Repository: knative/serving
Pull request #10241 (2020-12-02 11:19:27)

[Automated] Update net-contour nightly
Produced via:
```shell
for x in net-contour.yaml contour.yaml; do
  curl https://storage.googleapis.com/knative-nightly/net-contour/latest/$x > ${GITHUB_WORKSPACE}/./third_party/contour-latest/$x
done
```
/assign @knative/networking-wg-leads
/cc @knative/networking-wg-leads

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10241#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **nak3** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @nak3` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["nak3"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=h1) Report
> Merging [#10241](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=desc) (3dcbaec) into [master](https://codecov.io/gh/knative/serving/commit/2288d9642f21eccdfdc8232c26fbc53ecd6965a6?el=desc) (2288d96) will **decrease** coverage by `0.02%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/10241/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui)](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master   #10241      +/-   ##
==========================================
- Coverage   88.11%   88.08%   -0.03%     
==========================================
  Files         184      184              
  Lines        8614     8614              
==========================================
- Hits         7590     7588       -2     
- Misses        787      790       +3     
+ Partials      237      236       -1     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/autoscaler/scaling/multiscaler.go](https://codecov.io/gh/knative/serving/pull/10241/diff?src=pr&el=tree#diff-cGtnL2F1dG9zY2FsZXIvc2NhbGluZy9tdWx0aXNjYWxlci5nbw==) | `87.93% <0.00%> (-1.73%)` | :arrow_down: |
| [pkg/activator/net/revision\_backends.go](https://codecov.io/gh/knative/serving/pull/10241/diff?src=pr&el=tree#diff-cGtnL2FjdGl2YXRvci9uZXQvcmV2aXNpb25fYmFja2VuZHMuZ28=) | `90.49% <0.00%> (-0.91%)` | :arrow_down: |
| [pkg/autoscaler/statforwarder/forwarder.go](https://codecov.io/gh/knative/serving/pull/10241/diff?src=pr&el=tree#diff-cGtnL2F1dG9zY2FsZXIvc3RhdGZvcndhcmRlci9mb3J3YXJkZXIuZ28=) | `82.44% <0.00%> (+1.06%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=footer). Last update [2288d96...0d9649c](https://codecov.io/gh/knative/serving/pull/10241?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

knative-prow-robot: @knative-automation: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-contour-tls | 0d9649cf5c8a0f214b19f96c9ad94b168696cf0a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10241/pull-knative-serving-contour-tls/1334094854661083136) | `/test pull-knative-serving-contour-tls`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10241). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-contour-tls | 0d9649cf5c8a0f214b19f96c9ad94b168696cf0a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10241/pull-knative-serving-contour-tls/1334094854661083136) | `/test pull-knative-serving-contour-tls`
pull-knative-serving-istio-stable-no-mesh-tls | 0d9649cf5c8a0f214b19f96c9ad94b168696cf0a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10241/pull-knative-serving-istio-stable-no-mesh-tls/1334094854614945792) | `/test pull-knative-serving-istio-stable-no-mesh-tls`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10241). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-contour-tls | 0d9649cf5c8a0f214b19f96c9ad94b168696cf0a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10241/pull-knative-serving-contour-tls/1334094854661083136) | `/test pull-knative-serving-contour-tls`
pull-knative-serving-istio-stable-no-mesh-tls | 0d9649cf5c8a0f214b19f96c9ad94b168696cf0a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10241/pull-knative-serving-istio-stable-no-mesh-tls/1334094854614945792) | `/test pull-knative-serving-istio-stable-no-mesh-tls`
pull-knative-serving-istio-stable-no-mesh | 0d9649cf5c8a0f214b19f96c9ad94b168696cf0a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10241/pull-knative-serving-istio-stable-no-mesh/1334094854589779968) | `/test pull-knative-serving-istio-stable-no-mesh`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10241). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tcnghia: /retest

Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 5ac75d31a..5ab36ed92 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -24,7 +24,6 @@ aliases:
   - dprotaso        # API
   - markusthoemmes  # Scaling
   - mattmoor        # API
-  - mdemirhan       # Network
   - tcnghia         # Network
   - vagababov       # Scaling
 
@@ -35,7 +34,6 @@ aliases:
   - grantr          # TOC
   - markusthoemmes  # Scaling/TOC
   - mattmoor        # API/TOC
-  - mdemirhan       # Network
   - nak3            # Network
   - tcnghia         # Network/TOC
   - ZhiminXiang     # Network
@@ -43,13 +41,11 @@ aliases:
 
   autoscaling-approvers:
   - markusthoemmes
-  - mdemirhan
   - vagababov
   - julz
   autoscaling-reviewers:
   - julz
   - markusthoemmes
-  - mdemirhan
   - taragu
   - vagababov
   - yanweiguo
@@ -74,7 +70,6 @@ aliases:
   networking-approvers:
   - JRBANCEL
   - markusthoemmes
-  - mdemirhan
   - nak3
   - tcnghia
   - vagababov
@@ -83,7 +78,6 @@ aliases:
   - andrew-su
   - JRBANCEL
   - markusthoemmes
-  - mdemirhan
   - nak3
   - shashwathi
   - tcnghia
diff --git a/go.mod b/go.mod
index b823081e6..5c34ceedc 100644
--- a/go.mod
+++ b/go.mod
@@ -34,8 +34,8 @@ require (
 	k8s.io/client-go v0.18.12
 	k8s.io/code-generator v0.18.12
 	k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29
-	knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6
+	knative.dev/caching v0.0.0-20201202014037-fc10335afb00
 	knative.dev/hack v0.0.0-20201201234937-fddbf732e450
-	knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7
-	knative.dev/pkg v0.0.0-20201130192436-e5346d90e980
+	knative.dev/networking v0.0.0-20201203005409-47ea2396c447
+	knative.dev/pkg v0.0.0-20201203005309-e45bbefd1d63
 )
diff --git a/go.sum b/go.sum
index 6d21f16db..fcdef2389 100644
--- a/go.sum
+++ b/go.sum
@@ -1214,18 +1214,18 @@ k8s.io/legacy-cloud-providers v0.18.8/go.mod h1:tgp4xYf6lvjrWnjQwTOPvWQE9IVqSBGP
 k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20200603063816-c1c6865ac451 h1:v8ud2Up6QK1lNOKFgiIVrZdMg7MpmSnvtrOieolJKoE=
 k8s.io/utils v0.0.0-20200603063816-c1c6865ac451/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6 h1:W1R7UnGSGJmL6btl8AY8AVCT2cEwgHzRtlort7icB5M=
-knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6/go.mod h1:IocU4F1XK8udXpTRC4m9KWyEVtT928sSP+T7Oy34UDg=
+knative.dev/caching v0.0.0-20201202014037-fc10335afb00 h1:5w9QL7APTYyERDhYNakgS1Ct69bh06m5Qf7Tm+X5f6A=
+knative.dev/caching v0.0.0-20201202014037-fc10335afb00/go.mod h1:LWpD8X3fJcsDzfika4rzu1avRJqCmv2OOyTNoD8OHsQ=
 knative.dev/hack v0.0.0-20201120192952-353db687ec5b h1:Lc+AKgwhAZUD98mN++qTHeeaP6FRmS8fcwc/rXkP8G0=
 knative.dev/hack v0.0.0-20201120192952-353db687ec5b/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
 knative.dev/hack v0.0.0-20201201234937-fddbf732e450 h1:IyitWF7OzfunCgE4b9ZsJAeIRoQ6JOyqDrz/19X4iS4=
 knative.dev/hack v0.0.0-20201201234937-fddbf732e450/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7 h1:O40i4ZCYfpaw7m1yUwtmRhBOdT0HRp3MYD4PWaRzYqI=
-knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7/go.mod h1:EpImbpW3gu85Mg39GT7gUJTVYLtFYWDsZQCZlKFmGUM=
-knative.dev/pkg v0.0.0-20201125095035-9bf616d2f46a h1:pdJpLaq50mLKrPWYSQgTH2p64Dk7Fq/xID6l0F69cVY=
-knative.dev/pkg v0.0.0-20201125095035-9bf616d2f46a/go.mod h1:wXZqP8MXCxb51yNFlecA13BwG7Hk370SWDFWV4dx4ug=
+knative.dev/networking v0.0.0-20201203005409-47ea2396c447 h1:SQNnL1Od3asUVUVKPreMEsKNRcYvr3RG0tHTpOjB5eQ=
+knative.dev/networking v0.0.0-20201203005409-47ea2396c447/go.mod h1:9MYaP1/cs1zYvvvr+gda2XRW1e1WqmUE0xKVxkwmUXw=
 knative.dev/pkg v0.0.0-20201130192436-e5346d90e980 h1:44zakwrFjbivCM/YR+ni70e9u1ELtwA7VF1HSmUcj+g=
 knative.dev/pkg v0.0.0-20201130192436-e5346d90e980/go.mod h1:wXZqP8MXCxb51yNFlecA13BwG7Hk370SWDFWV4dx4ug=
+knative.dev/pkg v0.0.0-20201203005309-e45bbefd1d63 h1:ybRM/HKsR1x2idi7BI9rIOb4AAd5ZRCZSudPGQhw2io=
+knative.dev/pkg v0.0.0-20201203005309-e45bbefd1d63/go.mod h1:efRLl6Z597X5r3TTt/I73cQIDDV1He6LMN1y4HQlkHU=
 modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
 modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 0e637c93f..fa7aacff4 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -18,18 +18,15 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-export GO111MODULE=on
+source $(dirname $0)/../vendor/knative.dev/hack/codegen-library.sh
+
 # If we run with -mod=vendor here, then generate-groups.sh looks for vendor files in the wrong place.
 export GOFLAGS=-mod=
 
-if [ -z "${GOPATH:-}" ]; then
-  export GOPATH=$(go env GOPATH)
-fi
-
-source $(dirname $0)/../vendor/knative.dev/hack/library.sh
-
 boilerplate="${REPO_ROOT_DIR}/hack/boilerplate/boilerplate.go.txt"
 
+echo "=== Update Codegen for $MODULE_NAME"
+
 # Parse flags to determine if we should generate protobufs.
 generate_protobufs=0
 while [[ $# -ne 0 ]]; do
@@ -43,7 +40,7 @@ done
 readonly generate_protobufs
 
 if (( generate_protobufs )); then
-  echo "Generating protocol buffer code"
+  group "Generating protocol buffer code"
   protos=$(find "${REPO_ROOT_DIR}/pkg" "${REPO_ROOT_DIR}/test" -name '*.proto')
   for proto in $protos
   do
@@ -57,14 +54,11 @@ if (( generate_protobufs )); then
   done
 fi
 
-echo "Generating checksums for configmap _example keys"
-${REPO_ROOT_DIR}/hack/update-checksums.sh
+group "Generating checksums for configmap _example keys"
 
-CODEGEN_PKG=${CODEGEN_PKG:-$(cd ${REPO_ROOT_DIR}; ls -d -1 $(dirname $0)/../vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
-KNATIVE_CODEGEN_PKG=${KNATIVE_CODEGEN_PKG:-$(cd ${REPO_ROOT_DIR}; ls -d -1 $(dirname $0)/../vendor/knative.dev/pkg 2>/dev/null || echo ../pkg)}
+${REPO_ROOT_DIR}/hack/update-checksums.sh
 
-chmod +x ${CODEGEN_PKG}/generate-groups.sh
-chmod +x ${KNATIVE_CODEGEN_PKG}/hack/generate-knative.sh
+group "Kubernetes Codegen"
 
 # generate the code with:
 # --output-base    because this script should also be able to run inside the vendor dir of
@@ -75,12 +69,16 @@ ${CODEGEN_PKG}/generate-groups.sh "deepcopy,client,informer,lister" \
   "serving:v1 serving:v1alpha1 autoscaling:v1alpha1" \
   --go-header-file "${boilerplate}"
 
+group "Knative Codegen"
+
 # Knative Injection
 ${KNATIVE_CODEGEN_PKG}/hack/generate-knative.sh "injection" \
   knative.dev/serving/pkg/client knative.dev/serving/pkg/apis \
   "serving:v1 serving:v1alpha1 autoscaling:v1alpha1" \
   --go-header-file "${boilerplate}"
 
+group "Deepcopy Gen"
+
 # Depends on generate-groups.sh to install bin/deepcopy-gen
 ${GOPATH}/bin/deepcopy-gen \
   -O zz_generated.deepcopy \
@@ -98,5 +96,7 @@ ${GOPATH}/bin/deepcopy-gen \
   -i knative.dev/serving/pkg/logging \
   -i knative.dev/serving/pkg/metrics
 
+group "Update deps post-codegen"
+
 # Make sure our dependencies are up-to-date
 ${REPO_ROOT_DIR}/hack/update-deps.sh
diff --git a/pkg/reconciler/revision/background.go b/pkg/reconciler/revision/background.go
index 84d8d6567..0396ebdad 100644
--- a/pkg/reconciler/revision/background.go
+++ b/pkg/reconciler/revision/background.go
@@ -42,7 +42,7 @@ type backgroundResolver struct {
 	resolver imageResolver
 	enqueue  func(types.NamespacedName)
 
-	queue workqueue.Interface
+	queue workqueue.RateLimitingInterface
 
 	mu      sync.Mutex
 	results map[types.NamespacedName]*resolveResult
@@ -82,7 +82,9 @@ func newBackgroundResolver(logger *zap.SugaredLogger, resolver imageResolver, en
 		enqueue:  enqueue,
 
 		results: make(map[types.NamespacedName]*resolveResult),
-		queue:   workqueue.NewNamed("digests"),
+		queue: workqueue.NewNamedRateLimitingQueue(
+			workqueue.DefaultControllerRateLimiter(),
+			"digests"),
 	}
 
 	return r
@@ -192,7 +194,13 @@ func (r *backgroundResolver) addWorkItems(rev *v1.Revision, name types.Namespace
 // in the resolveResult. If this completes the work for the revision, the
 // completionCallback is called.
 func (r *backgroundResolver) processWorkItem(item *workItem) {
-	defer r.queue.Done(item)
+	defer func() {
+		// NOTE: right now we do not retry failing items, but if we were
+		// `Forget` should be called only in case of a success
+		// (or if we abandon the item).
+		r.queue.Forget(item)
+		r.queue.Done(item)
+	}()
 
 	ctx, cancel := context.WithTimeout(context.Background(), item.timeout)
 	defer cancel()
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index 3616159af..4900729ea 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -67,14 +67,17 @@ type ConfigurationRollout struct {
 	// This is required to compute step time and deadline.
 	StartTime int `json:"starttime,omitempty"`
 
-	// LastStepTimeStamp is the Unix timestamp when the last
-	// rollout step was performed.
-	LastStepTime int `json:"lastStep,omitempty"`
+	// NextStepTime is the Unix timestamp when the next
+	// rollout step should performed.
+	NextStepTime int `json:"lastStep,omitempty"`
 
 	// StepDuration is a rounded up number of seconds how long it took
 	// for ingress to successfully move first 1% of traffic to the new revision.
 	// Note, that his number does not include any coldstart, etc timing.
 	StepDuration int `json:"stepDuration,omitempty"`
+
+	// How much traffic to move in a single step.
+	StepSize int `json:"stepSize,omitempty"`
 }
 
 // RevisionRollout describes the revision in the config rollout.
@@ -89,9 +92,9 @@ type RevisionRollout struct {
 
 // Done returns true if there is no active rollout going on
 // for the configuration.
-func (cr *ConfigurationRollout) Done() bool {
+func (cur *ConfigurationRollout) Done() bool {
 	// Zero or just one revision.
-	return len(cr.Revisions) < 2
+	return len(cur.Revisions) < 2
 }
 
 // Validate validates current rollout for inconsistencies.
@@ -115,15 +118,21 @@ func (cur *Rollout) Validate() bool {
 	return true
 }
 
+// TODO(vagababov): default fake rollout duration in use, while we
+// only modify the annotation and do not actually modify the traffic.
+const durationSecs = 120.0
+
 // ObserveReady traverses the configs and the ones that are in rollout
 // but have not observed step time yet, will have it set, to
-// max(1, nowTS-cfg.StartTime). nowTS is unix timestamp in ns.
+// max(1, nowTS-cfg.StartTime).
 func (cur *Rollout) ObserveReady(nowTS int) {
 	for i := range cur.Configurations {
 		c := &cur.Configurations[i]
 		if c.StepDuration == 0 && c.StartTime > 0 {
-			c.StepDuration = int(math.Max(1,
-				math.Ceil(time.Duration(nowTS-c.StartTime).Seconds())))
+			// In really ceil(nowTS-c.StartTime) should always give 1s, but
+			// given possible time drift, we'll ensure that at least 1s is returned.
+			minStepSec := math.Max(1, math.Ceil(time.Duration(nowTS-c.StartTime).Seconds()))
+			c.computeProperties(float64(nowTS), minStepSec, durationSecs)
 		}
 	}
 }
@@ -133,7 +142,6 @@ func (cur *Rollout) ObserveReady(nowTS int) {
 // At the end of the call the returned object will contain the
 // desired traffic shape.
 // Step will return cur if no previous state was available.
-// nowTS is unix timestamp in ns.
 func (cur *Rollout) Step(prev *Rollout, nowTS int) *Rollout {
 	if prev == nil || len(prev.Configurations) == 0 {
 		return cur
@@ -214,6 +222,8 @@ func (cur *Rollout) Step(prev *Rollout, nowTS int) *Rollout {
 // the older revisions.
 func adjustPercentage(goal int, cr *ConfigurationRollout) {
 	switch diff := goal - cr.Percent; {
+	case goal == 0:
+		cr.Revisions = nil // No traffic, no rollout.
 	case diff > 0:
 		cr.Revisions[len(cr.Revisions)-1].Percent += diff
 	case diff < 0:
@@ -262,7 +272,7 @@ func stepConfig(goal, prev *ConfigurationRollout, nowTS int) *ConfigurationRollo
 			// Copy the duration info from the previous when no new revision
 			// has been created.
 			ret.Deadline = prev.Deadline
-			ret.LastStepTime = prev.LastStepTime
+			ret.NextStepTime = prev.NextStepTime
 			ret.StepDuration = prev.StepDuration
 			ret.StartTime = prev.StartTime
 		}
@@ -304,6 +314,40 @@ func stepConfig(goal, prev *ConfigurationRollout, nowTS int) *ConfigurationRollo
 	return ret
 }
 
+// computeProperties computes the time between steps, each step size
+// and next reconcile time. This is invoked when the rollout just starts.
+// nowTS current unix timestamp in ns.
+// Pre: minStepSec >= 1, in seconds.
+// Pre: durationSecs > 1, in seconds.
+func (cur *ConfigurationRollout) computeProperties(nowTS, minStepSec, durationSecs float64) {
+	// First compute number of steps.
+	numSteps := durationSecs / minStepSec
+	pf := float64(cur.Percent)
+
+	// The smallest step is 1%, so if we can fit more steps
+	// than we have percents, we'll make c.Percent-1 steps
+	// each equal to 1%. -1, since we already moved 1% of the traffic.
+	if pf < numSteps {
+		numSteps = pf - 1
+	}
+
+	// We're moving traffic in equal steps.
+	// The last step can be larger, since it's more likely to
+	// easily accommodate the traffic jump, due to built in
+	// spare capacity.
+	// E.g. 100% in 4 steps. 1% -> 25% -> 49% -> 74% -> 100%, last jump being 26%.
+	stepSize := math.Floor((pf - 1) / numSteps)
+
+	// The time we sleep between the steps.
+	// We round up here since it's better to roll slightly longer,
+	// than slightly shorter.
+	stepDuration := math.Ceil(durationSecs / numSteps)
+
+	cur.StepDuration = int(stepDuration)
+	cur.StepSize = int(stepSize)
+	cur.NextStepTime = int(nowTS + stepDuration*float64(time.Second))
+}
+
 // sortRollout sorts the rollout based on tag so it's consistent
 // from run to run, since input to the process is map iterator.
 func sortRollout(r *Rollout) {
diff --git a/vendor/knative.dev/pkg/network/handlers/error.go b/vendor/knative.dev/pkg/network/handlers/error.go
deleted file mode 100644
index a6bd3bd03..000000000
--- a/vendor/knative.dev/pkg/network/handlers/error.go
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
-Copyright 2020 The Knative Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package handlers
-
-import "knative.dev/pkg/network"
-
-// Error sets up a handler suitable for use with the ErrorHandler field on
-// httputil's reverse proxy, which logs /proc/net/sockstat data.
-var Error = network.ErrorHandler
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ae2f927e9..bb4fdf188 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -952,7 +952,7 @@ k8s.io/utils/buffer
 k8s.io/utils/integer
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20201125150135-91fb5833c3c6
+# knative.dev/caching v0.0.0-20201202014037-fc10335afb00
 ## explicit
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -976,7 +976,7 @@ knative.dev/caching/pkg/client/listers/caching/v1alpha1
 # knative.dev/hack v0.0.0-20201201234937-fddbf732e450
 ## explicit
 knative.dev/hack
-# knative.dev/networking v0.0.0-20201125133435-4b21f11ccfa7
+# knative.dev/networking v0.0.0-20201203005409-47ea2396c447
 ## explicit
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -1009,7 +1009,7 @@ knative.dev/networking/test/conformance/ingress
 knative.dev/networking/test/defaultsystem
 knative.dev/networking/test/test_images/grpc-ping/proto
 knative.dev/networking/test/types
-# knative.dev/pkg v0.0.0-20201130192436-e5346d90e980
+# knative.dev/pkg v0.0.0-20201203005309-e45bbefd1d63
 ## explicit
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/pkg/reconciler/route/traffic/rollout_test.go b/pkg/reconciler/route/traffic/rollout_test.go
index 6ee8baaec..0d8ff6d4a 100644
--- a/pkg/reconciler/route/traffic/rollout_test.go
+++ b/pkg/reconciler/route/traffic/rollout_test.go
@@ -79,7 +79,7 @@ func TestStep(t *testing.T) {
 					Percent:      100,
 				}},
 				Deadline:     2006, // <- Those should be ignored.
-				LastStepTime: 2009,
+				NextStepTime: 2009,
 				StepDuration: 2020,
 				StartTime:    2004,
 			}},
@@ -93,7 +93,7 @@ func TestStep(t *testing.T) {
 					Percent:      100,
 				}},
 				Deadline:     1982, // <- Those should be copied.
-				LastStepTime: 1984,
+				NextStepTime: 1984,
 				StepDuration: 1988,
 				StartTime:    1955,
 			}},
@@ -107,7 +107,7 @@ func TestStep(t *testing.T) {
 					Percent:      100,
 				}},
 				Deadline:     1982,
-				LastStepTime: 1984,
+				NextStepTime: 1984,
 				StepDuration: 1988,
 				StartTime:    1955,
 			}},
@@ -195,7 +195,7 @@ func TestStep(t *testing.T) {
 					Percent:      100,
 				}},
 				Deadline:     1982, // <- Those should be thrown out.
-				LastStepTime: 1984,
+				NextStepTime: 1984,
 				StepDuration: 1988,
 			}},
 		},
@@ -706,22 +706,58 @@ func TestObserveReady(t *testing.T) {
 	)
 	ro := Rollout{
 		Configurations: []ConfigurationRollout{{
+			Percent:           100,
 			ConfigurationName: "has-step",
 			StepDuration:      11,
 		}, {
 			ConfigurationName: "no-step-no-begin",
+			Percent:           100,
 		}, {
 			ConfigurationName: "step-begin < 1s",
 			StartTime:         200620092020,
+			Percent:           100,
 		}, {
 			ConfigurationName: "step-begin > 1s",
 			StartTime:         oldenDays,
+			Percent:           100,
+		}, {
+			ConfigurationName: "Percent not 100%",
+			StartTime:         oldenDays,
+			Percent:           50,
 		}},
 	}
 
-	want := ro
-	want.Configurations[2].StepDuration = 1
-	want.Configurations[3].StepDuration = 3 // 2.4 rounded up.
+	want := Rollout{
+		Configurations: []ConfigurationRollout{{
+			Percent:           100,
+			ConfigurationName: "has-step",
+			StepDuration:      11,
+		}, {
+			ConfigurationName: "no-step-no-begin",
+			Percent:           100,
+		}, {
+			ConfigurationName: "step-begin < 1s",
+			Percent:           100,
+			StartTime:         200620092020,
+			StepDuration:      2,
+			StepSize:          1,
+			NextStepTime:      now + int(2*time.Second),
+		}, {
+			ConfigurationName: "step-begin > 1s",
+			Percent:           100,
+			StartTime:         oldenDays,
+			StepDuration:      3,
+			StepSize:          100 / 40,
+			NextStepTime:      now + 3*int(time.Second),
+		}, {
+			ConfigurationName: "Percent not 100%",
+			Percent:           50,
+			StartTime:         oldenDays,
+			StepDuration:      3,
+			StepSize:          50 / 40,
+			NextStepTime:      now + 3*int(time.Second),
+		}},
+	}
 
 	// This works in place.
 	ro.ObserveReady(now)
@@ -981,7 +1017,7 @@ func TestJSONRoundtrip(t *testing.T) {
 			}},
 			StartTime:    1955,
 			Deadline:     2006,
-			LastStepTime: 1988,
+			NextStepTime: 1988,
 			StepDuration: 1984,
 		}, {
 			ConfigurationName: "no",
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 561c94430..59b7a8b2d 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
 webhooks:
   - admissionReviewVersions:
       - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,14 +168,14 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20201127-fb3b3cd"
+        serving.knative.dev/release: "v20201202-672a8e3"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-certmanager
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:0f5f99a5fe5b527d8154da27ad5bf433ba615facab4f4fae08b640a9586bf4fe
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:44c5415b355d9cf3a1e8c701d997cba05af4c070a70e0caed6168154e150c003
           resources:
             requests:
               cpu: 30m
@@ -213,7 +213,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -250,7 +250,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
 spec:
   selector:
     matchLabels:
@@ -263,14 +263,14 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20201127-fb3b3cd"
+        serving.knative.dev/release: "v20201202-672a8e3"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:40e5284e599c742e8cc439b15cc9ee49ef99c552c29fc2e6ed6934c0a94fa15e
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:16a1aada5d38c4ffebdd0341d53ce608e30ebc8f43c519e298830bcb3a4dfd7f
           resources:
             requests:
               cpu: 20m
@@ -329,7 +329,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20201127-fb3b3cd"
+    serving.knative.dev/release: "v20201202-672a8e3"
 spec:
   ports:
     # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index 94e4b790f..15e8197a5 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -1482,7 +1482,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: Always
           command:
             - contour
@@ -1709,7 +1709,7 @@ spec:
             - --contour-key-file=/certs/tls.key
             - --config-path=/config/contour.yaml
           command: ["contour"]
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -1798,7 +1798,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -1875,7 +1875,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -2097,7 +2097,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: Always
           command:
             - contour
@@ -2217,7 +2217,7 @@ spec:
             - --contour-key-file=/certs/tls.key
             - --config-path=/config/contour.yaml
           command: ["contour"]
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2306,7 +2306,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2383,7 +2383,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7f3205d7f42bfd2c9017eb3eab4a26a297ad74d1b8e4a3d2ce04c94281ec8a0f
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:de820f735df92cdf12a6eb55c1b8719e9f44a7b8fbfe477655af52cefd5e5b5e
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index ff838385e..cb8bc013e 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -33,7 +33,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: contour
-    serving.knative.dev/release: "v20201201-5716387a"
+    serving.knative.dev/release: "v20201202-91d358e2"
 data:
   _example: |
     ################################
@@ -103,7 +103,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:a79af5fd8c0089cafde29110bcd51ce38a153ec55cea39f0470e4cb61d924a32
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:60b517019616347905d9853a01e0dd2fa5b97ae56c3193d66bf39944e58c1965
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index b24ddea40..a14a6ad27 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 861d1ad147f4f7c0c79095447da9df8eefbf1497
+# Generated when HEAD was 8a3d05fd2b6d88d8915f325072d4a44f9b9529e6
 #
 # Copyright 2019 The Knative Authors
 #
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -126,7 +126,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -141,7 +141,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -170,7 +170,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -206,7 +206,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -244,7 +244,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -268,7 +268,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -338,7 +338,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -354,14 +354,14 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20201201-861d1ad1"
+        serving.knative.dev/release: "v20201202-8a3d05fd"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-istio
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:e16eb747220b1f910a4991529a88f867dc1534e099dbd7c2a7f354a3909e9479
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:c412c59517d409295d5161b0e6255f31c53ae4adaee36e61af90e922fa318cba
           resources:
             requests:
               cpu: 30m
@@ -418,7 +418,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -432,14 +432,14 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20201201-861d1ad1"
+        serving.knative.dev/release: "v20201202-8a3d05fd"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:4f8b008593c7756c7e0fe7b58cb913e438e3688b969bce7eeeb6561916630b25
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:f9585c75f9ccb1348b7e19a65eae323f89b918e6da9dc1fe14781cce26c49cf8
           resources:
             requests:
               cpu: 20m
@@ -493,7 +493,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20201201-861d1ad1"
+    serving.knative.dev/release: "v20201202-8a3d05fd"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports: