531073936-5671699f23d9
+# knative.dev/pkg v0.0.0-20230612155445-74c4be5e935e
 ## explicit; go 1.18
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index a74d64dd8..edfa0135e 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -87,9 +87,9 @@ jobs:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         k8s-version:
-        - v1.25.9
-        - v1.26.4
-        - v1.27.1
+        - v1.25.x
+        - v1.26.x
+        - v1.27.x
 
         ingress:
         - kourier
@@ -105,22 +105,6 @@ jobs:
         - e2e
 
         include:
-          # Map between K8s and KinD versions.
-          # This is attempting to make it a bit clearer what's being tested.
-          # See: https://github.com/kubernetes-sigs/kind/releases
-          #      https://hub.docker.com/r/kindest/node/tags
-        - k8s-version: v1.25.9
-          kind-version: v0.19.0
-          kind-image-sha: sha256:c08d6c52820aa42e533b70bce0c2901183326d86dcdcbedecc9343681db45161
-
-        - k8s-version: v1.26.4
-          kind-version: v0.19.0
-          kind-image-sha: sha256:f4c0d87be03d6bea69f5e5dc0adb678bb498a190ee5c38422bf751541cebe92e
-
-        - k8s-version: v1.27.1
-          kind-version: v0.19.0
-          kind-image-sha: sha256:b7d12ed662b873bd8510879c1846e87c7e676a79fefc93e17b2a52989d3ff42b
-
         # Disabled due to consistent failures
         # - ingress: gateway_istio
         #   ingress-class: gateway-api
@@ -166,15 +150,23 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-go-
 
+    - uses: actions/download-artifact@v3
+      with:
+        name: artifacts
+        path: ~/artifacts
+
+    - name: Setup KinD 
+      uses: chainguard-dev/actions/setup-kind@main
+      with:
+        k8s-version: ${{ matrix.k8s-version }}
+        kind-worker-count: 4
+        cluster-suffix: c${{ github.run_id }}.local
+        registry-volume: $HOME/artifacts/registry
+
+ 
     - name: Install Dependencies
       run: |
         set -x
-        echo "::group:: install kind ${KIND_VERSION}"
-        curl -Lo ./kind https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-amd64
-        chmod +x ./kind
-        sudo mv kind /usr/local/bin
-        echo "::endgroup::"
-
         echo "::group:: install gotestsum ${GOTESTSUM_VERSION}"
         curl -L https://github.com/gotestyourself/gotestsum/releases/download/v${GOTESTSUM_VERSION}/gotestsum_${GOTESTSUM_VERSION}_linux_amd64.tar.gz | tar xzf - gotestsum
         chmod +x ./gotestsum
@@ -197,113 +189,6 @@ jobs:
       with:
         fetch-depth: 0
 
-    - uses: actions/download-artifact@v3
-      with:
-        name: artifacts
-        path: ~/artifacts
-
-    - name: Configure KinD Cluster
-      run: |
-        set -x
-
-        # Disable swap otherwise memory enforcement doesn't work
-        # See: https://kubernetes.slack.com/archives/CEKK1KTN2/p1600009955324200
-        sudo swapoff -a
-        sudo rm -f /swapfile
-
-        # Use in-memory storage to avoid etcd server timeouts.
-        # https://kubernetes.slack.com/archives/CEKK1KTN2/p1615134111016300
-        # https://github.com/kubernetes-sigs/kind/issues/845
-        sudo mkdir -p /tmp/etcd
-        sudo mount -t tmpfs tmpfs /tmp/etcd
-
-        # KinD configuration.
-        cat > kind.yaml <<EOF
-        apiVersion: kind.x-k8s.io/v1alpha4
-        kind: Cluster
-
-        # Configure registry for KinD.
-        containerdConfigPatches:
-        - |-
-          [plugins."io.containerd.grpc.v1.cri".registry.mirrors."$REGISTRY_NAME:$REGISTRY_PORT"]
-            endpoint = ["http://$REGISTRY_NAME:$REGISTRY_PORT"]
-          [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
-            endpoint = ["https://mirror.gcr.io"]
-
-        # This is needed in order to support projected volumes with service account tokens.
-        # See: https://kubernetes.slack.com/archives/CEKK1KTN2/p1600268272383600
-        kubeadmConfigPatches:
-          - |
-            kind: ClusterConfiguration
-            metadata:
-              name: config
-            apiServer:
-              extraArgs:
-                "service-account-issuer": "kubernetes.default.svc"
-                "service-account-signing-key-file": "/etc/kubernetes/pki/sa.key"
-            networking:
-              dnsDomain: "${CLUSTER_DOMAIN}"
-
-        nodes:
-        - role: control-plane
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-          extraMounts:
-          - containerPath: /var/lib/etcd
-            hostPath: /tmp/etcd
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        EOF
-
-        kind create cluster --config kind.yaml --wait 5m
-
-    - name: Install metallb
-      shell: bash
-      run: |
-        # Install metallb
-        # disable the webhook-mode because there is a bug:https://github.com/metallb/metallb/issues/1597
-        # this webhook only checks crd, it has not effects to out e2e tests
-        curl https://raw.githubusercontent.com/metallb/metallb/v0.13.5/config/manifests/metallb-native.yaml -k | \
-         sed '0,/args:/s//args:\n        - --webhook-mode=disabled/' | \
-         sed '/apiVersion: admissionregistration/,$d' | \
-         kubectl apply -f -
-
-        # Add Layer 2 config
-        network=$(docker network inspect kind -f "{{(index .IPAM.Config 0).Subnet}}" | cut -d '.' -f1,2)
-        cat <<EOF | kubectl apply -f -
-        apiVersion: metallb.io/v1beta1
-        kind: IPAddressPool
-        metadata:
-          name: first-pool
-          namespace: metallb-system
-        spec:
-          addresses:
-          - $network.255.1-$network.255.250
-        ---
-        apiVersion: metallb.io/v1beta1
-        kind: L2Advertisement
-        metadata:
-          name: example
-          namespace: metallb-system
-        EOF
-
-    - name: Setup local registry
-      run: |
-        # Run a registry.
-        docker run -d --restart=always \
-          -v $HOME/artifacts/registry:/var/lib/registry \
-          -p $REGISTRY_PORT:$REGISTRY_PORT --name $REGISTRY_NAME registry:2
-        # Connect the registry to the KinD network.
-        docker network connect "kind" $REGISTRY_NAME
-        # Make the $REGISTRY_NAME -> 127.0.0.1, to tell `ko` to publish to
-        # local registry, even when pushing $REGISTRY_NAME:$REGISTRY_PORT/some/image
-        sudo echo "127.0.0.1 $REGISTRY_NAME" | sudo tee -a /etc/hosts
-
     - name: Install Serving & Ingress
       run: |
         set -x
@@ -329,12 +214,13 @@ jobs:
           -timeout=30m \
           ${{ matrix.test-path }} \
           -skip-cleanup-on-fail \
-          ${{ matrix.test-flags || '-enable-alpha -enable-beta' }} \
+          -enable-alpha -enable-beta \
           --ingress-class=${{ matrix.ingress-class || matrix.ingress }}.ingress.networking.knative.dev
+ 
     - uses: chainguard-dev/actions/kind-diag@main
       # Only upload logs on failure.
       if: ${{ failure() }}
       with:
-        cluster-resources: nodes,namespaces,crds,${{ matrix.cluster-resources || '' }}
+        cluster-resources: nodes,namespaces,crds
         namespace-resources: configmaps,pods,svc,ksvc,route,configuration,revision,king,${{ matrix.namespace-resources || '' }}
         artifact-name: logs-${{ matrix.k8s-version}}-${{ matrix.ingress }}-${{ matrix.test-suite }}
diff --git a/pkg/activator/certificate/cache_test.go b/pkg/activator/certificate/cache_test.go
index d417e80d4..5378bb2c6 100644
--- a/pkg/activator/certificate/cache_test.go
+++ b/pkg/activator/certificate/cache_test.go
@@ -31,7 +31,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/tools/cache"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netcfg "knative.dev/networking/pkg/config"
 	fakekubeclient "knative.dev/pkg/client/injection/kube/client/fake"
 	fakesecretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret/fake"
diff --git a/pkg/activator/net/throttler_test.go b/pkg/activator/net/throttler_test.go
index d8735078f..5d15a7d7c 100644
--- a/pkg/activator/net/throttler_test.go
+++ b/pkg/activator/net/throttler_test.go
@@ -65,130 +65,195 @@ func newTestThrottler(ctx context.Context) *Throttler {
 
 func TestThrottlerUpdateCapacity(t *testing.T) {
 	logger := TestLogger(t)
-	rt := &revisionThrottler{
-		logger:               logger,
-		breaker:              queue.NewBreaker(testBreakerParams),
-		containerConcurrency: 10,
-	}
-
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(100)
-	if got, want := rt.breaker.Capacity(), 100*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(5)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10/5; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(200)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
 
-	// now test with CC=0.
-	// in the CC=0 cases we use the infinite breaker whose capacity can either be
-	// totally blocked (0) or totally open (1).
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	rt.numActivators.Store(200)
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// shouldn't really happen since revisionMaxConcurrency is very, very large,
-	// but check that we behave reasonably if it's exceeded.
-	capacity := rt.calculateCapacity(revisionMaxConcurrency+5, 1)
-	if got, want := capacity, queue.MaxBreakerCapacity; got != want {
-		t.Errorf("calculateCapacity = %d, want: %d", got, want)
-	}
-
-	// Now test with podIP trackers in tow.
-	// Simple case.
-	rt.numActivators.Store(1)
-	rt.activatorIndex.Store(0)
-	rt.podTrackers = makeTrackers(1, 10)
-	rt.containerConcurrency = 10
-	rt.breaker = queue.NewBreaker(testBreakerParams)
-
-	rt.updateCapacity(0 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 backends.
-	rt.podTrackers = makeTrackers(2, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 20; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 activators.
-	rt.numActivators.Store(2)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 0.
-	rt.podTrackers = makeTrackers(3, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 1.
-	rt.activatorIndex.Store(1)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
+	tests := []struct {
+		name                 string
+		capacity             int
+		numActivators        int32
+		activatorIndex       int32
+		containerConcurrency int
+		isNewInfiniteBreaker bool
+		podTrackers          []*podTracker
+		want                 int
+		checkAssignedPod     bool
+	}{{
+		name:                 "capacity: 1, cc: 10",
+		capacity:             1,
+		containerConcurrency: 10,
+		want:                 1 * 10,
+	}, {
+		name:                 "capacity: 10, cc: 10",
+		capacity:             10,
+		containerConcurrency: 10,
+		want:                 10 * 10,
+	}, {
+		name:                 "capacity: 100, cc: 10",
+		capacity:             100,
+		containerConcurrency: 10,
+		want:                 100 * 10,
+	}, {
+		name:                 "numActivators: 5, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        5,
+		containerConcurrency: 10,
+		want:                 10 * 10 / 5,
+	}, {
+		name:                 "numActivators: 200, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 1,
+	}, {
+		name:                 "numActivators: 200, capacity: 0, cc: 10",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 0,
+	}, {
+		// now test with CC=0.
+		// in the CC=0 cases we use the infinite breaker whose capacity can either be
+		// totally blocked (0) or totally open (1).
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 10, cc: 0",
+		capacity:             10,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		// Now test with podIP trackers in tow.
+		// Simple case.
+		name:                 "numActivators: 1, capacity: 0, cc: 10, trackers(1, 10)",
+		capacity:             0,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(1, 10),
+		want:                 10,
+	}, {
+		name:                 "2 backends. numActivators: 1, capacity: -1, cc: 10, trackers(2, 10)",
+		capacity:             -1,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 20,
+	}, {
+		name:                 "2 activators. numActivators: 2, capacity: -1, cc: 10, trackers(2, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 10,
+	}, {
+		name:                 "3 pods, index 0. numActivators: 2, index: 0, capacity: -1, cc: 10, trackers(3, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 15,
+	}, {
+		name:                 "3 pods, index 1. numActivators: 2, index: 1, capacity: -1, cc: 10, trackers(3, 10)",
+		capacity:             -1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 15,
+	}, {
+		name:                 "Infinite capacity with podIP trackers.",
+		capacity:             1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 0,
+		podTrackers:          makeTrackers(3, 0),
+		isNewInfiniteBreaker: true,
+		want:                 1,
+		checkAssignedPod:     true,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              queue.NewBreaker(testBreakerParams),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			rt.activatorIndex.Store(tt.activatorIndex)
+			rt.podTrackers = tt.podTrackers
+			if tt.isNewInfiniteBreaker {
+				rt.breaker = newInfiniteBreaker(logger)
+			}
+			rt.updateCapacity(tt.capacity)
+			if got := rt.breaker.Capacity(); got != tt.want {
+				t.Errorf("Capacity = %d, want: %d", got, tt.want)
+			}
+			if tt.checkAssignedPod {
+				if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
+					t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
+						cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+				}
+			}
+		})
 	}
+}
 
-	// Infinite capacity with podIP trackers.
-	rt.activatorIndex.Store(1)
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-	rt.podTrackers = makeTrackers(3, 0)
-	rt.updateCapacity(1)
+func TestThrottlerCalculateCapacity(t *testing.T) {
+	logger := TestLogger(t)
 
-	// infinite breaker capacity is either 0 (blocked) or 1 (totally open)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
-		t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
-			cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+	tests := []struct {
+		name                 string
+		numActivators        int32
+		containerConcurrency int
+		size                 int
+		activatorCount       int
+	}{{
+		name:                 "over revisionMaxConcurrency",
+		numActivators:        200,
+		containerConcurrency: 0,
+		size:                 revisionMaxConcurrency + 5,
+		activatorCount:       1,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              newInfiniteBreaker(logger),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			// shouldn't really happen since revisionMaxConcurrency is very, very large,
+			// but check that we behave reasonably if it's exceeded.
+			capacity := rt.calculateCapacity(tt.size, tt.activatorCount)
+			if got, want := capacity, queue.MaxBreakerCapacity; got != want {
+				t.Errorf("calculateCapacity = %d, want: %d", got, want)
+			}
+		})
 	}
 }
 
diff --git a/pkg/reconciler/autoscaling/config/store_test.go b/pkg/reconciler/autoscaling/config/store_test.go
index 06681f0ef..6de86bbf9 100644
--- a/pkg/reconciler/autoscaling/config/store_test.go
+++ b/pkg/reconciler/autoscaling/config/store_test.go
@@ -66,17 +66,17 @@ func TestStoreImmutableConfig(t *testing.T) {
 	config := store.Load()
 	config.Autoscaler.MaxScaleUpRate = 100.0
 	config.Deployment.ProgressDeadline = 3 * time.Minute
-	config.Network.InternalEncryption = true
+	config.Network.DataplaneTrust = netcfg.TrustMinimal
 	newConfig := store.Load()
 
 	if newConfig.Autoscaler.MaxScaleUpRate == 100.0 {
-		t.Error("Autoscaler config is not immuable")
+		t.Error("Autoscaler config is not immutable")
 	}
 	if newConfig.Deployment.ProgressDeadline == 3*time.Minute {
-		t.Error("Deployment config is not immuable")
+		t.Error("Deployment config is not immutable")
 	}
 
-	if newConfig.Network.InternalEncryption {
-		t.Error("Network config is not immuable")
+	if newConfig.Network.DataplaneTrust != netcfg.TrustDisabled {
+		t.Error("Network config is not immutable")
 	}
 }
diff --git a/pkg/reconciler/autoscaling/kpa/kpa_test.go b/pkg/reconciler/autoscaling/kpa/kpa_test.go
index 59541f50f..b12a56cb3 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa_test.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa_test.go
@@ -128,7 +128,7 @@ func initialScaleZeroASConfig() *autoscalerconfig.Config {
 
 func activatorCertsNetConfig() *netcfg.Config {
 	nc, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "true",
+		netcfg.DataplaneTrustKey: "minimal",
 	})
 	return nc
 }
@@ -140,7 +140,7 @@ func defaultConfig() *config.Config {
 		deployment.ProgressDeadlineKey:  progressDeadline.String(),
 	})
 	networkConfig, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "false",
+		netcfg.DataplaneTrustKey: "disabled",
 	})
 
 	return &config.Config{
diff --git a/pkg/reconciler/route/resources/ingress_test.go b/pkg/reconciler/route/resources/ingress_test.go
index 89dd75eac..2c6c7085b 100644
--- a/pkg/reconciler/route/resources/ingress_test.go
+++ b/pkg/reconciler/route/resources/ingress_test.go
@@ -1427,6 +1427,6 @@ func testContextWithHTTPOption() context.Context {
 
 func testContextWithActivatorCA() context.Context {
 	cfg := testConfig()
-	cfg.Network.InternalEncryption = true
+	cfg.Network.DataplaneTrust = netcfg.TrustMinimal
 	return config.ToContext(context.Background(), cfg)
 }
diff --git a/pkg/reconciler/route/resources/service_test.go b/pkg/reconciler/route/resources/service_test.go
index 684b06c79..a17e7972b 100644
--- a/pkg/reconciler/route/resources/service_test.go
+++ b/pkg/reconciler/route/resources/service_test.go
@@ -419,6 +419,7 @@ func testConfig() *config.Config {
 			DefaultIngressClass: "test-ingress-class",
 			DomainTemplate:      netcfg.DefaultDomainTemplate,
 			TagTemplate:         netcfg.DefaultTagTemplate,
+			DataplaneTrust:      netcfg.TrustDisabled,
 		},
 		Features: &apiConfig.Features{
 			MultiContainer:               apiConfig.Disabled,
diff --git a/test/e2e/autoscale_test.go b/test/e2e/autoscale_test.go
index f5ac77059..86c3d133e 100644
--- a/test/e2e/autoscale_test.go
+++ b/test/e2e/autoscale_test.go
@@ -173,7 +173,7 @@ func TestTargetBurstCapacity(t *testing.T) {
 	if err != nil {
 		t.Fatal("Fail to get ConfigMap config-network:", err)
 	}
-	if strings.EqualFold(cm.Data[netcfg.InternalEncryptionKey], "true") {
+	if !strings.EqualFold(cm.Data[netcfg.DataplaneTrustKey], string(netcfg.TrustDisabled)) {
 		// TODO: Remove this when https://github.com/knative/serving/issues/12797 was done.
 		t.Skip("Skipping TestTargetBurstCapacity as activator-ca is specified. See issue/12797.")
 	}
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 2f3ddc264..828f0aa82 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,7 +19,7 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
@@ -52,7 +52,7 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
@@ -93,7 +93,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 
@@ -119,7 +119,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 data:
@@ -168,7 +168,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -180,7 +180,7 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230601-c32774b3"
+        app.kubernetes.io/version: "20230608-398f9590"
         app.kubernetes.io/name: knative-serving
     spec:
       serviceAccountName: controller
@@ -188,7 +188,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:71129a3d31e59fb107f3b8c61068d92da1b5d48c7f2fd1ab648d12894f3675f5
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:fb846b6bd2de5f2d6bee2eff87261d420847fb2aad49835c0e5dc01c41ca6029
           resources:
             requests:
               cpu: 30m
@@ -227,7 +227,7 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
@@ -266,7 +266,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -279,7 +279,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230601-c32774b3"
+        app.kubernetes.io/version: "20230608-398f9590"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
     spec:
@@ -288,7 +288,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:1336e25037f174df7345c09996008a9bbfa26965f1bd50ec54cc5ffe677a3ba5
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:fd8a05dfc6befdffd22b21f1294ab270eff2fd2c22e2f20df63f8d79326f5395
           resources:
             requests:
               cpu: 20m
@@ -352,7 +352,7 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230601-c32774b3"
+    app.kubernetes.io/version: "20230608-398f9590"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
diff --git a/third_party/gateway-api-latest/istio-gateway.yaml b/third_party/gateway-api-latest/istio-gateway.yaml
index e05b51077..ef5b28274 100644
--- a/third_party/gateway-api-latest/istio-gateway.yaml
+++ b/third_party/gateway-api-latest/istio-gateway.yaml
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230608-accc06cf"
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
   type: ClusterIP
diff --git a/third_party/gateway-api-latest/net-gateway-api.yaml b/third_party/gateway-api-latest/net-gateway-api.yaml
index fea3cb0fc..3076ef909 100644
--- a/third_party/gateway-api-latest/net-gateway-api.yaml
+++ b/third_party/gateway-api-latest/net-gateway-api.yaml
@@ -5204,7 +5204,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230608-accc06cf"
 aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
@@ -5220,7 +5220,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230608-accc06cf"
 rules:
   - apiGroups: ["gateway.networking.k8s.io"]
     resources: ["httproutes", "referencegrants", "referencepolicies"]
@@ -5253,7 +5253,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230608-accc06cf"
 data:
   _example: |
     ################################
@@ -5307,7 +5307,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
-    app.kubernetes.io/version: "20230601-40b33c90"
+    app.kubernetes.io/version: "20230608-accc06cf"
     app.kubernetes.io/name: knative-serving
 spec:
   replicas: 1
@@ -5334,7 +5334,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:7405891efe33b7af8dbc71269e7542f67a03f2440a6f9343c1932776d77858ad
+          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:18df5bc6b2a263faf4aaad416391caa143fabddb368e198d15bdc6818fb91d74
           resources:
             requests:
               cpu: 100m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 885db5b69..d637d8144 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 77e1cf889b1757f503744baa22a447c9d82f72c2
+# Generated when HEAD was b52086715e45f4c9523e8c82a3eb566e4540f023
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -54,7 +54,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -93,7 +93,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -114,7 +114,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -149,7 +149,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 data:
   # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
@@ -192,11 +192,6 @@ data:
     # `knative-serving`
     local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"
 
-    # If true, knative will use the Istio VirtualService's status to determine
-    # endpoint readiness. Otherwise, probe as usual.
-    # NOTE: This feature is currently experimental and should not be used in production.
-    enable-virtualservice-status: "false"
-
 ---
 # Allows the Webhooks to be reached by kube-api with or without
 # sidecar injection and with mTLS PERMISSIVE and STRICT.
@@ -208,7 +203,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -226,7 +221,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -244,7 +239,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -277,7 +272,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -294,14 +289,14 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230601-77e1cf88"
+        app.kubernetes.io/version: "20230615-b5208671"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:da481f0c4fbae9e560ea0c5ae6cb783567b161cff56bc5ea97b1f7aa633cb5ed
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:defd049d05b1634ee92b66b181a5f23eef0b380a58dadb60c8d1fd9fdac250f5
           resources:
             requests:
               cpu: 30m
@@ -380,7 +375,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -394,14 +389,14 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230601-77e1cf88"
+        app.kubernetes.io/version: "20230615-b5208671"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:ce9dff8cf2af9b0a8061e62d88f32c64f2e440fda7001136d7073650510ba602
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:7cd381b8a2c23562922bc6b211413b40e1602d8284672a7e31cb1b6914557936
           resources:
             requests:
               cpu: 20m
@@ -485,7 +480,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -512,7 +507,7 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -551,7 +546,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -590,7 +585,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230601-77e1cf88"
+    app.kubernetes.io/version: "20230615-b5208671"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index efd1f0e52..41e7bcb0a 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -20,7 +20,7 @@ metadata:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -45,7 +45,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 data:
   envoy-bootstrap.yaml: |
@@ -168,7 +168,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 data:
   _example: |
@@ -259,7 +259,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -269,7 +269,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -301,7 +301,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -335,7 +335,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -357,7 +357,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:5e4ac306727f16f83f1e3895b3559651fbec60173196865f610dc926f694cfd5
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:9d0ba7b5c187e5b3994a1c31f9b579391a641563a73f68b8767f54f57c8d59c9
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -378,6 +378,11 @@ spec:
             - name: http2-xds
               containerPort: 18000
               protocol: TCP
+          startupProbe:
+            grpc:
+              port: 18000
+            periodSeconds: 10
+            failureThreshold: 120
           readinessProbe:
             grpc:
               port: 18000
@@ -415,7 +420,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -450,7 +455,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -559,7 +564,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -583,7 +588,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -607,7 +612,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   minReplicas: 1
@@ -633,7 +638,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230601-3cd3437c"
+    app.kubernetes.io/version: "20230615-039e48af"
     app.kubernetes.io/name: knative-serving
 spec:
   minAvailable: 80%