Repository: knative/serving
Pull request #14038 (2023-05-31 08:46:46)

Allow to set QP resources per service
Part of the work for https://github.com/knative/serving/issues/13861.

<!-- Please include the 'why' behind your changes if no issue exists -->
## Proposed Changes

* Adds an annotation per resource type. Here is a sample ksvc:
```
apiVersion: serving.knative.dev/v1
kind: Service
spec:
  template:
    metadata:
      labels:
        app: helloworld-go
      annotations:
        queue.sidecar.serving.knative.dev/cpu-resource-request: "1"
        queue.sidecar.serving.knative.dev/cpu-resource-limit: "2"
        queue.sidecar.serving.knative.dev/memory-resource-request: "1Gi"
        queue.sidecar.serving.knative.dev/memory-resource-limit: "2Gi"
        queue.sidecar.serving.knative.dev/ephemeral-storage-resource-request: "400Mi"
        queue.sidecar.serving.knative.dev/ephemeral-storage-resource-limit: "450Mi"
    spec:
 ...
```
* The values passed by the user have higher priority compared to the percentage annotation.
* Tests added.

**Release Note**

<!-- Enter your extended release note in the below block. If the PR requires
additional action from users switching to the new release, include the string
"action required". If no release note is required, write "NONE". -->

```release-note
Queue proxy resources can be configured via annotations at the service level.  The resource percentage annotation is now deprecated.
```


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/14038#" title="Author self-approved">skonto</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign evankanderson for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative/serving/blob/main/OWNERS)~~ [skonto]
- **[pkg/apis/OWNERS](https://github.com/knative/serving/blob/main/pkg/apis/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["evankanderson"]} -->
codecov[bot]: ## [Codecov](https://app.codecov.io/gh/knative/serving/pull/14038?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
Patch coverage: **`100.00`**% and project coverage change: **`-0.04`** :warning:
> Comparison is base [(`c12c917`)](https://app.codecov.io/gh/knative/serving/commit/c12c9173978e342e957b629445679bfc8c78f181?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.22% compared to head [(`c4cc59c`)](https://app.codecov.io/gh/knative/serving/pull/14038?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) 86.18%.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main   #14038      +/-   ##
==========================================
- Coverage   86.22%   86.18%   -0.04%     
==========================================
  Files         199      199              
  Lines       14767    14783      +16     
==========================================
+ Hits        12733    12741       +8     
- Misses       1732     1738       +6     
- Partials      302      304       +2     
```


| [Impacted Files](https://app.codecov.io/gh/knative/serving/pull/14038?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/revision/resources/queue.go](https://app.codecov.io/gh/knative/serving/pull/14038?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvcmV2aXNpb24vcmVzb3VyY2VzL3F1ZXVlLmdv) | `98.33% <100.00%> (+0.09%)` | :arrow_up: |

... and [4 files with indirect coverage changes](https://app.codecov.io/gh/knative/serving/pull/14038/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)


</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/knative/serving/pull/14038?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).


Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 9bf8cadb0..b47fefd4d 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -152,7 +152,7 @@ aliases:
   technical-oversight-committee:
   - dprotaso
   - dsimansk
-  - evankanderson
+  - kvmware
   - psschwei
   - zroubalik
   trademark-committee:
diff --git a/cmd/controller/main.go b/cmd/controller/main.go
index c4895f011..94dd13db9 100644
--- a/cmd/controller/main.go
+++ b/cmd/controller/main.go
@@ -20,7 +20,7 @@ import (
 	// The set of controllers this controller process runs.
 	"flag"
 
-	certificate "knative.dev/control-protocol/pkg/certificates/reconciler"
+	certificate "knative.dev/networking/pkg/certificates/reconciler"
 	"knative.dev/pkg/reconciler"
 	"knative.dev/pkg/signals"
 	"knative.dev/serving/pkg/reconciler/configuration"
diff --git a/config/core/300-resources/domain-mapping.yaml b/config/core/300-resources/domain-mapping.yaml
index 9e048d99b..8ea083587 100644
--- a/config/core/300-resources/domain-mapping.yaml
+++ b/config/core/300-resources/domain-mapping.yaml
@@ -25,7 +25,7 @@ spec:
   versions:
     - name: v1beta1
       served: true
-      storage: false
+      storage: true
       subresources:
         status: {}
       additionalPrinterColumns:
@@ -149,7 +149,9 @@ spec:
                   type: string
     - name: v1alpha1
       served: true
-      storage: true
+      storage: false
+      deprecated: true
+      deprecationWarning: The v1alpha1 version of DomainMapping has been deprecated and will be removed in a future release of the API. Please upgrade to v1beta1
       subresources:
         status: {}
       schema:
diff --git a/config/core/300-secret.yaml b/config/core/300-secret.yaml
index faeabb73f..abce97bd1 100644
--- a/config/core/300-secret.yaml
+++ b/config/core/300-secret.yaml
@@ -15,8 +15,8 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  # Do not drop -ctrl-ca suffix as control-protocol requires it.
-  # https://github.com/knative-sandbox/control-protocol/blob/main/pkg/certificates/reconciler/controller.go
+  # Do not drop -ctrl-ca suffix as certificate creation requires it
+  # https://github.com/knative/networking/blob/main/pkg/certificates/reconciler/controller.go#L38
   name: serving-certs-ctrl-ca
   namespace: knative-serving
   labels:
diff --git a/config/post-install/storage-version-migration.yaml b/config/post-install/storage-version-migration.yaml
index 887d7dfa9..b7b0c5708 100644
--- a/config/post-install/storage-version-migration.yaml
+++ b/config/post-install/storage-version-migration.yaml
@@ -47,6 +47,7 @@ spec:
           - "configurations.serving.knative.dev"
           - "revisions.serving.knative.dev"
           - "routes.serving.knative.dev"
+          - "domainmappings.serving.knative.dev"
         resources:
           requests:
             cpu: 100m
diff --git a/go.mod b/go.mod
index 62e58b03f..342dbc880 100644
--- a/go.mod
+++ b/go.mod
@@ -32,11 +32,10 @@ require (
 	k8s.io/code-generator v0.26.5
 	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
 	k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2
-	knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6
-	knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d
-	knative.dev/hack v0.0.0-20230524013611-5812c57cc1ac
-	knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60
-	knative.dev/pkg v0.0.0-20230525143525-9bda38b21643
+	knative.dev/caching v0.0.0-20230615185548-38a807574e69
+	knative.dev/hack v0.0.0-20230615155948-d7586a218601
+	knative.dev/networking v0.0.0-20230616133350-b9dd5c201e19
+	knative.dev/pkg v0.0.0-20230616134650-eb63a40adfb0
 	sigs.k8s.io/yaml v1.3.0
 )
 
diff --git a/go.sum b/go.sum
index 159c62735..2054bb7f4 100644
--- a/go.sum
+++ b/go.sum
@@ -1194,16 +1194,14 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
 k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6 h1:kajORjwXlGzSPddhazNIE01i5Efgqo52iB8VdFou22g=
-knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6/go.mod h1:G3SAcfsMvSh0QeE0qybQ4G1J7v60XeH1DLaHGx12Ixk=
-knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d h1:UCorKZ+dKWmBesDNpocdKLsd/yo+qsCCvnlzj4+QNxs=
-knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d/go.mod h1:6IjiiR5I2DjCWdOsj0jLvrIjzDaKYaq4jUhT1ImrWwg=
-knative.dev/hack v0.0.0-20230524013611-5812c57cc1ac h1:XQrhtfWPsyuxwSxv4GhcFnqZh75Nq+L1iZWhFMz4aPg=
-knative.dev/hack v0.0.0-20230524013611-5812c57cc1ac/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
-knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60 h1:vErunGWa8pZNriLFaE4UbgdqNECKF7gJTYZE+DdOuOE=
-knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60/go.mod h1:ieNknBTSWl441656hZF1JNHbTXbab138w8qPEwuwC0Q=
-knative.dev/pkg v0.0.0-20230525143525-9bda38b21643 h1:DoGHeW3ckr509v87NcYSSuRHEnxKIxyJxWrrDO/71CY=
-knative.dev/pkg v0.0.0-20230525143525-9bda38b21643/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
+knative.dev/caching v0.0.0-20230615185548-38a807574e69 h1:UWuyiV5MyvAkTy/ZA3z6L25J9z1ZmDqWLYcogBE7zYE=
+knative.dev/caching v0.0.0-20230615185548-38a807574e69/go.mod h1:j9aFEAmBO8I4Iz5EdP1YgnRvklHBKAPuqr6NA4B1VhQ=
+knative.dev/hack v0.0.0-20230615155948-d7586a218601 h1:yMe29SMHrAIt3+J+APvf4WVP6cW7ZDtUhh5uxD5ERdA=
+knative.dev/hack v0.0.0-20230615155948-d7586a218601/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
+knative.dev/networking v0.0.0-20230616133350-b9dd5c201e19 h1:yZXjdJbr+HgwjmGRkZ2QQRYB9r7fhVklStuTEMm6l6w=
+knative.dev/networking v0.0.0-20230616133350-b9dd5c201e19/go.mod h1:xYtCGVLsoxLEHxUEQxVa0Ut7R/M5x2E49bHzEj09M5w=
+knative.dev/pkg v0.0.0-20230616134650-eb63a40adfb0 h1:weQWWxEEbNOPuL4qtGiBZuMSFhcjF/Cu163uktd/xFE=
+knative.dev/pkg v0.0.0-20230616134650-eb63a40adfb0/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
 pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/pkg/activator/certificate/cache.go b/pkg/activator/certificate/cache.go
index 699ace5cc..62f43e4f8 100644
--- a/pkg/activator/certificate/cache.go
+++ b/pkg/activator/certificate/cache.go
@@ -28,7 +28,7 @@ import (
 	v1 "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/tools/cache"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/controller"
 	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
@@ -103,7 +103,7 @@ func (cr *CertCache) updateCache(secret *corev1.Secret) {
 
 	cr.TLSConf.RootCAs = pool
 	cr.TLSConf.ServerName = certificates.LegacyFakeDnsName
-	cr.TLSConf.MinVersion = tls.VersionTLS12
+	cr.TLSConf.MinVersion = tls.VersionTLS13
 }
 
 func (cr *CertCache) handleCertificateUpdate(_, new interface{}) {
diff --git a/pkg/activator/net/throttler.go b/pkg/activator/net/throttler.go
index d976327e0..eae2a7c3e 100644
--- a/pkg/activator/net/throttler.go
+++ b/pkg/activator/net/throttler.go
@@ -18,8 +18,6 @@ package net
 
 import (
 	"context"
-	"math"
-	"math/rand"
 	"net/http"
 	"sort"
 	"sync"
@@ -240,18 +238,30 @@ func (rt *revisionThrottler) try(ctx context.Context, function func(string) erro
 	return ret
 }
 
-func (rt *revisionThrottler) calculateCapacity(size, activatorCount int) int {
-	targetCapacity := rt.containerConcurrency * size
+func (rt *revisionThrottler) calculateCapacity(backendCount, numTrackers, activatorCount int) int {
+	targetCapacity := 0
+	if numTrackers > 0 {
+		// Capacity is computed based off of number of trackers,
+		// when using pod direct routing.
+		// We use number of assignedTrackers (numTrackers) for calculation
+		// since assignedTrackers means activator's capacity
+		targetCapacity = rt.containerConcurrency * numTrackers
+	} else {
+		// Capacity is computed off of number of ready backends,
+		// when we are using clusterIP routing.
+		targetCapacity = rt.containerConcurrency * backendCount
+		if targetCapacity > 0 {
+			targetCapacity = minOneOrValue(targetCapacity / minOneOrValue(activatorCount))
+		}
+	}
 
-	if size > 0 && (rt.containerConcurrency == 0 || targetCapacity > revisionMaxConcurrency) {
+	if (backendCount > 0) && (rt.containerConcurrency == 0 || targetCapacity > revisionMaxConcurrency) {
 		// If cc==0, we need to pick a number, but it does not matter, since
 		// infinite breaker will dole out as many tokens as it can.
 		// For cc>0 we clamp targetCapacity to maxConcurrency because the backing
 		// breaker requires some limit (it's backed by a chan struct{}), but the
 		// limit is math.MaxInt32 so in practice this should never be a real limit.
 		targetCapacity = revisionMaxConcurrency
-	} else if targetCapacity > 0 {
-		targetCapacity = minOneOrValue(targetCapacity / minOneOrValue(activatorCount))
 	}
 
 	return targetCapacity
@@ -305,16 +315,7 @@ func (rt *revisionThrottler) updateCapacity(backendCount int) {
 		return len(assigned)
 	}()
 
-	capacity := 0
-	if numTrackers > 0 {
-		// Capacity is computed based off of number of trackers,
-		// when using pod direct routing.
-		capacity = rt.calculateCapacity(len(rt.podTrackers), ac)
-	} else {
-		// Capacity is computed off of number of ready backends,
-		// when we are using clusterIP routing.
-		capacity = rt.calculateCapacity(backendCount, ac)
-	}
+	capacity := rt.calculateCapacity(backendCount, numTrackers, ac)
 	rt.logger.Infof("Set capacity to %d (backends: %d, index: %d/%d)",
 		capacity, backendCount, ai, ac)
 
@@ -382,22 +383,16 @@ func assignSlice(trackers []*podTracker, selfIndex, numActivators, cc int) []*po
 		return trackers
 	}
 
+	// If the number of pods is not divisible by the number of activators, we allocate one pod to each activator exclusively.
+	// examples
+	// 1. we have 20 pods and 3 activators -> we'd get 2 remnants so activator with index 0,1 would each pick up a unique tracker
+	// 2. we have 24 pods and 5 activators -> we'd get 4 remnants so the activator 0,1,2,3 would each pick up a unique tracker
 	bi, ei, remnants := pickIndices(lt, selfIndex, numActivators)
 	x := append(trackers[:0:0], trackers[bi:ei]...)
 	if remnants > 0 {
 		tail := trackers[len(trackers)-remnants:]
-		// We shuffle the tail, to ensure that pods in the tail get better
-		// load distribution, since we sort the pods above, this puts more requests
-		// on the very first tail pod, than on the others.
-		rand.Shuffle(remnants, func(i, j int) {
-			tail[i], tail[j] = tail[j], tail[i]
-		})
-		// assignSlice is not called for CC=0 case.
-		dcc := int(math.Ceil(float64(cc) / float64(numActivators)))
-		// This is basically: x = append(x, trackers[len(trackers)-remnants:]...)
-		// But we need to update the capacity.
-		for _, t := range tail {
-			t.UpdateConcurrency(dcc)
+		if len(tail) > selfIndex {
+			t := tail[selfIndex]
 			x = append(x, t)
 		}
 	}
diff --git a/pkg/apis/serving/register.go b/pkg/apis/serving/register.go
index 51eada3e9..7fc51964f 100644
--- a/pkg/apis/serving/register.go
+++ b/pkg/apis/serving/register.go
@@ -116,8 +116,27 @@ const (
 
 	// QueueSidecarResourcePercentageAnnotationKey is the percentage of user container resources to be used for queue-proxy
 	// It has to be in [0.1,100]
+	// Deprecated: Please consider setting resources explicitly for the QP per service, see `QueueSidecarCPUResourceRequestAnnotationKey` for example.
 	QueueSidecarResourcePercentageAnnotationKey = "queue.sidecar." + GroupName + "/resource-percentage"
 
+	// QueueSidecarCPUResourceRequestAnnotationKey is the explicit value of the cpu request for queue-proxy's request resources
+	QueueSidecarCPUResourceRequestAnnotationKey = "queue.sidecar." + GroupName + "/cpu-resource-request"
+
+	// QueueSidecarCPUResourceLimitAnnotationKey is the explicit value of the cpu limit for queue-proxy's limit resources
+	QueueSidecarCPUResourceLimitAnnotationKey = "queue.sidecar." + GroupName + "/cpu-resource-limit"
+
+	// QueueSidecarMemoryResourceRequestAnnotationKey is the explicit value of the memory request for queue-proxy's request resources
+	QueueSidecarMemoryResourceRequestAnnotationKey = "queue.sidecar." + GroupName + "/memory-resource-request"
+
+	// QueueSidecarMemoryResourceLimitAnnotationKey is the explicit value of the memory limit for queue-proxy's limit resources
+	QueueSidecarMemoryResourceLimitAnnotationKey = "queue.sidecar." + GroupName + "/memory-resource-limit"
+
+	// QueueSidecarEphemeralStorageResourceRequestAnnotationKey is the explicit value of the ephemeral storage request for queue-proxy's request resources
+	QueueSidecarEphemeralStorageResourceRequestAnnotationKey = "queue.sidecar." + GroupName + "/ephemeral-storage-resource-request"
+
+	// QueueSidecarEphemeralStorageResourceLimitAnnotationKey is the explicit value of the ephemeral storage limit for queue-proxy's limit resources
+	QueueSidecarEphemeralStorageResourceLimitAnnotationKey = "queue.sidecar." + GroupName + "/ephemeral-storage-resource-limit"
+
 	// VisibilityClusterLocal is the label value for VisibilityLabelKey
 	// that will result to the Route/KService getting a cluster local
 	// domain suffix.
@@ -162,6 +181,24 @@ var (
 		QueueSidecarResourcePercentageAnnotationKey,
 		"queue.sidecar." + GroupName + "/resourcePercentage",
 	}
+	QueueSidecarCPUResourceRequestAnnotation = kmap.KeyPriority{
+		QueueSidecarCPUResourceRequestAnnotationKey,
+	}
+	QueueSidecarCPUResourceLimitAnnotation = kmap.KeyPriority{
+		QueueSidecarCPUResourceLimitAnnotationKey,
+	}
+	QueueSidecarMemoryResourceRequestAnnotation = kmap.KeyPriority{
+		QueueSidecarMemoryResourceRequestAnnotationKey,
+	}
+	QueueSidecarMemoryResourceLimitAnnotation = kmap.KeyPriority{
+		QueueSidecarMemoryResourceLimitAnnotationKey,
+	}
+	QueueSidecarEphemeralStorageResourceRequestAnnotation = kmap.KeyPriority{
+		QueueSidecarEphemeralStorageResourceRequestAnnotationKey,
+	}
+	QueueSidecarEphemeralStorageResourceLimitAnnotation = kmap.KeyPriority{
+		QueueSidecarEphemeralStorageResourceLimitAnnotationKey,
+	}
 	ProgressDeadlineAnnotation = kmap.KeyPriority{
 		ProgressDeadlineAnnotationKey,
 	}
diff --git a/pkg/apis/serving/v1/revision_validation.go b/pkg/apis/serving/v1/revision_validation.go
index 9351f91f1..2508bf8bb 100644
--- a/pkg/apis/serving/v1/revision_validation.go
+++ b/pkg/apis/serving/v1/revision_validation.go
@@ -23,8 +23,10 @@ import (
 	"strings"
 	"time"
 
+	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/api/validation"
 	"knative.dev/pkg/apis"
+	"knative.dev/pkg/kmap"
 	"knative.dev/pkg/kmp"
 	"knative.dev/serving/pkg/apis/autoscaling"
 	"knative.dev/serving/pkg/apis/config"
@@ -68,7 +70,7 @@ func (rts *RevisionTemplateSpec) Validate(ctx context.Context) *apis.FieldError
 	// If the RevisionTemplateSpec has a name specified, then check that
 	// it follows the requirements on the name.
 	errs = errs.Also(validateRevisionName(ctx, rts.Name, rts.GenerateName))
-	errs = errs.Also(validateQueueSidecarAnnotation(rts.Annotations).ViaField("metadata.annotations"))
+	errs = errs.Also(validateQueueSidecarResourceAnnotations(rts.Annotations).ViaField("metadata.annotations"))
 	errs = errs.Also(validateProgressDeadlineAnnotation(rts.Annotations).ViaField("metadata.annotations"))
 	return errs
 }
@@ -179,23 +181,42 @@ func validateTimeoutSeconds(ctx context.Context, timeoutSeconds int64) *apis.Fie
 	return nil
 }
 
-// validateQueueSidecarAnnotation validates QueueSideCarResourcePercentageAnnotation
-func validateQueueSidecarAnnotation(m map[string]string) *apis.FieldError {
+// validateQueueSidecarResourceAnnotations validates QueueSideCarResourcePercentageAnnotation and other QP resource related annotations.
+func validateQueueSidecarResourceAnnotations(m map[string]string) *apis.FieldError {
 	if len(m) == 0 {
 		return nil
 	}
-	k, v, ok := serving.QueueSidecarResourcePercentageAnnotation.Get(m)
-	if !ok {
-		return nil
-	}
-	value, err := strconv.ParseFloat(v, 64)
-	if err != nil {
-		return apis.ErrInvalidValue(v, apis.CurrentField).ViaKey(k)
+
+	var errs *apis.FieldError
+	if k, v, ok := serving.QueueSidecarResourcePercentageAnnotation.Get(m); ok {
+		errs = apis.ErrGeneric("Queue proxy resource percentage annotation is deprecated. Please use the available annotations to explicitly set resource values per service").ViaKey(k).At(apis.WarningLevel)
+		value, err := strconv.ParseFloat(v, 64)
+		if err != nil {
+			errs = errs.Also(apis.ErrInvalidValue(v, apis.CurrentField).ViaKey(k))
+		} else {
+			if value < 0.1 || value > 100 {
+				errs = errs.Also(apis.ErrOutOfBoundsValue(value, 0.1, 100.0, apis.CurrentField).ViaKey(k))
+			}
+		}
 	}
-	if value < 0.1 || value > 100 {
-		return apis.ErrOutOfBoundsValue(value, 0.1, 100.0, apis.CurrentField).ViaKey(k)
+	annoKeys := []kmap.KeyPriority{
+		serving.QueueSidecarCPUResourceRequestAnnotation,
+		serving.QueueSidecarCPUResourceLimitAnnotation,
+		serving.QueueSidecarMemoryResourceRequestAnnotation,
+		serving.QueueSidecarMemoryResourceLimitAnnotation,
+		serving.QueueSidecarEphemeralStorageResourceRequestAnnotation,
+		serving.QueueSidecarEphemeralStorageResourceLimitAnnotation,
+	}
+	for _, resAnno := range annoKeys {
+		k, v, ok := resAnno.Get(m)
+		if !ok {
+			continue
+		}
+		if _, err := resource.ParseQuantity(v); err != nil {
+			errs = errs.Also(apis.ErrInvalidValue(v, apis.CurrentField).ViaKey(k))
+		}
 	}
-	return nil
+	return errs
 }
 
 // ValidateProgressDeadlineAnnotation validates the revision progress deadline annotation.
diff --git a/pkg/queue/sharedmain/main.go b/pkg/queue/sharedmain/main.go
index a28d88775..0400d4164 100644
--- a/pkg/queue/sharedmain/main.go
+++ b/pkg/queue/sharedmain/main.go
@@ -32,7 +32,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/types"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netstats "knative.dev/networking/pkg/http/stats"
 	pkglogging "knative.dev/pkg/logging"
 	"knative.dev/pkg/logging/logkey"
diff --git a/pkg/reconciler/autoscaling/kpa/kpa.go b/pkg/reconciler/autoscaling/kpa/kpa.go
index e155aa56b..013022d2d 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa.go
@@ -25,6 +25,7 @@ import (
 	"go.uber.org/zap"
 
 	nv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	"knative.dev/pkg/logging"
 	pkgmetrics "knative.dev/pkg/metrics"
 	"knative.dev/pkg/ptr"
@@ -128,7 +129,7 @@ func (c *Reconciler) ReconcileKind(ctx context.Context, pa *autoscalingv1alpha1.
 	// When activator CA is enabled, force activator always in path.
 	// TODO: This is a temporary state and to be fixed.
 	// See also issues/11906 and issues/12797.
-	case config.FromContext(ctx).Network.InternalEncryption:
+	case config.FromContext(ctx).Network.DataplaneTrust != netcfg.TrustDisabled:
 		mode = nv1alpha1.SKSOperationModeProxy
 
 	// If the want == -1 and PA is inactive that implies the autoscaler
diff --git a/pkg/reconciler/revision/reconcile_resources.go b/pkg/reconciler/revision/reconcile_resources.go
index 1ff13b27a..4818c35b9 100644
--- a/pkg/reconciler/revision/reconcile_resources.go
+++ b/pkg/reconciler/revision/reconcile_resources.go
@@ -28,7 +28,7 @@ import (
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	"knative.dev/pkg/kmeta"
 	"knative.dev/pkg/kmp"
 	"knative.dev/pkg/logging"
diff --git a/pkg/reconciler/revision/resources/queue.go b/pkg/reconciler/revision/resources/queue.go
index 9fe5511ae..17dd97a3f 100644
--- a/pkg/reconciler/revision/resources/queue.go
+++ b/pkg/reconciler/revision/resources/queue.go
@@ -138,6 +138,30 @@ func createQueueResources(cfg *deployment.Config, annotations map[string]string,
 		}
 	}
 
+	if requestCPU, ok := resourceFromAnnotation(annotations, serving.QueueSidecarCPUResourceRequestAnnotation); ok {
+		resourceRequests[corev1.ResourceCPU] = requestCPU
+	}
+
+	if limitCPU, ok := resourceFromAnnotation(annotations, serving.QueueSidecarCPUResourceLimitAnnotation); ok {
+		resourceLimits[corev1.ResourceCPU] = limitCPU
+	}
+
+	if requestMemory, ok := resourceFromAnnotation(annotations, serving.QueueSidecarMemoryResourceRequestAnnotation); ok {
+		resourceRequests[corev1.ResourceMemory] = requestMemory
+	}
+
+	if limitMemory, ok := resourceFromAnnotation(annotations, serving.QueueSidecarMemoryResourceLimitAnnotation); ok {
+		resourceLimits[corev1.ResourceMemory] = limitMemory
+	}
+
+	if requestEphmeralStorage, ok := resourceFromAnnotation(annotations, serving.QueueSidecarEphemeralStorageResourceRequestAnnotation); ok {
+		resourceRequests[corev1.ResourceEphemeralStorage] = requestEphmeralStorage
+	}
+
+	if limitEphemeralStorage, ok := resourceFromAnnotation(annotations, serving.QueueSidecarEphemeralStorageResourceLimitAnnotation); ok {
+		resourceLimits[corev1.ResourceEphemeralStorage] = limitEphemeralStorage
+	}
+
 	resources := corev1.ResourceRequirements{
 		Requests: resourceRequests,
 	}
@@ -172,6 +196,12 @@ func computeResourceRequirements(resourceQuantity *resource.Quantity, fraction f
 	return true, newquantity
 }
 
+func resourceFromAnnotation(m map[string]string, key kmap.KeyPriority) (resource.Quantity, bool) {
+	_, v, _ := key.Get(m)
+	q, err := resource.ParseQuantity(v)
+	return q, err == nil
+}
+
 func fractionFromPercentage(m map[string]string, key kmap.KeyPriority) (float64, bool) {
 	_, v, _ := key.Get(m)
 	value, err := strconv.ParseFloat(v, 64)
diff --git a/pkg/reconciler/route/resources/ingress.go b/pkg/reconciler/route/resources/ingress.go
index 588a37cfe..64bb51020 100644
--- a/pkg/reconciler/route/resources/ingress.go
+++ b/pkg/reconciler/route/resources/ingress.go
@@ -29,6 +29,7 @@ import (
 
 	"knative.dev/networking/pkg/apis/networking"
 	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	netcfg "knative.dev/networking/pkg/config"
 	netheader "knative.dev/networking/pkg/http/header"
 	ingress "knative.dev/networking/pkg/ingress"
 	"knative.dev/pkg/kmeta"
@@ -149,7 +150,7 @@ func makeIngressSpec(
 				return netv1alpha1.IngressSpec{}, err
 			}
 			rule := makeIngressRule(domains, r.Namespace,
-				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.InternalEncryption)
+				visibility, tc.Targets[name], ro.RolloutsByTag(name), networkConfig.DataplaneTrust != netcfg.TrustDisabled)
 			if featuresConfig.TagHeaderBasedRouting == apicfg.Enabled {
 				if rule.HTTP.Paths[0].AppendHeaders == nil {
 					rule.HTTP.Paths[0].AppendHeaders = make(map[string]string, 1)
@@ -171,7 +172,7 @@ func makeIngressSpec(
 					// Since names are sorted `DefaultTarget == ""` is the first one,
 					// so just pass the subslice.
 					rule.HTTP.Paths = append(
-						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.InternalEncryption, names[1:]), rule.HTTP.Paths...)
+						makeTagBasedRoutingIngressPaths(r.Namespace, tc, ro, networkConfig.DataplaneTrust != netcfg.TrustDisabled, names[1:]), rule.HTTP.Paths...)
 				} else {
 					// If a request is routed by a tag-attached hostname instead of the tag header,
 					// the request may not have the tag header "Knative-Serving-Tag",
diff --git a/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE b/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE
deleted file mode 100644
index 261eeb9e9..000000000
--- a/third_party/VENDOR-LICENSE/knative.dev/control-protocol/pkg/certificates/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/knative.dev/control-protocol/LICENSE b/vendor/knative.dev/control-protocol/LICENSE
deleted file mode 100644
index 261eeb9e9..000000000
--- a/vendor/knative.dev/control-protocol/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/knative.dev/hack/README.md b/vendor/knative.dev/hack/README.md
index b3ad76c5a..5dc34c8ed 100644
--- a/vendor/knative.dev/hack/README.md
+++ b/vendor/knative.dev/hack/README.md
@@ -96,7 +96,7 @@ main "$@"
 This is a helper script for Knative E2E test scripts. To use it:
 
 1. [optional] Customize the test cluster. Pass the flags as described
-   [here](../tools/kntest/pkg/kubetest2/gke/README.md) to the `initialize` function
+   [here](https://github.com/knative/toolbox/blob/main/kntest/pkg/kubetest2/gke/README.md) to the `initialize` function
    call if the default values don't fit your needs.
 
 1. Source the script.
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
index 8d9530844..35787c8d5 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
@@ -29,7 +29,7 @@ func (c *Certificate) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates CertificateSpec object.
-func (spec *CertificateSpec) Validate(ctx context.Context) (all *apis.FieldError) {
+func (spec *CertificateSpec) Validate(_ context.Context) (all *apis.FieldError) {
 	// Spec must have at least one DNS Name.
 	if len(spec.DNSNames) == 0 {
 		all = all.Also(apis.ErrMissingField("dnsNames"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
index a0cec0126..1d3ff93c8 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_defaults.go
@@ -28,5 +28,5 @@ func (d *Domain) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in DomainSpec
-func (*DomainSpec) SetDefaults(ctx context.Context) {
+func (*DomainSpec) SetDefaults(_ context.Context) {
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
index d2434e234..85d556972 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/domain_validation.go
@@ -50,7 +50,7 @@ func (ds *DomainSpec) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-func (lb *LoadBalancerIngressSpec) Validate(ctx context.Context) *apis.FieldError {
+func (lb *LoadBalancerIngressSpec) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if lb.Domain == "" && lb.DomainInternal == "" && lb.IP == "" && !lb.MeshOnly {
 		return all.Also(apis.ErrMissingOneOf("domain", "domainInternal", "ip", "meshOnly"))
@@ -58,7 +58,7 @@ func (lb *LoadBalancerIngressSpec) Validate(ctx context.Context) *apis.FieldErro
 	return all
 }
 
-func (cfg *IngressConfig) Validate(ctx context.Context) *apis.FieldError {
+func (cfg *IngressConfig) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if cfg.Name == "" {
 		all = all.Also(apis.ErrMissingField("name"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
index 890717dd6..6cfc08524 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
@@ -38,7 +38,7 @@ func (is *IngressSpec) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in IngressTLS
-func (t *IngressTLS) SetDefaults(ctx context.Context) {}
+func (t *IngressTLS) SetDefaults(_ context.Context) {}
 
 // SetDefaults populates default values in IngressRule
 func (r *IngressRule) SetDefaults(ctx context.Context) {
@@ -56,7 +56,7 @@ func (h *HTTPIngressRuleValue) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in HTTPIngressPath
-func (h *HTTPIngressPath) SetDefaults(ctx context.Context) {
+func (h *HTTPIngressPath) SetDefaults(_ context.Context) {
 	// If only one split is specified, we default to 100.
 	if len(h.Splits) == 1 && h.Splits[0].Percent == 0 {
 		h.Splits[0].Percent = 100
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
index ed708d420..2a49acddb 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
@@ -152,7 +152,7 @@ func (b IngressBackend) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates IngressTLS object.
-func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
+func (t *IngressTLS) Validate(_ context.Context) *apis.FieldError {
 	// Provided TLS setting must not be empty.
 	if equality.Semantic.DeepEqual(t, &IngressTLS{}) {
 		return apis.ErrMissingField(apis.CurrentField)
@@ -168,7 +168,7 @@ func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-func (t HTTPOption) Validate(ctx context.Context) (all *apis.FieldError) {
+func (t HTTPOption) Validate(_ context.Context) (all *apis.FieldError) {
 	switch t {
 	case "", HTTPOptionEnabled, HTTPOptionRedirected:
 		break
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
index 85d7c41f1..5614104be 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_defaults.go
@@ -28,5 +28,5 @@ func (r *Realm) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults populates default values in RealmSpec
-func (*RealmSpec) SetDefaults(ctx context.Context) {
+func (*RealmSpec) SetDefaults(_ context.Context) {
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
index 7137499d7..93caf7016 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/realm_validation.go
@@ -28,7 +28,7 @@ func (r *Realm) Validate(ctx context.Context) *apis.FieldError {
 }
 
 // Validate inspects and validates RealmSpec object.
-func (rs *RealmSpec) Validate(ctx context.Context) *apis.FieldError {
+func (rs *RealmSpec) Validate(_ context.Context) *apis.FieldError {
 	var all *apis.FieldError
 	if rs.External == "" && rs.Internal == "" {
 		all = all.Also(apis.ErrMissingOneOf("external", "internal"))
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
index 884754d09..cb358ad90 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/serverlessservice_defaults.go
@@ -24,6 +24,6 @@ func (ss *ServerlessService) SetDefaults(ctx context.Context) {
 }
 
 // SetDefaults sets default values on the ServerlessServiceSpec.
-func (*ServerlessServiceSpec) SetDefaults(ctx context.Context) {
+func (*ServerlessServiceSpec) SetDefaults(_ context.Context) {
 	// Nothing is defaultable so far.
 }
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/certs.go b/vendor/knative.dev/networking/pkg/certificates/certs.go
similarity index 71%
rename from vendor/knative.dev/control-protocol/pkg/certificates/certs.go
rename to vendor/knative.dev/networking/pkg/certificates/certs.go
index 68cb4f125..16cca6047 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/certs.go
+++ b/vendor/knative.dev/networking/pkg/certificates/certs.go
@@ -23,13 +23,9 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"math/big"
 	"time"
-
-	"go.uber.org/zap"
-	"knative.dev/pkg/logging"
 )
 
 var randReader = rand.Reader
@@ -39,7 +35,7 @@ var serialNumberLimit = new(big.Int).Lsh(big.NewInt(1), 128)
 func createCertTemplate(expirationInterval time.Duration, sans []string) (*x509.Certificate, error) {
 	serialNumber, err := rand.Int(randReader, serialNumberLimit)
 	if err != nil {
-		return nil, errors.New("failed to generate serial number: " + err.Error())
+		return nil, fmt.Errorf("failed to generate serial number: %w", err)
 	}
 
 	tmpl := x509.Certificate{
@@ -83,12 +79,12 @@ func createTransportCertTemplate(expirationInterval time.Duration, sans []string
 	return cert, err
 }
 
-func createCert(template, parent *x509.Certificate, pub, parentPriv interface{}) (cert *x509.Certificate, certPEM *pem.Block, err error) {
+func createCert(template, parent *x509.Certificate, pub, parentPriv interface{}) (certPEM *pem.Block, err error) {
 	certDER, err := x509.CreateCertificate(rand.Reader, template, parent, pub, parentPriv)
 	if err != nil {
 		return
 	}
-	cert, err = x509.ParseCertificate(certDER)
+	_, err = x509.ParseCertificate(certDER)
 	if err != nil {
 		return
 	}
@@ -97,24 +93,20 @@ func createCert(template, parent *x509.Certificate, pub, parentPriv interface{})
 }
 
 // CreateCACerts generates the root CA cert
-func CreateCACerts(ctx context.Context, expirationInterval time.Duration) (*KeyPair, error) {
-	logger := logging.FromContext(ctx)
+func CreateCACerts(expirationInterval time.Duration) (*KeyPair, error) {
 	caKeyPair, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		logger.Errorw("error generating random key", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating random key: %w", err)
 	}
 
 	rootCertTmpl, err := createCACertTemplate(expirationInterval)
 	if err != nil {
-		logger.Errorw("error generating CA cert", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating CA cert: %w", err)
 	}
 
-	_, caCertPem, err := createCert(rootCertTmpl, rootCertTmpl, &caKeyPair.PublicKey, caKeyPair)
+	caCertPem, err := createCert(rootCertTmpl, rootCertTmpl, &caKeyPair.PublicKey, caKeyPair)
 	if err != nil {
-		logger.Errorw("error signing the CA cert", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error signing the CA cert: %w", err)
 	}
 	caPrivateKeyPem := &pem.Block{
 		Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(caKeyPair),
@@ -123,37 +115,33 @@ func CreateCACerts(ctx context.Context, expirationInterval time.Duration) (*KeyP
 }
 
 // Deprecated: CreateControlPlaneCert generates the certificate for the client
-func CreateControlPlaneCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
-	return CreateCert(ctx, caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
+func CreateControlPlaneCert(_ context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
+	return CreateCert(caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
 }
 
 // Deprecated: CreateDataPlaneCert generates the certificate for the server
-func CreateDataPlaneCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
-	return CreateCert(ctx, caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
+func CreateDataPlaneCert(_ context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration) (*KeyPair, error) {
+	return CreateCert(caKey, caCertificate, expirationInterval, LegacyFakeDnsName)
 }
 
 // CreateCert generates the certificate for use by client and server
-func CreateCert(ctx context.Context, caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration, sans ...string) (*KeyPair, error) {
-	logger := logging.FromContext(ctx)
+func CreateCert(caKey *rsa.PrivateKey, caCertificate *x509.Certificate, expirationInterval time.Duration, sans ...string) (*KeyPair, error) {
 
 	// Then create the private key for the serving cert
 	keyPair, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		logger.Errorw("error generating random key", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error generating random key: %w", err)
 	}
 
 	certTemplate, err := createTransportCertTemplate(expirationInterval, sans)
 	if err != nil {
-		logger.Errorw("failed to create the certificate template", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("failed to create the certificate template: %w", err)
 	}
 
 	// create a certificate which wraps the public key, sign it with the CA private key
-	_, certPEM, err := createCert(certTemplate, caCertificate, &keyPair.PublicKey, caKey)
+	certPEM, err := createCert(certTemplate, caCertificate, &keyPair.PublicKey, caKey)
 	if err != nil {
-		logger.Errorw("error signing certificate template", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error signing certificate template: %w", err)
 	}
 
 	privateKeyPEM := &pem.Block{
@@ -187,9 +175,9 @@ func ParseCert(certPemBytes []byte, privateKeyPemBytes []byte) (*x509.Certificat
 	return cert, pk, err
 }
 
-// ValidateCert checks the expiration of the certificate
-func ValidateCert(cert *x509.Certificate, rotationThreshold time.Duration) error {
-	if !cert.NotAfter.After(time.Now().Add(rotationThreshold)) {
+// CheckExpiry checks the expiration of the certificate
+func CheckExpiry(cert *x509.Certificate, rotationThreshold time.Duration) error {
+	if time.Now().Add(rotationThreshold).After(cert.NotAfter) {
 		return fmt.Errorf("certificate is going to expire %v", cert.NotAfter)
 	}
 	return nil
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/constants.go b/vendor/knative.dev/networking/pkg/certificates/constants.go
similarity index 75%
rename from vendor/knative.dev/control-protocol/pkg/certificates/constants.go
rename to vendor/knative.dev/networking/pkg/certificates/constants.go
index cfb125e33..04a1d7747 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/constants.go
+++ b/vendor/knative.dev/networking/pkg/certificates/constants.go
@@ -19,9 +19,12 @@ package certificates
 import "strings"
 
 const (
-	Organization           = "knative.dev"
-	LegacyFakeDnsName      = "data-plane." + Organization
-	FakeDnsName            = LegacyFakeDnsName // Deprecated
+	Organization = "knative.dev"
+	//nolint:all
+	LegacyFakeDnsName = "data-plane." + Organization
+	//nolint:all
+	// Deprecated: FakeDnsName is deprecated. Please use the DataPlaneRoutingName or DataPlaneUserName function.
+	FakeDnsName            = LegacyFakeDnsName
 	dataPlaneUserPrefix    = "kn-user-"
 	dataPlaneRoutingPrefix = "kn-routing-"
 	ControlPlaneName       = "kn-control"
@@ -33,18 +36,21 @@ const (
 	PrivateKeyName = "tls.key"
 
 	//These should be able to be deprecated some time in the future when the new names are fully adopted
+	// #nosec
 	SecretCaCertKey = "ca-cert.pem"
-	SecretCertKey   = "public-cert.pem"
-	SecretPKKey     = "private-key.pem"
+	// #nosec
+	SecretCertKey = "public-cert.pem"
+	// #nosec
+	SecretPKKey = "private-key.pem"
 )
 
 // DataPlaneRoutingName constructs a san for a data-plane-routing certificate
 // Accepts a routingId  - a unique identifier used as part of the san (default is "0" used when an empty routingId is provided)
-func DataPlaneRoutingName(routingId string) string {
-	if routingId == "" {
-		routingId = "0"
+func DataPlaneRoutingName(routingID string) string {
+	if routingID == "" {
+		routingID = "0"
 	}
-	return dataPlaneRoutingPrefix + strings.ToLower(routingId)
+	return dataPlaneRoutingPrefix + strings.ToLower(routingID)
 }
 
 // DataPlaneUserName constructs a san for a data-plane-user certificate
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/key_pair.go b/vendor/knative.dev/networking/pkg/certificates/key_pair.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/key_pair.go
rename to vendor/knative.dev/networking/pkg/certificates/key_pair.go
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
similarity index 86%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
index c6687a81b..8a4ced724 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/certificates.go
+++ b/vendor/knative.dev/networking/pkg/certificates/reconciler/certificates.go
@@ -17,6 +17,7 @@ limitations under the License.
 package sample
 
 import (
+	"bytes"
 	"context"
 	"crypto/rsa"
 	"crypto/x509"
@@ -34,7 +35,7 @@ import (
 	pkgreconciler "knative.dev/pkg/reconciler"
 	"knative.dev/pkg/system"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 )
 
 const (
@@ -89,14 +90,14 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 		r.logger.Errorf("Error accessing CA certificate secret %q %q: %v", system.Namespace(), r.caSecretName, err)
 		return err
 	}
-	caCert, caPk, err := parseAndValidateSecret(caSecret, false)
+	caCert, caPk, err := parseAndValidateSecret(caSecret, nil)
 	if err != nil {
 		r.logger.Infof("CA cert invalid: %v", err)
 
 		// We need to generate a new CA cert, then shortcircuit the reconciler
-		keyPair, err := certificates.CreateCACerts(ctx, caExpirationInterval)
+		keyPair, err := certificates.CreateCACerts(caExpirationInterval)
 		if err != nil {
-			return fmt.Errorf("cannot generate the CA cert: %v", err)
+			return fmt.Errorf("cannot generate the CA cert: %w", err)
 		}
 		return r.commitUpdatedSecret(ctx, caSecret, keyPair, nil)
 	}
@@ -107,8 +108,8 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 	case controlPlaneSecretType:
 		sans = []string{certificates.ControlPlaneName, certificates.LegacyFakeDnsName}
 	case dataPlaneRoutingSecretType:
-		routingId := secret.Labels[secretRoutingId]
-		san := certificates.DataPlaneRoutingName(routingId)
+		routingID := secret.Labels[secretRoutingID]
+		san := certificates.DataPlaneRoutingName(routingID)
 		sans = []string{san, certificates.LegacyFakeDnsName}
 	case dataPlaneUserSecretType:
 		sans = []string{certificates.DataPlaneUserName(secret.Namespace), certificates.LegacyFakeDnsName}
@@ -118,15 +119,15 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 		return fmt.Errorf("unknown cert type: %v", r.secretTypeLabelName)
 	}
 
-	cert, _, err := parseAndValidateSecret(secret, true, sans...)
+	cert, _, err := parseAndValidateSecret(secret, caSecret.Data[certificates.SecretCertKey], sans...)
 	if err != nil {
 		r.logger.Infof("Secret invalid: %v", err)
 		// Check the secret to reconcile type
 
 		var keyPair *certificates.KeyPair
-		keyPair, err = certificates.CreateCert(ctx, caPk, caCert, expirationInterval, sans...)
+		keyPair, err = certificates.CreateCert(caPk, caCert, expirationInterval, sans...)
 		if err != nil {
-			return fmt.Errorf("cannot generate the cert: %v", err)
+			return fmt.Errorf("cannot generate the cert: %w", err)
 		}
 		err = r.commitUpdatedSecret(ctx, secret, keyPair, caSecret.Data[certificates.SecretCertKey])
 		if err != nil {
@@ -144,7 +145,7 @@ func (r *reconciler) ReconcileKind(ctx context.Context, secret *corev1.Secret) p
 }
 
 // All sans provided are required to be lower case
-func parseAndValidateSecret(secret *corev1.Secret, shouldContainCaCert bool, sans ...string) (*x509.Certificate, *rsa.PrivateKey, error) {
+func parseAndValidateSecret(secret *corev1.Secret, caCert []byte, sans ...string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	certBytes, ok := secret.Data[certificates.SecretCertKey]
 	if !ok {
 		return nil, nil, fmt.Errorf("missing cert bytes")
@@ -153,17 +154,21 @@ func parseAndValidateSecret(secret *corev1.Secret, shouldContainCaCert bool, san
 	if !ok {
 		return nil, nil, fmt.Errorf("missing pk bytes")
 	}
-	if shouldContainCaCert {
-		if _, ok := secret.Data[certificates.SecretCaCertKey]; !ok {
+	if caCert != nil {
+		ca, ok := secret.Data[certificates.SecretCaCertKey]
+		if !ok {
 			return nil, nil, fmt.Errorf("missing ca cert bytes")
 		}
+		if !bytes.Equal(ca, caCert) {
+			return nil, nil, fmt.Errorf("ca cert bytes changed")
+		}
 	}
 
 	cert, caPk, err := certificates.ParseCert(certBytes, pkBytes)
 	if err != nil {
 		return nil, nil, err
 	}
-	if err := certificates.ValidateCert(cert, rotationThreshold); err != nil {
+	if err := certificates.CheckExpiry(cert, rotationThreshold); err != nil {
 		return nil, nil, err
 	}
 
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
similarity index 98%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
index 88bac5a21..dab349547 100644
--- a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller.go
+++ b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller.go
@@ -38,7 +38,7 @@ import (
 const (
 	caSecretNamePostfix    = "-ctrl-ca"
 	secretLabelNamePostfix = "-ctrl"
-	secretRoutingId        = "routing-id"
+	secretRoutingID        = "routing-id"
 )
 
 // NewControllerFactory generates a ControllerConstructor for the control certificates reconciler.
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller_impl.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/controller_impl.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/controller_impl.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/controller_impl.go
diff --git a/vendor/knative.dev/control-protocol/pkg/certificates/reconciler/reconciler.go b/vendor/knative.dev/networking/pkg/certificates/reconciler/reconciler.go
similarity index 100%
rename from vendor/knative.dev/control-protocol/pkg/certificates/reconciler/reconciler.go
rename to vendor/knative.dev/networking/pkg/certificates/reconciler/reconciler.go
diff --git a/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go b/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go
index 491c13f1f..1f6ee8264 100644
--- a/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go
+++ b/vendor/knative.dev/pkg/apis/duck/v1/kresource_type.go
@@ -23,6 +23,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+
 	"knative.dev/pkg/apis/duck/ducktypes"
 
 	"knative.dev/pkg/apis"
@@ -41,6 +42,7 @@ type KRShaped interface {
 // Asserts KResource conformance with KRShaped
 var _ KRShaped = (*KResource)(nil)
 
+// +genduck
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // KResource is a skeleton type wrapping Conditions in the manner we expect
@@ -54,6 +56,11 @@ type KResource struct {
 	Status Status `json:"status"`
 }
 
+// GetFullType implements duck.Implementable
+func (*KResource) GetFullType() ducktypes.Populatable {
+	return &KResource{}
+}
+
 // Populate implements duck.Populatable
 func (t *KResource) Populate() {
 	t.Status.ObservedGeneration = 42
diff --git a/vendor/knative.dev/pkg/environment/client_config.go b/vendor/knative.dev/pkg/environment/client_config.go
index 04d4220b0..aef33927e 100644
--- a/vendor/knative.dev/pkg/environment/client_config.go
+++ b/vendor/knative.dev/pkg/environment/client_config.go
@@ -19,8 +19,10 @@ package environment
 import (
 	"flag"
 	"fmt"
+	"log"
 	"math"
 	"os"
+	"strconv"
 
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
@@ -45,9 +47,19 @@ func (c *ClientConfig) InitFlags(fs *flag.FlagSet) {
 	fs.StringVar(&c.Kubeconfig, "kubeconfig", os.Getenv("KUBECONFIG"),
 		"Path to a kubeconfig. Only required if out-of-cluster.")
 
-	fs.IntVar(&c.Burst, "kube-api-burst", 0, "Maximum burst for throttle.")
+	fs.IntVar(&c.Burst, "kube-api-burst", int(envVarOrDefault("KUBE_API_BURST", 0)), "Maximum burst for throttle.")
 
-	fs.Float64Var(&c.QPS, "kube-api-qps", 0, "Maximum QPS to the server from the client.")
+	fs.Float64Var(&c.QPS, "kube-api-qps", envVarOrDefault("KUBE_API_QPS", 0.0), "Maximum QPS to the server from the client.")
+}
+
+func envVarOrDefault(key string, val float64) float64 {
+	var err error
+	if v := os.Getenv(key); v != "" {
+		if val, err = strconv.ParseFloat(v, 64); err != nil {
+			log.Fatal(err)
+		}
+	}
+	return val
 }
 
 func (c *ClientConfig) GetRESTConfig() (*rest.Config, error) {
diff --git a/vendor/knative.dev/pkg/injection/clients.go b/vendor/knative.dev/pkg/injection/clients.go
index 92e991218..b71ef1d94 100644
--- a/vendor/knative.dev/pkg/injection/clients.go
+++ b/vendor/knative.dev/pkg/injection/clients.go
@@ -62,22 +62,3 @@ func (i *impl) FetchAllClients(ctx context.Context) []interface{} {
 	}
 	return clients
 }
-
-// DynamicClientInjector holds the type of a callback that attaches a particular
-// client type to a context.
-type DynamicClientInjector func(context.Context) context.Context
-
-func (i *impl) RegisterDynamicClient(ci DynamicClientInjector) {
-	i.m.Lock()
-	defer i.m.Unlock()
-
-	i.dynamicClients = append(i.dynamicClients, ci)
-}
-
-func (i *impl) GetDynamicClients() []DynamicClientInjector {
-	i.m.RLock()
-	defer i.m.RUnlock()
-
-	// Copy the slice before returning.
-	return append(i.dynamicClients[:0:0], i.dynamicClients...)
-}
diff --git a/vendor/knative.dev/pkg/injection/informers.go b/vendor/knative.dev/pkg/injection/informers.go
index ce5d481e8..9356f8d7f 100644
--- a/vendor/knative.dev/pkg/injection/informers.go
+++ b/vendor/knative.dev/pkg/injection/informers.go
@@ -28,10 +28,6 @@ import (
 // informer type to a context.
 type InformerInjector func(context.Context) (context.Context, controller.Informer)
 
-// DynamicInformerInjector holds the type of a callback that attaches a particular
-// informer type (backed by a Dynamic) to a context.
-type DynamicInformerInjector func(context.Context) context.Context
-
 // FilteredInformersInjector holds the type of a callback that attaches a set of particular
 // filtered informers type to a context.
 type FilteredInformersInjector func(context.Context) (context.Context, []controller.Informer)
@@ -43,13 +39,6 @@ func (i *impl) RegisterInformer(ii InformerInjector) {
 	i.informers = append(i.informers, ii)
 }
 
-func (i *impl) RegisterDynamicInformer(ii DynamicInformerInjector) {
-	i.m.Lock()
-	defer i.m.Unlock()
-
-	i.dynamicInformers = append(i.dynamicInformers, ii)
-}
-
 func (i *impl) RegisterFilteredInformers(fii FilteredInformersInjector) {
 	i.m.Lock()
 	defer i.m.Unlock()
@@ -65,14 +54,6 @@ func (i *impl) GetInformers() []InformerInjector {
 	return append(i.informers[:0:0], i.informers...)
 }
 
-func (i *impl) GetDynamicInformers() []DynamicInformerInjector {
-	i.m.RLock()
-	defer i.m.RUnlock()
-
-	// Copy the slice before returning.
-	return append(i.dynamicInformers[:0:0], i.dynamicInformers...)
-}
-
 func (i *impl) GetFilteredInformers() []FilteredInformersInjector {
 	i.m.RLock()
 	defer i.m.RUnlock()
@@ -81,22 +62,6 @@ func (i *impl) GetFilteredInformers() []FilteredInformersInjector {
 	return append(i.filteredInformers[:0:0], i.filteredInformers...)
 }
 
-func (i *impl) SetupDynamic(ctx context.Context) context.Context {
-	// Based on the reconcilers we have linked, build up a set of clients and inject
-	// them onto the context.
-	for _, ci := range i.GetDynamicClients() {
-		ctx = ci(ctx)
-	}
-
-	// Based on the reconcilers we have linked, build up a set of informers
-	// and inject them onto the context.
-	for _, ii := range i.GetDynamicInformers() {
-		ctx = ii(ctx)
-	}
-
-	return ctx
-}
-
 func (i *impl) SetupInformers(ctx context.Context, cfg *rest.Config) (context.Context, []controller.Informer) {
 	// Based on the reconcilers we have linked, build up a set of clients and inject
 	// them onto the context.
diff --git a/vendor/knative.dev/pkg/injection/interface.go b/vendor/knative.dev/pkg/injection/interface.go
index 158864015..c6d5715ad 100644
--- a/vendor/knative.dev/pkg/injection/interface.go
+++ b/vendor/knative.dev/pkg/injection/interface.go
@@ -78,29 +78,6 @@ type Interface interface {
 	SetupInformers(context.Context, *rest.Config) (context.Context, []controller.Informer)
 }
 
-// DynamicInterface is the interface for interacting with dynamicclient-based injection
-// implementations, such as Dynamic below.
-type DynamicInterface interface {
-	// RegisterDynamicClient registers a new injector callback for associating
-	// a new dynamicclient-based client with a context.
-	RegisterDynamicClient(DynamicClientInjector)
-
-	// GetDynamicClients fetches all of the registered dynamicclient-based client injectors.
-	GetDynamicClients() []DynamicClientInjector
-
-	// RegisterDynamicInformer registers a new injector callback for associating
-	// a new dynamicclient-based informer with a context.
-	RegisterDynamicInformer(DynamicInformerInjector)
-
-	// GetDynamicInformers fetches all of the registered dynamicclient-based informer injectors.
-	GetDynamicInformers() []DynamicInformerInjector
-
-	// SetupDynamic runs all of the injectors against a context, starting with
-	// the clients and the given stream.  A context infused with the various elements
-	// is returned.
-	SetupDynamic(context.Context) context.Context
-}
-
 type ControllerConstructor func(context.Context, configmap.Watcher) *controller.Impl
 
 // NamedControllerConstructor is a ControllerConstructor with an associated name.
@@ -120,10 +97,6 @@ var (
 	// are being run for real.
 	Default Interface = &impl{}
 
-	// Dynamic is the injection interface to use when bootstrapping a version
-	// of things based on the prototype dynamicclient-based reconciler framework.
-	Dynamic DynamicInterface = &impl{}
-
 	// Fake is the injection interface with which informers should register
 	// to make themselves available to the controller process when it is being
 	// unit tested.
@@ -134,11 +107,9 @@ type impl struct {
 	m sync.RWMutex
 
 	clients           []ClientInjector
-	dynamicClients    []DynamicClientInjector
 	clientFetchers    []ClientFetcher
 	factories         []InformerFactoryInjector
 	informers         []InformerInjector
-	dynamicInformers  []DynamicInformerInjector
 	filteredInformers []FilteredInformersInjector
 	ducks             []DuckFactoryInjector
 }
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go
index b50fcf8f4..ba50005d7 100644
--- a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/controller.go
@@ -46,13 +46,6 @@ func NewAdmissionController(
 	callbacks ...map[schema.GroupVersionKind]Callback,
 ) *controller.Impl {
 
-	client := kubeclient.Get(ctx)
-	mwhInformer := mwhinformer.Get(ctx)
-	secretInformer := secretinformer.Get(ctx)
-	options := webhook.GetOptions(ctx)
-
-	key := types.NamespacedName{Name: name}
-
 	// This not ideal, we are using a variadic argument to effectively make callbacks optional
 	// This allows this addition to be non-breaking to consumers of /pkg
 	// TODO: once all sub-repos have adopted this, we might move this back to a traditional param.
@@ -66,6 +59,34 @@ func NewAdmissionController(
 		panic("NewAdmissionController may not be called with multiple callback maps")
 	}
 
+	opts := []OptionFunc{
+		WithPath(path),
+		WithTypes(handlers),
+		WithWrapContext(wc),
+		WithCallbacks(unwrappedCallbacks),
+	}
+
+	if disallowUnknownFields {
+		opts = append(opts, WithDisallowUnknownFields())
+	}
+
+	return newController(ctx, name, opts...)
+}
+
+func newController(ctx context.Context, name string, optsFunc ...OptionFunc) *controller.Impl {
+	client := kubeclient.Get(ctx)
+	mwhInformer := mwhinformer.Get(ctx)
+	secretInformer := secretinformer.Get(ctx)
+
+	opts := &options{}
+	wopts := webhook.GetOptions(ctx)
+
+	for _, f := range optsFunc {
+		f(opts)
+	}
+
+	key := types.NamespacedName{Name: name}
+
 	wh := &reconciler{
 		LeaderAwareFuncs: pkgreconciler.LeaderAwareFuncs{
 			// Have this reconciler enqueue our singleton whenever it becomes leader.
@@ -76,13 +97,13 @@ func NewAdmissionController(
 		},
 
 		key:       key,
-		path:      path,
-		handlers:  handlers,
-		callbacks: unwrappedCallbacks,
+		path:      opts.path,
+		handlers:  opts.types,
+		callbacks: opts.callbacks,
 
-		withContext:           wc,
-		disallowUnknownFields: disallowUnknownFields,
-		secretName:            options.SecretName,
+		withContext:           opts.wc,
+		disallowUnknownFields: opts.disallowUnknownFields,
+		secretName:            wopts.SecretName,
 
 		client:       client,
 		mwhlister:    mwhInformer.Lister(),
@@ -90,8 +111,12 @@ func NewAdmissionController(
 	}
 
 	logger := logging.FromContext(ctx)
-	const queueName = "DefaultingWebhook"
-	c := controller.NewContext(ctx, wh, controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)})
+	controllerOptions := wopts.ControllerOptions
+	if controllerOptions == nil {
+		const queueName = "DefaultingWebhook"
+		controllerOptions = &controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)}
+	}
+	c := controller.NewContext(ctx, wh, *controllerOptions)
 
 	// Reconcile when the named MutatingWebhookConfiguration changes.
 	mwhInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/options.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/options.go
new file mode 100644
index 000000000..deb04945a
--- /dev/null
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/options.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package defaulting
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"knative.dev/pkg/webhook/resourcesemantics"
+)
+
+type options struct {
+	path                  string
+	types                 map[schema.GroupVersionKind]resourcesemantics.GenericCRD
+	wc                    func(context.Context) context.Context
+	disallowUnknownFields bool
+	callbacks             map[schema.GroupVersionKind]Callback
+}
+
+type OptionFunc func(*options)
+
+func WithCallbacks(callbacks map[schema.GroupVersionKind]Callback) OptionFunc {
+	return func(o *options) {
+		o.callbacks = callbacks
+	}
+}
+
+func WithPath(path string) OptionFunc {
+	return func(o *options) {
+		o.path = path
+	}
+}
+
+func WithTypes(types map[schema.GroupVersionKind]resourcesemantics.GenericCRD) OptionFunc {
+	return func(o *options) {
+		o.types = types
+	}
+}
+
+func WithWrapContext(f func(context.Context) context.Context) OptionFunc {
+	return func(o *options) {
+		o.wc = f
+	}
+}
+
+func WithDisallowUnknownFields() OptionFunc {
+	return func(o *options) {
+		o.disallowUnknownFields = true
+	}
+}
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go
index 8e8e008e6..eee6105b4 100644
--- a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/controller.go
@@ -45,10 +45,31 @@ func NewAdmissionControllerWithConfig(
 	disallowUnknownFields bool,
 	callbacks map[schema.GroupVersionKind]Callback,
 ) *controller.Impl {
+
+	opts := []OptionFunc{
+		WithPath(path),
+		WithTypes(handlers),
+		WithWrapContext(wc),
+		WithCallbacks(callbacks),
+	}
+
+	if disallowUnknownFields {
+		opts = append(opts, WithDisallowUnknownFields())
+	}
+	return newController(ctx, name, opts...)
+}
+
+func newController(ctx context.Context, name string, optsFunc ...OptionFunc) *controller.Impl {
 	client := kubeclient.Get(ctx)
 	vwhInformer := vwhinformer.Get(ctx)
 	secretInformer := secretinformer.Get(ctx)
-	options := webhook.GetOptions(ctx)
+	woptions := webhook.GetOptions(ctx)
+
+	opts := &options{}
+
+	for _, f := range optsFunc {
+		f(opts)
+	}
 
 	wh := &reconciler{
 		LeaderAwareFuncs: pkgreconciler.LeaderAwareFuncs{
@@ -62,13 +83,13 @@ func NewAdmissionControllerWithConfig(
 		key: types.NamespacedName{
 			Name: name,
 		},
-		path:      path,
-		handlers:  handlers,
-		callbacks: callbacks,
+		path:      opts.path,
+		handlers:  opts.types,
+		callbacks: opts.callbacks,
 
-		withContext:           wc,
-		disallowUnknownFields: disallowUnknownFields,
-		secretName:            options.SecretName,
+		withContext:           opts.wc,
+		disallowUnknownFields: opts.DisallowUnknownFields(),
+		secretName:            woptions.SecretName,
 
 		client:       client,
 		vwhlister:    vwhInformer.Lister(),
@@ -76,8 +97,13 @@ func NewAdmissionControllerWithConfig(
 	}
 
 	logger := logging.FromContext(ctx)
-	const queueName = "ValidationWebhook"
-	c := controller.NewContext(ctx, wh, controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)})
+
+	controllerOptions := woptions.ControllerOptions
+	if woptions.ControllerOptions == nil {
+		const queueName = "ValidationWebhook"
+		controllerOptions = &controller.ControllerOptions{WorkQueueName: queueName, Logger: logger.Named(queueName)}
+	}
+	c := controller.NewContext(ctx, wh, *controllerOptions)
 
 	// Reconcile when the named ValidatingWebhookConfiguration changes.
 	vwhInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/options.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/options.go
new file mode 100644
index 000000000..108453b6e
--- /dev/null
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/options.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"knative.dev/pkg/webhook/resourcesemantics"
+)
+
+type options struct {
+	path                  string
+	types                 map[schema.GroupVersionKind]resourcesemantics.GenericCRD
+	wc                    func(context.Context) context.Context
+	disallowUnknownFields bool
+	callbacks             map[schema.GroupVersionKind]Callback
+}
+
+type OptionFunc func(*options)
+
+func WithCallbacks(callbacks map[schema.GroupVersionKind]Callback) OptionFunc {
+	return func(o *options) {
+		o.callbacks = callbacks
+	}
+}
+
+func WithPath(path string) OptionFunc {
+	return func(o *options) {
+		o.path = path
+	}
+}
+
+func WithTypes(types map[schema.GroupVersionKind]resourcesemantics.GenericCRD) OptionFunc {
+	return func(o *options) {
+		o.types = types
+	}
+}
+
+func WithWrapContext(f func(context.Context) context.Context) OptionFunc {
+	return func(o *options) {
+		o.wc = f
+	}
+}
+
+func WithDisallowUnknownFields() OptionFunc {
+	return func(o *options) {
+		o.disallowUnknownFields = true
+	}
+}
+
+func (o *options) DisallowUnknownFields() bool {
+	return o.disallowUnknownFields
+}
diff --git a/vendor/knative.dev/pkg/webhook/webhook.go b/vendor/knative.dev/pkg/webhook/webhook.go
index 80bd8c2be..92dd01ae3 100644
--- a/vendor/knative.dev/pkg/webhook/webhook.go
+++ b/vendor/knative.dev/pkg/webhook/webhook.go
@@ -29,6 +29,7 @@ import (
 
 	// Injection stuff
 
+	"knative.dev/pkg/controller"
 	kubeinformerfactory "knative.dev/pkg/injection/clients/namespacedkube/informers/factory"
 	"knative.dev/pkg/network/handlers"
 
@@ -69,6 +70,10 @@ type Options struct {
 	// GracePeriod is how long to wait after failing readiness probes
 	// before shutting down.
 	GracePeriod time.Duration
+
+	// ControllerOptions encapsulates options for creating a new controller,
+	// including throttling and stats behavior.
+	ControllerOptions *controller.ControllerOptions
 }
 
 // Operation is the verb being operated on
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0b20e7738..58d048f9c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1243,7 +1243,7 @@ k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/strings/slices
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20230524171624-ae49e7c31ba6
+# knative.dev/caching v0.0.0-20230615185548-38a807574e69
 ## explicit; go 1.18
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -1264,20 +1264,18 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/control-protocol v0.0.0-20230525131829-4c3c81d2f64d
-## explicit; go 1.18
-knative.dev/control-protocol/pkg/certificates
-knative.dev/control-protocol/pkg/certificates/reconciler
-# knative.dev/hack v0.0.0-20230524013611-5812c57cc1ac
+# knative.dev/hack v0.0.0-20230615155948-d7586a218601
 ## explicit; go 1.18
 knative.dev/hack
 knative.dev/hack/shell
-# knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60
+# knative.dev/networking v0.0.0-20230616133350-b9dd5c201e19
 ## explicit; go 1.18
 knative.dev/networking/config
 knative.dev/networking/pkg
 knative.dev/networking/pkg/apis/networking
 knative.dev/networking/pkg/apis/networking/v1alpha1
+knative.dev/networking/pkg/certificates
+knative.dev/networking/pkg/certificates/reconciler
 knative.dev/networking/pkg/client/clientset/versioned
 knative.dev/networking/pkg/client/clientset/versioned/fake
 knative.dev/networking/pkg/client/clientset/versioned/scheme
@@ -1309,7 +1307,7 @@ knative.dev/networking/pkg/http/stats
 knative.dev/networking/pkg/ingress
 knative.dev/networking/pkg/k8s
 knative.dev/networking/pkg/prober
-# knative.dev/pkg v0.0.0-20230525143525-9bda38b21643
+# knative.dev/pkg v0.0.0-20230616134650-eb63a40adfb0
 ## explicit; go 1.18
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index a74d64dd8..edfa0135e 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -87,9 +87,9 @@ jobs:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         k8s-version:
-        - v1.25.9
-        - v1.26.4
-        - v1.27.1
+        - v1.25.x
+        - v1.26.x
+        - v1.27.x
 
         ingress:
         - kourier
@@ -105,22 +105,6 @@ jobs:
         - e2e
 
         include:
-          # Map between K8s and KinD versions.
-          # This is attempting to make it a bit clearer what's being tested.
-          # See: https://github.com/kubernetes-sigs/kind/releases
-          #      https://hub.docker.com/r/kindest/node/tags
-        - k8s-version: v1.25.9
-          kind-version: v0.19.0
-          kind-image-sha: sha256:c08d6c52820aa42e533b70bce0c2901183326d86dcdcbedecc9343681db45161
-
-        - k8s-version: v1.26.4
-          kind-version: v0.19.0
-          kind-image-sha: sha256:f4c0d87be03d6bea69f5e5dc0adb678bb498a190ee5c38422bf751541cebe92e
-
-        - k8s-version: v1.27.1
-          kind-version: v0.19.0
-          kind-image-sha: sha256:b7d12ed662b873bd8510879c1846e87c7e676a79fefc93e17b2a52989d3ff42b
-
         # Disabled due to consistent failures
         # - ingress: gateway_istio
         #   ingress-class: gateway-api
@@ -166,15 +150,23 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-go-
 
+    - uses: actions/download-artifact@v3
+      with:
+        name: artifacts
+        path: ~/artifacts
+
+    - name: Setup KinD 
+      uses: chainguard-dev/actions/setup-kind@main
+      with:
+        k8s-version: ${{ matrix.k8s-version }}
+        kind-worker-count: 4
+        cluster-suffix: c${{ github.run_id }}.local
+        registry-volume: $HOME/artifacts/registry
+
+ 
     - name: Install Dependencies
       run: |
         set -x
-        echo "::group:: install kind ${KIND_VERSION}"
-        curl -Lo ./kind https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-amd64
-        chmod +x ./kind
-        sudo mv kind /usr/local/bin
-        echo "::endgroup::"
-
         echo "::group:: install gotestsum ${GOTESTSUM_VERSION}"
         curl -L https://github.com/gotestyourself/gotestsum/releases/download/v${GOTESTSUM_VERSION}/gotestsum_${GOTESTSUM_VERSION}_linux_amd64.tar.gz | tar xzf - gotestsum
         chmod +x ./gotestsum
@@ -197,113 +189,6 @@ jobs:
       with:
         fetch-depth: 0
 
-    - uses: actions/download-artifact@v3
-      with:
-        name: artifacts
-        path: ~/artifacts
-
-    - name: Configure KinD Cluster
-      run: |
-        set -x
-
-        # Disable swap otherwise memory enforcement doesn't work
-        # See: https://kubernetes.slack.com/archives/CEKK1KTN2/p1600009955324200
-        sudo swapoff -a
-        sudo rm -f /swapfile
-
-        # Use in-memory storage to avoid etcd server timeouts.
-        # https://kubernetes.slack.com/archives/CEKK1KTN2/p1615134111016300
-        # https://github.com/kubernetes-sigs/kind/issues/845
-        sudo mkdir -p /tmp/etcd
-        sudo mount -t tmpfs tmpfs /tmp/etcd
-
-        # KinD configuration.
-        cat > kind.yaml <<EOF
-        apiVersion: kind.x-k8s.io/v1alpha4
-        kind: Cluster
-
-        # Configure registry for KinD.
-        containerdConfigPatches:
-        - |-
-          [plugins."io.containerd.grpc.v1.cri".registry.mirrors."$REGISTRY_NAME:$REGISTRY_PORT"]
-            endpoint = ["http://$REGISTRY_NAME:$REGISTRY_PORT"]
-          [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
-            endpoint = ["https://mirror.gcr.io"]
-
-        # This is needed in order to support projected volumes with service account tokens.
-        # See: https://kubernetes.slack.com/archives/CEKK1KTN2/p1600268272383600
-        kubeadmConfigPatches:
-          - |
-            kind: ClusterConfiguration
-            metadata:
-              name: config
-            apiServer:
-              extraArgs:
-                "service-account-issuer": "kubernetes.default.svc"
-                "service-account-signing-key-file": "/etc/kubernetes/pki/sa.key"
-            networking:
-              dnsDomain: "${CLUSTER_DOMAIN}"
-
-        nodes:
-        - role: control-plane
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-          extraMounts:
-          - containerPath: /var/lib/etcd
-            hostPath: /tmp/etcd
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        - role: worker
-          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
-        EOF
-
-        kind create cluster --config kind.yaml --wait 5m
-
-    - name: Install metallb
-      shell: bash
-      run: |
-        # Install metallb
-        # disable the webhook-mode because there is a bug:https://github.com/metallb/metallb/issues/1597
-        # this webhook only checks crd, it has not effects to out e2e tests
-        curl https://raw.githubusercontent.com/metallb/metallb/v0.13.5/config/manifests/metallb-native.yaml -k | \
-         sed '0,/args:/s//args:\n        - --webhook-mode=disabled/' | \
-         sed '/apiVersion: admissionregistration/,$d' | \
-         kubectl apply -f -
-
-        # Add Layer 2 config
-        network=$(docker network inspect kind -f "{{(index .IPAM.Config 0).Subnet}}" | cut -d '.' -f1,2)
-        cat <<EOF | kubectl apply -f -
-        apiVersion: metallb.io/v1beta1
-        kind: IPAddressPool
-        metadata:
-          name: first-pool
-          namespace: metallb-system
-        spec:
-          addresses:
-          - $network.255.1-$network.255.250
-        ---
-        apiVersion: metallb.io/v1beta1
-        kind: L2Advertisement
-        metadata:
-          name: example
-          namespace: metallb-system
-        EOF
-
-    - name: Setup local registry
-      run: |
-        # Run a registry.
-        docker run -d --restart=always \
-          -v $HOME/artifacts/registry:/var/lib/registry \
-          -p $REGISTRY_PORT:$REGISTRY_PORT --name $REGISTRY_NAME registry:2
-        # Connect the registry to the KinD network.
-        docker network connect "kind" $REGISTRY_NAME
-        # Make the $REGISTRY_NAME -> 127.0.0.1, to tell `ko` to publish to
-        # local registry, even when pushing $REGISTRY_NAME:$REGISTRY_PORT/some/image
-        sudo echo "127.0.0.1 $REGISTRY_NAME" | sudo tee -a /etc/hosts
-
     - name: Install Serving & Ingress
       run: |
         set -x
@@ -329,12 +214,13 @@ jobs:
           -timeout=30m \
           ${{ matrix.test-path }} \
           -skip-cleanup-on-fail \
-          ${{ matrix.test-flags || '-enable-alpha -enable-beta' }} \
+          -enable-alpha -enable-beta \
           --ingress-class=${{ matrix.ingress-class || matrix.ingress }}.ingress.networking.knative.dev
+ 
     - uses: chainguard-dev/actions/kind-diag@main
       # Only upload logs on failure.
       if: ${{ failure() }}
       with:
-        cluster-resources: nodes,namespaces,crds,${{ matrix.cluster-resources || '' }}
+        cluster-resources: nodes,namespaces,crds
         namespace-resources: configmaps,pods,svc,ksvc,route,configuration,revision,king,${{ matrix.namespace-resources || '' }}
         artifact-name: logs-${{ matrix.k8s-version}}-${{ matrix.ingress }}-${{ matrix.test-suite }}
diff --git a/pkg/activator/certificate/cache_test.go b/pkg/activator/certificate/cache_test.go
index d417e80d4..5378bb2c6 100644
--- a/pkg/activator/certificate/cache_test.go
+++ b/pkg/activator/certificate/cache_test.go
@@ -31,7 +31,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/tools/cache"
 
-	"knative.dev/control-protocol/pkg/certificates"
+	"knative.dev/networking/pkg/certificates"
 	netcfg "knative.dev/networking/pkg/config"
 	fakekubeclient "knative.dev/pkg/client/injection/kube/client/fake"
 	fakesecretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret/fake"
diff --git a/pkg/activator/net/throttler_test.go b/pkg/activator/net/throttler_test.go
index d8735078f..8bb76dbb3 100644
--- a/pkg/activator/net/throttler_test.go
+++ b/pkg/activator/net/throttler_test.go
@@ -19,7 +19,6 @@ package net
 import (
 	"context"
 	"errors"
-	"math"
 	"strconv"
 	"sync"
 	"testing"
@@ -65,130 +64,212 @@ func newTestThrottler(ctx context.Context) *Throttler {
 
 func TestThrottlerUpdateCapacity(t *testing.T) {
 	logger := TestLogger(t)
-	rt := &revisionThrottler{
-		logger:               logger,
-		breaker:              queue.NewBreaker(testBreakerParams),
-		containerConcurrency: 10,
-	}
-
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(100)
-	if got, want := rt.breaker.Capacity(), 100*10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(5)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 10*10/5; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.numActivators.Store(200)
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// now test with CC=0.
-	// in the CC=0 cases we use the infinite breaker whose capacity can either be
-	// totally blocked (0) or totally open (1).
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(10)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	rt.numActivators.Store(200)
-	rt.updateCapacity(1)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	rt.updateCapacity(0)
-	if got, want := rt.breaker.Capacity(), 0; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// shouldn't really happen since revisionMaxConcurrency is very, very large,
-	// but check that we behave reasonably if it's exceeded.
-	capacity := rt.calculateCapacity(revisionMaxConcurrency+5, 1)
-	if got, want := capacity, queue.MaxBreakerCapacity; got != want {
-		t.Errorf("calculateCapacity = %d, want: %d", got, want)
-	}
-
-	// Now test with podIP trackers in tow.
-	// Simple case.
-	rt.numActivators.Store(1)
-	rt.activatorIndex.Store(0)
-	rt.podTrackers = makeTrackers(1, 10)
-	rt.containerConcurrency = 10
-	rt.breaker = queue.NewBreaker(testBreakerParams)
-
-	rt.updateCapacity(0 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 backends.
-	rt.podTrackers = makeTrackers(2, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 20; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 2 activators.
-	rt.numActivators.Store(2)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 10; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-
-	// 3 pods, index 0.
-	rt.podTrackers = makeTrackers(3, 10)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
 
-	// 3 pods, index 1.
-	rt.activatorIndex.Store(1)
-	rt.updateCapacity(-1 /* doesn't matter here*/)
-	if got, want := rt.breaker.Capacity(), 15; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
+	tests := []struct {
+		name                 string
+		capacity             int
+		numActivators        int32
+		activatorIndex       int32
+		containerConcurrency int
+		isNewInfiniteBreaker bool
+		podTrackers          []*podTracker
+		want                 int
+		checkAssignedPod     bool
+	}{{
+		name:                 "capacity: 1, cc: 10",
+		capacity:             1,
+		containerConcurrency: 10,
+		want:                 1 * 10,
+	}, {
+		name:                 "capacity: 10, cc: 10",
+		capacity:             10,
+		containerConcurrency: 10,
+		want:                 10 * 10,
+	}, {
+		name:                 "capacity: 100, cc: 10",
+		capacity:             100,
+		containerConcurrency: 10,
+		want:                 100 * 10,
+	}, {
+		name:                 "numActivators: 5, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        5,
+		containerConcurrency: 10,
+		want:                 10 * 10 / 5,
+	}, {
+		name:                 "numActivators: 200, capacity: 10, cc: 10",
+		capacity:             10,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 1,
+	}, {
+		name:                 "numActivators: 200, capacity: 0, cc: 10",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 10,
+		want:                 0,
+	}, {
+		// now test with CC=0.
+		// in the CC=0 cases we use the infinite breaker whose capacity can either be
+		// totally blocked (0) or totally open (1).
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 0, capacity: 10, cc: 0",
+		capacity:             10,
+		numActivators:        0,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 0, cc: 0",
+		capacity:             0,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 0,
+	}, {
+		name:                 "newInfiniteBreaker, numActivators: 200, capacity: 1, cc: 0",
+		capacity:             1,
+		numActivators:        200,
+		containerConcurrency: 0,
+		isNewInfiniteBreaker: true,
+		want:                 1,
+	}, {
+		// Now test with podIP trackers in tow.
+		// Simple case.
+		name:                 "numActivators: 1, capacity: 0, cc: 10, pods: 1",
+		capacity:             0,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(1, 10),
+		want:                 10,
+	}, {
+		name:                 "2 backends. numActivators: 1, capacity: -1, cc: 10, pods: 2",
+		capacity:             -1,
+		numActivators:        1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 20,
+	}, {
+		name:                 "2 activators. numActivators: 2, capacity: -1, cc: 10, pods: 2",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(2, 10),
+		want:                 10,
+	}, {
+		name:                 "numActivators: 2, index: 0, pods: 3, cc: 1. Capacity is expected to 20 (2 * 10)",
+		capacity:             -1,
+		numActivators:        2,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 20,
+	}, {
+		name:                 "numActivators: 2, index: 1, pods: 3, cc: 1. Capacity is expected to 10 (1 * 10)",
+		capacity:             -1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 10,
+		podTrackers:          makeTrackers(3, 10),
+		want:                 10,
+	}, {
+		name:                 "numActivators: 2, index: 0, pods: 5, cc: 1. Capacity is expected to 3 (2 + 1)",
+		capacity:             5,
+		numActivators:        2,
+		activatorIndex:       0,
+		containerConcurrency: 1,
+		podTrackers:          makeTrackers(5, 1),
+		want:                 3,
+	}, {
+		name:                 "numActivators: 2, index: 1, pods: 5, cc: 1. Capacity is expected to 2",
+		capacity:             5,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 1,
+		podTrackers:          makeTrackers(5, 1),
+		want:                 2,
+	}, {
+		name:                 "Infinite capacity with podIP trackers.",
+		capacity:             1,
+		numActivators:        2,
+		activatorIndex:       1,
+		containerConcurrency: 0,
+		podTrackers:          makeTrackers(3, 0),
+		isNewInfiniteBreaker: true,
+		want:                 1,
+		checkAssignedPod:     true,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              queue.NewBreaker(testBreakerParams),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			rt.activatorIndex.Store(tt.activatorIndex)
+			rt.podTrackers = tt.podTrackers
+			if tt.isNewInfiniteBreaker {
+				rt.breaker = newInfiniteBreaker(logger)
+			}
+			rt.updateCapacity(tt.capacity)
+			if got := rt.breaker.Capacity(); got != tt.want {
+				t.Errorf("Capacity = %d, want: %d", got, tt.want)
+			}
+			if tt.checkAssignedPod {
+				if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
+					t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
+						cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+				}
+			}
+		})
 	}
+}
 
-	// Infinite capacity with podIP trackers.
-	rt.activatorIndex.Store(1)
-	rt.containerConcurrency = 0
-	rt.breaker = newInfiniteBreaker(logger)
-	rt.podTrackers = makeTrackers(3, 0)
-	rt.updateCapacity(1)
-
-	// infinite breaker capacity is either 0 (blocked) or 1 (totally open)
-	if got, want := rt.breaker.Capacity(), 1; got != want {
-		t.Errorf("Capacity = %d, want: %d", got, want)
-	}
-	if got, want := len(rt.assignedTrackers), len(rt.podTrackers); got != want {
-		t.Errorf("Assigned tracker count = %d, want: %d, diff:\n%s", got, want,
-			cmp.Diff(rt.assignedTrackers, rt.podTrackers))
+func TestThrottlerCalculateCapacity(t *testing.T) {
+	logger := TestLogger(t)
+	tests := []struct {
+		name                 string
+		numActivators        int32
+		containerConcurrency int
+		numTrackers          int
+		activatorCount       int
+		backendCount         int
+	}{{
+		name:                 "over revisionMaxConcurrency",
+		numActivators:        200,
+		containerConcurrency: 0,
+		numTrackers:          revisionMaxConcurrency + 5,
+		activatorCount:       1,
+		backendCount:         1,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rt := &revisionThrottler{
+				logger:               logger,
+				breaker:              newInfiniteBreaker(logger),
+				containerConcurrency: tt.containerConcurrency,
+			}
+			rt.numActivators.Store(tt.numActivators)
+			// shouldn't really happen since revisionMaxConcurrency is very, very large,
+			// but check that we behave reasonably if it's exceeded.
+			capacity := rt.calculateCapacity(tt.backendCount, tt.numTrackers, tt.activatorCount)
+			if got, want := capacity, queue.MaxBreakerCapacity; got != want {
+				t.Errorf("calculateCapacity = %d, want: %d", got, want)
+			}
+		})
 	}
 }
 
@@ -552,19 +633,17 @@ func TestPodAssignmentFinite(t *testing.T) {
 	if got, want := len(rt.podTrackers), len(update.Dests); got != want {
 		t.Errorf("NumTrackers = %d, want: %d", got, want)
 	}
-	if got, want := trackerDestSet(rt.assignedTrackers), sets.NewString("ip0", "ip4", "ip5"); !got.Equal(want) {
+	// 6 = 4 * 1 + 2; index 0 and index 1 have 2 pods and others have 1 pod.
+	if got, want := trackerDestSet(rt.assignedTrackers), sets.NewString("ip0", "ip4"); !got.Equal(want) {
 		t.Errorf("Assigned trackers = %v, want: %v, diff: %s", got, want, cmp.Diff(want, got))
 	}
-	if got, want := rt.breaker.Capacity(), 6*42/4; got != want {
+	if got, want := rt.breaker.Capacity(), 2*42; got != want {
 		t.Errorf("TotalCapacity = %d, want: %d", got, want)
 	}
 	if got, want := rt.assignedTrackers[0].Capacity(), 42; got != want {
 		t.Errorf("Exclusive tracker capacity: %d, want: %d", got, want)
 	}
-	if got, want := rt.assignedTrackers[1].Capacity(), int(math.Ceil(42./4.)); got != want {
-		t.Errorf("Shared tracker capacity: %d, want: %d", got, want)
-	}
-	if got, want := rt.assignedTrackers[2].Capacity(), int(math.Ceil(42./4.)); got != want {
+	if got, want := rt.assignedTrackers[1].Capacity(), 42; got != want {
 		t.Errorf("Shared tracker capacity: %d, want: %d", got, want)
 	}
 
@@ -704,7 +783,7 @@ func TestActivatorsIndexUpdate(t *testing.T) {
 	if got, want := rt.activatorIndex.Load(), int32(1); got != want {
 		t.Fatalf("activatorIndex = %d, want %d", got, want)
 	}
-	if got, want := len(rt.assignedTrackers), 2; got != want {
+	if got, want := len(rt.assignedTrackers), 1; got != want {
 		t.Fatalf("len(assignedTrackers) = %d, want %d", got, want)
 	}
 
@@ -1126,12 +1205,12 @@ func TestAssignSlice(t *testing.T) {
 		}}
 		cp := append(trackers[:0:0], trackers...)
 		got := assignSlice(cp, 1, 2, 5)
-		want := trackers[1:3]
+		want := trackers[1:2]
 		if !cmp.Equal(got, want, opt) {
 			t.Errorf("Got=%v, want: %v; diff: %s", got, want,
 				cmp.Diff(want, got, opt))
 		}
-		if got, want := got[1].b.Capacity(), 5/2+1; got != want {
+		if got, want := got[0].b.Capacity(), 0; got != want {
 			t.Errorf("Capacity for the tail pod = %d, want: %d", got, want)
 		}
 	})
@@ -1148,12 +1227,12 @@ func TestAssignSlice(t *testing.T) {
 		}}
 		cp := append(trackers[:0:0], trackers...)
 		got := assignSlice(cp, 1, 2, 6)
-		want := trackers[1:]
+		want := trackers[1:2]
 		if !cmp.Equal(got, want, opt) {
 			t.Errorf("Got=%v, want: %v; diff: %s", got, want,
 				cmp.Diff(want, got, opt))
 		}
-		if got, want := got[1].b.Capacity(), 3; got != want {
+		if got, want := got[0].b.Capacity(), 0; got != want {
 			t.Errorf("Capacity for the tail pod = %d, want: %d", got, want)
 		}
 	})
diff --git a/pkg/apis/serving/v1/revision_validation_test.go b/pkg/apis/serving/v1/revision_validation_test.go
index ea42c2986..ba0769049 100644
--- a/pkg/apis/serving/v1/revision_validation_test.go
+++ b/pkg/apis/serving/v1/revision_validation_test.go
@@ -942,6 +942,34 @@ func TestRevisionTemplateSpecValidation(t *testing.T) {
 			Message: "invalid value: 50mx",
 			Paths:   []string{fmt.Sprintf("[%s]", serving.QueueSidecarResourcePercentageAnnotationKey)},
 		}).ViaField("metadata.annotations"),
+	}, {
+		name: "Invalid queue sidecar resource annotations",
+		rts: &RevisionTemplateSpec{
+			ObjectMeta: metav1.ObjectMeta{
+				Annotations: map[string]string{
+					serving.QueueSidecarCPUResourceLimitAnnotationKey:                "100mx",
+					serving.QueueSidecarCPUResourceRequestAnnotationKey:              "50mx",
+					serving.QueueSidecarMemoryResourceLimitAnnotationKey:             "1Gi",
+					serving.QueueSidecarMemoryResourceRequestAnnotationKey:           "100Mi",
+					serving.QueueSidecarEphemeralStorageResourceLimitAnnotationKey:   "5Gi",
+					serving.QueueSidecarEphemeralStorageResourceRequestAnnotationKey: "2Gi",
+				},
+			},
+			Spec: RevisionSpec{
+				PodSpec: corev1.PodSpec{
+					Containers: []corev1.Container{{
+						Image: "helloworld",
+					}},
+				},
+			},
+		},
+		want: ((&apis.FieldError{
+			Message: "invalid value: 100mx",
+			Paths:   []string{fmt.Sprintf("[%s]", serving.QueueSidecarCPUResourceLimitAnnotationKey)},
+		}).Also(&apis.FieldError{
+			Message: "invalid value: 50mx",
+			Paths:   []string{fmt.Sprintf("[%s]", serving.QueueSidecarCPUResourceRequestAnnotationKey)},
+		})).ViaField("metadata.annotations"),
 	}, {
 		name: "Invalid initial scale when cluster doesn't allow zero",
 		ctx:  autoscalerConfigCtx(false, 1),
@@ -1093,6 +1121,9 @@ func autoscalerConfigCtx(allowInitialScaleZero bool, initialScale int) context.C
 }
 
 func TestValidateQueueSidecarAnnotation(t *testing.T) {
+	resourcePercentageDeprecationWarning := apis.ErrGeneric("Queue proxy resource percentage annotation is deprecated. Please use the available annotations to explicitly set resource values per service").
+		ViaKey(serving.QueueSidecarResourcePercentageAnnotationKey).At(apis.WarningLevel)
+
 	cases := []struct {
 		name       string
 		annotation map[string]string
@@ -1102,28 +1133,28 @@ func TestValidateQueueSidecarAnnotation(t *testing.T) {
 		annotation: map[string]string{
 			serving.QueueSidecarResourcePercentageAnnotationKey: "0.01982",
 		},
-		expectErr: &apis.FieldError{
+		expectErr: (&apis.FieldError{
 			Message: "expected 0.1 <= 0.01982 <= 100",
 			Paths:   []string{fmt.Sprintf("[%s]", serving.QueueSidecarResourcePercentageAnnotationKey)},
-		},
+		}).Also(resourcePercentageDeprecationWarning),
 	}, {
 		name: "too big for Queue sidecar resource percentage annotation",
 		annotation: map[string]string{
 			serving.QueueSidecarResourcePercentageAnnotationKey: "100.0001",
 		},
-		expectErr: &apis.FieldError{
+		expectErr: (&apis.FieldError{
 			Message: "expected 0.1 <= 100.0001 <= 100",
 			Paths:   []string{fmt.Sprintf("[%s]", serving.QueueSidecarResourcePercentageAnnotationKey)},
-		},
+		}).Also(resourcePercentageDeprecationWarning),
 	}, {
 		name: "Invalid queue sidecar resource percentage annotation",
 		annotation: map[string]string{
 			serving.QueueSidecarResourcePercentageAnnotationKey: "",
 		},
-		expectErr: &apis.FieldError{
+		expectErr: (&apis.FieldError{
 			Message: "invalid value: ",
 			Paths:   []string{fmt.Sprintf("[%s]", serving.QueueSidecarResourcePercentageAnnotationKey)},
-		},
+		}).Also(resourcePercentageDeprecationWarning),
 	}, {
 		name:       "empty annotation",
 		annotation: map[string]string{},
@@ -1137,16 +1168,18 @@ func TestValidateQueueSidecarAnnotation(t *testing.T) {
 		annotation: map[string]string{
 			serving.QueueSidecarResourcePercentageAnnotationKey: "0.1",
 		},
+		expectErr: resourcePercentageDeprecationWarning,
 	}, {
 		name: "valid value for Queue sidecar resource percentage annotation",
 		annotation: map[string]string{
 			serving.QueueSidecarResourcePercentageAnnotationKey: "100",
 		},
+		expectErr: resourcePercentageDeprecationWarning,
 	}}
 
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			err := validateQueueSidecarAnnotation(c.annotation)
+			err := validateQueueSidecarResourceAnnotations(c.annotation)
 			if got, want := err.Error(), c.expectErr.Error(); got != want {
 				t.Errorf("Got: %q want: %q", got, want)
 			}
diff --git a/pkg/reconciler/autoscaling/config/store_test.go b/pkg/reconciler/autoscaling/config/store_test.go
index 06681f0ef..6de86bbf9 100644
--- a/pkg/reconciler/autoscaling/config/store_test.go
+++ b/pkg/reconciler/autoscaling/config/store_test.go
@@ -66,17 +66,17 @@ func TestStoreImmutableConfig(t *testing.T) {
 	config := store.Load()
 	config.Autoscaler.MaxScaleUpRate = 100.0
 	config.Deployment.ProgressDeadline = 3 * time.Minute
-	config.Network.InternalEncryption = true
+	config.Network.DataplaneTrust = netcfg.TrustMinimal
 	newConfig := store.Load()
 
 	if newConfig.Autoscaler.MaxScaleUpRate == 100.0 {
-		t.Error("Autoscaler config is not immuable")
+		t.Error("Autoscaler config is not immutable")
 	}
 	if newConfig.Deployment.ProgressDeadline == 3*time.Minute {
-		t.Error("Deployment config is not immuable")
+		t.Error("Deployment config is not immutable")
 	}
 
-	if newConfig.Network.InternalEncryption {
-		t.Error("Network config is not immuable")
+	if newConfig.Network.DataplaneTrust != netcfg.TrustDisabled {
+		t.Error("Network config is not immutable")
 	}
 }
diff --git a/pkg/reconciler/autoscaling/kpa/kpa_test.go b/pkg/reconciler/autoscaling/kpa/kpa_test.go
index 59541f50f..b12a56cb3 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa_test.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa_test.go
@@ -128,7 +128,7 @@ func initialScaleZeroASConfig() *autoscalerconfig.Config {
 
 func activatorCertsNetConfig() *netcfg.Config {
 	nc, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "true",
+		netcfg.DataplaneTrustKey: "minimal",
 	})
 	return nc
 }
@@ -140,7 +140,7 @@ func defaultConfig() *config.Config {
 		deployment.ProgressDeadlineKey:  progressDeadline.String(),
 	})
 	networkConfig, _ := netcfg.NewConfigFromMap(map[string]string{
-		netcfg.InternalEncryptionKey: "false",
+		netcfg.DataplaneTrustKey: "disabled",
 	})
 
 	return &config.Config{
diff --git a/pkg/reconciler/revision/resources/queue_test.go b/pkg/reconciler/revision/resources/queue_test.go
index 8c4f33a27..39a3c2bd8 100644
--- a/pkg/reconciler/revision/resources/queue_test.go
+++ b/pkg/reconciler/revision/resources/queue_test.go
@@ -570,6 +570,122 @@ func TestMakeQueueContainerWithPercentageAnnotation(t *testing.T) {
 	}
 }
 
+func TestMakeQueueContainerWithResourceAnnotations(t *testing.T) {
+	tests := []struct {
+		name string
+		rev  *v1.Revision
+		want corev1.Container
+		dc   deployment.Config
+	}{{
+		name: "resources defined via annotations",
+		rev: revision("bar", "foo",
+			func(revision *v1.Revision) {
+				revision.Annotations = map[string]string{
+					serving.QueueSidecarCPUResourceRequestAnnotationKey:              "1",
+					serving.QueueSidecarCPUResourceLimitAnnotationKey:                "2",
+					serving.QueueSidecarMemoryResourceRequestAnnotationKey:           "1Gi",
+					serving.QueueSidecarMemoryResourceLimitAnnotationKey:             "2Gi",
+					serving.QueueSidecarEphemeralStorageResourceRequestAnnotationKey: "500Mi",
+					serving.QueueSidecarEphemeralStorageResourceLimitAnnotationKey:   "600Mi",
+				}
+				revision.Spec.PodSpec.Containers = []corev1.Container{{
+					Name:           servingContainerName,
+					ReadinessProbe: testProbe,
+				}}
+			}),
+		want: queueContainer(func(c *corev1.Container) {
+			c.Env = env(map[string]string{})
+			c.Resources.Requests = corev1.ResourceList{
+				corev1.ResourceMemory:           resource.MustParse("1Gi"),
+				corev1.ResourceCPU:              resource.MustParse("1"),
+				corev1.ResourceEphemeralStorage: resource.MustParse("500Mi"),
+			}
+			c.Resources.Limits = corev1.ResourceList{
+				corev1.ResourceMemory:           resource.MustParse("2Gi"),
+				corev1.ResourceCPU:              resource.MustParse("2"),
+				corev1.ResourceEphemeralStorage: resource.MustParse("600Mi"),
+			}
+		}),
+	}, {
+		name: "resources defined via annotations with bad values ignored",
+		rev: revision("bar", "foo",
+			func(revision *v1.Revision) {
+				revision.Annotations = map[string]string{
+					serving.QueueSidecarCPUResourceRequestAnnotationKey:    "zzz",
+					serving.QueueSidecarCPUResourceLimitAnnotationKey:      "2",
+					serving.QueueSidecarMemoryResourceRequestAnnotationKey: "Gdx",
+					serving.QueueSidecarMemoryResourceLimitAnnotationKey:   "2Gi",
+				}
+				revision.Spec.PodSpec.Containers = []corev1.Container{{
+					Name:           servingContainerName,
+					ReadinessProbe: testProbe,
+				}}
+			}),
+		want: queueContainer(func(c *corev1.Container) {
+			c.Env = env(map[string]string{})
+			c.Resources.Limits = corev1.ResourceList{
+				corev1.ResourceMemory: resource.MustParse("2Gi"),
+				corev1.ResourceCPU:    resource.MustParse("2"),
+			}
+		}),
+	}, {
+		name: "resources defined via annotations mixed with percentage annotation",
+		rev: revision("bar", "foo",
+			func(revision *v1.Revision) {
+				revision.Annotations = map[string]string{
+					serving.QueueSidecarCPUResourceLimitAnnotationKey:    "1",
+					serving.QueueSidecarMemoryResourceLimitAnnotationKey: "4Gi",
+					serving.QueueSidecarResourcePercentageAnnotationKey:  "50",
+				}
+				revision.Spec.PodSpec.Containers = []corev1.Container{{
+					Name:           servingContainerName,
+					ReadinessProbe: testProbe,
+					Resources: corev1.ResourceRequirements{
+						Requests: corev1.ResourceList{
+							corev1.ResourceMemory: resource.MustParse("1Gi"),
+							corev1.ResourceCPU:    resource.MustParse("1"),
+						},
+						Limits: corev1.ResourceList{
+							corev1.ResourceMemory: resource.MustParse("2Gi"),
+							corev1.ResourceCPU:    resource.MustParse("2"),
+						},
+					}},
+				}
+			}),
+		want: queueContainer(func(c *corev1.Container) {
+			c.Env = env(map[string]string{})
+			c.Resources.Requests = corev1.ResourceList{
+				corev1.ResourceMemory: resource.MustParse("200Mi"), // hits the boundary for max value
+				corev1.ResourceCPU:    resource.MustParse("100m"),  // hits the boundary for max value
+			}
+			c.Resources.Limits = corev1.ResourceList{ // enforce the desired limits
+				corev1.ResourceMemory: resource.MustParse("4Gi"),
+				corev1.ResourceCPU:    resource.MustParse("1"),
+			}
+		}),
+	}}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cfg := revConfig()
+			cfg.Deployment = &test.dc
+			got, err := makeQueueContainer(test.rev, cfg)
+			if err != nil {
+				t.Fatal("makeQueueContainer returned error:", err)
+			}
+			test.want.Env = append(test.want.Env, corev1.EnvVar{
+				Name:  "SERVING_READINESS_PROBE",
+				Value: probeJSON(test.rev.Spec.GetContainer()),
+			})
+			sortEnv(got.Env)
+			sortEnv(test.want.Env)
+			if got, want := *got, test.want; !cmp.Equal(got, want, quantityComparer) {
+				t.Errorf("makeQueueContainer (-want, +got) =\n%s", cmp.Diff(want, got, quantityComparer))
+			}
+		})
+	}
+}
+
 func TestProbeGenerationHTTPDefaults(t *testing.T) {
 	rev := revision("bar", "foo",
 		func(revision *v1.Revision) {
diff --git a/pkg/reconciler/revision/revision_test.go b/pkg/reconciler/revision/revision_test.go
index 4d2685e11..fb6a17439 100644
--- a/pkg/reconciler/revision/revision_test.go
+++ b/pkg/reconciler/revision/revision_test.go
@@ -43,7 +43,6 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -516,10 +515,7 @@ func TestGlobalResyncOnDefaultCMChange(t *testing.T) {
 	paL := fakepainformer.Get(ctx).Lister().PodAutoscalers(rev.Namespace)
 	if ierr := wait.PollImmediate(50*time.Millisecond, 6*time.Second, func() (bool, error) {
 		_, err = paL.Get(rev.Name)
-		if apierrs.IsNotFound(err) {
-			return false, nil
-		}
-		return err == nil, err
+		return err == nil, nil
 	}); ierr != nil {
 		t.Fatal("Failed to see PA creation:", ierr)
 	}
@@ -555,7 +551,7 @@ func TestGlobalResyncOnDefaultCMChange(t *testing.T) {
 		t.Logf("Initial PA: %#v GetErr: %v", pa, err)
 		if ierr := wait.PollImmediate(50*time.Millisecond, 2*time.Second, func() (bool, error) {
 			pa, err = paL.Get(rev.Name)
-			return pa != nil && pa.Spec.ContainerConcurrency == pos, err
+			return pa != nil && pa.Spec.ContainerConcurrency == pos, nil
 		}); ierr == nil { // err==nil!
 			break
 		}
@@ -613,8 +609,8 @@ func TestGlobalResyncOnConfigMapUpdateRevision(t *testing.T) {
 
 	want := "http://new-logging.test.com?filter=" + string(rev.UID)
 	if ierr := wait.PollImmediate(50*time.Millisecond, 5*time.Second, func() (bool, error) {
-		r, err := revL.Revisions(rev.Namespace).Get(rev.Name)
-		return r != nil && r.Status.LogURL == want, err
+		r, _ := revL.Revisions(rev.Namespace).Get(rev.Name)
+		return r != nil && r.Status.LogURL == want, nil
 	}); ierr != nil {
 		t.Fatal("Failed to see Revision propagation:", ierr)
 	}
@@ -682,8 +678,8 @@ func TestGlobalResyncOnConfigMapUpdateDeployment(t *testing.T) {
 
 	depL := fakedeploymentinformer.Get(ctx).Lister().Deployments(rev.Namespace)
 	if err := wait.PollImmediate(10*time.Millisecond, 5*time.Second, func() (bool, error) {
-		dep, err := depL.Get(names.Deployment(rev))
-		return dep != nil && checkF(dep), err
+		dep, _ := depL.Get(names.Deployment(rev))
+		return dep != nil && checkF(dep), nil
 	}); err != nil {
 		t.Error("Failed to see deployment properly updating:", err)
 	}
@@ -728,8 +724,8 @@ func TestNewRevisionCallsSyncHandler(t *testing.T) {
 	// Poll to see if the deployment is created. This should _already_ be there.
 	depL := fakedeploymentinformer.Get(ctx).Lister().Deployments(rev.Namespace)
 	if err := wait.PollImmediate(10*time.Millisecond, 1*time.Second, func() (bool, error) {
-		dep, err := depL.Get(names.Deployment(rev))
-		return dep != nil, err
+		dep, _ := depL.Get(names.Deployment(rev))
+		return dep != nil, nil
 	}); err != nil {
 		t.Error("Failed to see deployment creation:", err)
 	}
diff --git a/pkg/reconciler/route/resources/ingress_test.go b/pkg/reconciler/route/resources/ingress_test.go
index 89dd75eac..2c6c7085b 100644
--- a/pkg/reconciler/route/resources/ingress_test.go
+++ b/pkg/reconciler/route/resources/ingress_test.go
@@ -1427,6 +1427,6 @@ func testContextWithHTTPOption() context.Context {
 
 func testContextWithActivatorCA() context.Context {
 	cfg := testConfig()
-	cfg.Network.InternalEncryption = true
+	cfg.Network.DataplaneTrust = netcfg.TrustMinimal
 	return config.ToContext(context.Background(), cfg)
 }
diff --git a/pkg/reconciler/route/resources/service_test.go b/pkg/reconciler/route/resources/service_test.go
index 684b06c79..a17e7972b 100644
--- a/pkg/reconciler/route/resources/service_test.go
+++ b/pkg/reconciler/route/resources/service_test.go
@@ -419,6 +419,7 @@ func testConfig() *config.Config {
 			DefaultIngressClass: "test-ingress-class",
 			DomainTemplate:      netcfg.DefaultDomainTemplate,
 			TagTemplate:         netcfg.DefaultTagTemplate,
+			DataplaneTrust:      netcfg.TrustDisabled,
 		},
 		Features: &apiConfig.Features{
 			MultiContainer:               apiConfig.Disabled,
diff --git a/test/e2e/autoscale_test.go b/test/e2e/autoscale_test.go
index f5ac77059..86c3d133e 100644
--- a/test/e2e/autoscale_test.go
+++ b/test/e2e/autoscale_test.go
@@ -173,7 +173,7 @@ func TestTargetBurstCapacity(t *testing.T) {
 	if err != nil {
 		t.Fatal("Fail to get ConfigMap config-network:", err)
 	}
-	if strings.EqualFold(cm.Data[netcfg.InternalEncryptionKey], "true") {
+	if !strings.EqualFold(cm.Data[netcfg.DataplaneTrustKey], string(netcfg.TrustDisabled)) {
 		// TODO: Remove this when https://github.com/knative/serving/issues/12797 was done.
 		t.Skip("Skipping TestTargetBurstCapacity as activator-ca is specified. See issue/12797.")
 	}
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 330831a27..7c2cf473d 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,7 +19,7 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
@@ -52,7 +52,7 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
@@ -93,7 +93,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 
@@ -119,7 +119,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 data:
@@ -168,7 +168,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -177,12 +177,10 @@ spec:
       app: net-certmanager-controller
   template:
     metadata:
-      annotations:
-        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230530-102581f4"
+        app.kubernetes.io/version: "20230619-e391f2d4"
         app.kubernetes.io/name: knative-serving
     spec:
       serviceAccountName: controller
@@ -190,7 +188,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:134281d251958ed73bab2c9a3a3fbfdc221c3a505876b1226b601c134b270dff
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:4fa747a0a1dd72d47f29ce10a455abdbc9f63e57d647f6dc5f7c869141ee46cd
           resources:
             requests:
               cpu: 30m
@@ -229,7 +227,7 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
@@ -268,7 +266,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -278,12 +276,10 @@ spec:
       role: net-certmanager-webhook
   template:
     metadata:
-      annotations:
-        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230530-102581f4"
+        app.kubernetes.io/version: "20230619-e391f2d4"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
     spec:
@@ -292,7 +288,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:7f3b2c8798018dcadac1b2fac7e7a83d84fa3c78d1e3cc7e1d58311425509a35
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:0f59d3d20148de5ece280f7f0ae2e36cde354e79db5074b45ed84ff4abe313b8
           resources:
             requests:
               cpu: 20m
@@ -356,7 +352,7 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230530-102581f4"
+    app.kubernetes.io/version: "20230619-e391f2d4"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index a52efe2f6..6154e5336 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -221,8 +221,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.11.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.11.4
   name: contourconfigurations.projectcontour.io
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -473,6 +472,61 @@ spec:
                         - namespace
                       type: object
                   type: object
+                globalExtAuth:
+                  description: GlobalExternalAuthorization allows envoys external authorization filter to be enabled for all virtual hosts.
+                  properties:
+                    authPolicy:
+                      description: AuthPolicy sets a default authorization policy for client requests. This policy will be used unless overridden by individual routes.
+                      properties:
+                        context:
+                          additionalProperties:
+                            type: string
+                          description: Context is a set of key/value pairs that are sent to the authentication server in the check request. If a context is provided at an enclosing scope, the entries are merged such that the inner scope overrides matching keys from the outer scope.
+                          type: object
+                        disabled:
+                          description: When true, this field disables client request authentication for the scope of the policy.
+                          type: boolean
+                      type: object
+                    extensionRef:
+                      description: ExtensionServiceRef specifies the extension resource that will authorize client requests.
+                      properties:
+                        apiVersion:
+                          description: API version of the referent. If this field is not specified, the default "projectcontour.io/v1alpha1" will be used
+                          minLength: 1
+                          type: string
+                        name:
+                          description: "Name of the referent. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names"
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: "Namespace of the referent. If this field is not specifies, the namespace of the resource that targets the referent will be used. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/"
+                          minLength: 1
+                          type: string
+                      type: object
+                    failOpen:
+                      description: If FailOpen is true, the client request is forwarded to the upstream service even if the authorization server fails to respond. This field should not be set in most cases. It is intended for use only while migrating applications from internal authorization to Contour external authorization.
+                      type: boolean
+                    responseTimeout:
+                      description: ResponseTimeout configures maximum time to wait for a check response from the authorization server. Timeout durations are expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The string "infinity" is also a valid input and specifies no timeout.
+                      pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$
+                      type: string
+                    withRequestBody:
+                      description: WithRequestBody specifies configuration for sending the client request's body to authorization server.
+                      properties:
+                        allowPartialMessage:
+                          description: If AllowPartialMessage is true, then Envoy will buffer the body until MaxRequestBytes are reached.
+                          type: boolean
+                        maxRequestBytes:
+                          default: 1024
+                          description: MaxRequestBytes sets the maximum size of message body ExtAuthz filter will hold in-memory.
+                          format: int32
+                          minimum: 1
+                          type: integer
+                        packAsBytes:
+                          description: If PackAsBytes is true, the body sent to Authorization Server is in raw bytes.
+                          type: boolean
+                      type: object
+                  type: object
                 health:
                   description: "Health defines the endpoints Contour uses to serve health checks. \n Contour's default is { address: \"0.0.0.0\", port: 8000 }."
                   properties:
@@ -604,6 +658,54 @@ spec:
                   required:
                     - extensionService
                   type: object
+                tracing:
+                  description: Tracing defines properties for exporting trace data to OpenTelemetry.
+                  properties:
+                    customTags:
+                      description: CustomTags defines a list of custom tags with unique tag name.
+                      items:
+                        description: CustomTag defines custom tags with unique tag name to create tags for the active span.
+                        properties:
+                          literal:
+                            description: Literal is a static custom tag value. Precisely one of Literal, RequestHeaderName must be set.
+                            type: string
+                          requestHeaderName:
+                            description: RequestHeaderName indicates which request header the label value is obtained from. Precisely one of Literal, RequestHeaderName must be set.
+                            type: string
+                          tagName:
+                            description: TagName is the unique name of the custom tag.
+                            type: string
+                        required:
+                          - tagName
+                        type: object
+                      type: array
+                    extensionService:
+                      description: ExtensionService identifies the extension service defining the otel-collector.
+                      properties:
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      required:
+                        - name
+                        - namespace
+                      type: object
+                    includePodDetail:
+                      description: 'IncludePodDetail defines a flag. If it is true, contour will add the pod name and namespace to the span of the trace. the default is true. Note: The Envoy pods MUST have the HOSTNAME and CONTOUR_NAMESPACE environment variables set for this to work properly.'
+                      type: boolean
+                    maxPathTagLength:
+                      description: MaxPathTagLength defines maximum length of the request path to extract and include in the HttpUrl tag. contour's default is 256.
+                      format: int32
+                      type: integer
+                    overallSampling:
+                      description: OverallSampling defines the sampling rate of trace data. contour's default is 100.
+                      type: string
+                    serviceName:
+                      description: ServiceName defines the name for the service. contour's default is contour.
+                      type: string
+                  required:
+                    - extensionService
+                  type: object
                 xdsServer:
                   description: XDSServer contains parameters for the xDS server.
                   properties:
@@ -766,8 +868,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.11.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.11.4
   name: contourdeployments.projectcontour.io
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -883,7 +984,7 @@ spec:
                       description: 'Compute Resources required by contour container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                       properties:
                         claims:
-                          description: "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. \n This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. \n This field is immutable."
+                          description: "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. \n This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. \n This field is immutable. It can only be set for containers."
                           items:
                             description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                             properties:
@@ -1317,7 +1418,7 @@ spec:
                                         description: 'resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources'
                                         properties:
                                           claims:
-                                            description: "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. \n This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. \n This field is immutable."
+                                            description: "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. \n This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. \n This field is immutable. It can only be set for containers."
                                             items:
                                               description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                                               properties:
@@ -2022,7 +2123,7 @@ spec:
                       description: 'Compute Resources required by envoy container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                       properties:
                         claims:
-                          description: "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. \n This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. \n This field is immutable."
+                          description: "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. \n This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. \n This field is immutable. It can only be set for containers."
                           items:
                             description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                             properties:
@@ -2286,6 +2387,61 @@ spec:
                             - namespace
                           type: object
                       type: object
+                    globalExtAuth:
+                      description: GlobalExternalAuthorization allows envoys external authorization filter to be enabled for all virtual hosts.
+                      properties:
+                        authPolicy:
+                          description: AuthPolicy sets a default authorization policy for client requests. This policy will be used unless overridden by individual routes.
+                          properties:
+                            context:
+                              additionalProperties:
+                                type: string
+                              description: Context is a set of key/value pairs that are sent to the authentication server in the check request. If a context is provided at an enclosing scope, the entries are merged such that the inner scope overrides matching keys from the outer scope.
+                              type: object
+                            disabled:
+                              description: When true, this field disables client request authentication for the scope of the policy.
+                              type: boolean
+                          type: object
+                        extensionRef:
+                          description: ExtensionServiceRef specifies the extension resource that will authorize client requests.
+                          properties:
+                            apiVersion:
+                              description: API version of the referent. If this field is not specified, the default "projectcontour.io/v1alpha1" will be used
+                              minLength: 1
+                              type: string
+                            name:
+                              description: "Name of the referent. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names"
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: "Namespace of the referent. If this field is not specifies, the namespace of the resource that targets the referent will be used. \n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/"
+                              minLength: 1
+                              type: string
+                          type: object
+                        failOpen:
+                          description: If FailOpen is true, the client request is forwarded to the upstream service even if the authorization server fails to respond. This field should not be set in most cases. It is intended for use only while migrating applications from internal authorization to Contour external authorization.
+                          type: boolean
+                        responseTimeout:
+                          description: ResponseTimeout configures maximum time to wait for a check response from the authorization server. Timeout durations are expressed in the Go [Duration format](https://godoc.org/time#ParseDuration). Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The string "infinity" is also a valid input and specifies no timeout.
+                          pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$
+                          type: string
+                        withRequestBody:
+                          description: WithRequestBody specifies configuration for sending the client request's body to authorization server.
+                          properties:
+                            allowPartialMessage:
+                              description: If AllowPartialMessage is true, then Envoy will buffer the body until MaxRequestBytes are reached.
+                              type: boolean
+                            maxRequestBytes:
+                              default: 1024
+                              description: MaxRequestBytes sets the maximum size of message body ExtAuthz filter will hold in-memory.
+                              format: int32
+                              minimum: 1
+                              type: integer
+                            packAsBytes:
+                              description: If PackAsBytes is true, the body sent to Authorization Server is in raw bytes.
+                              type: boolean
+                          type: object
+                      type: object
                     health:
                       description: "Health defines the endpoints Contour uses to serve health checks. \n Contour's default is { address: \"0.0.0.0\", port: 8000 }."
                       properties:
@@ -2417,6 +2573,54 @@ spec:
                       required:
                         - extensionService
                       type: object
+                    tracing:
+                      description: Tracing defines properties for exporting trace data to OpenTelemetry.
+                      properties:
+                        customTags:
+                          description: CustomTags defines a list of custom tags with unique tag name.
+                          items:
+                            description: CustomTag defines custom tags with unique tag name to create tags for the active span.
+                            properties:
+                              literal:
+                                description: Literal is a static custom tag value. Precisely one of Literal, RequestHeaderName must be set.
+                                type: string
+                              requestHeaderName:
+                                description: RequestHeaderName indicates which request header the label value is obtained from. Precisely one of Literal, RequestHeaderName must be set.
+                                type: string
+                              tagName:
+                                description: TagName is the unique name of the custom tag.
+                                type: string
+                            required:
+                              - tagName
+                            type: object
+                          type: array
+                        extensionService:
+                          description: ExtensionService identifies the extension service defining the otel-collector.
+                          properties:
+                            name:
+                              type: string
+                            namespace:
+                              type: string
+                          required:
+                            - name
+                            - namespace
+                          type: object
+                        includePodDetail:
+                          description: 'IncludePodDetail defines a flag. If it is true, contour will add the pod name and namespace to the span of the trace. the default is true. Note: The Envoy pods MUST have the HOSTNAME and CONTOUR_NAMESPACE environment variables set for this to work properly.'
+                          type: boolean
+                        maxPathTagLength:
+                          description: MaxPathTagLength defines maximum length of the request path to extract and include in the HttpUrl tag. contour's default is 256.
+                          format: int32
+                          type: integer
+                        overallSampling:
+                          description: OverallSampling defines the sampling rate of trace data. contour's default is 100.
+                          type: string
+                        serviceName:
+                          description: ServiceName defines the name for the service. contour's default is contour.
+                          type: string
+                      required:
+                        - extensionService
+                      type: object
                     xdsServer:
                       description: XDSServer contains parameters for the xDS server.
                       properties:
@@ -2510,8 +2714,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.11.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.11.4
   name: extensionservices.projectcontour.io
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -2548,7 +2751,7 @@ spec:
                   description: The policy for load balancing GRPC service requests. Note that the `Cookie` and `RequestHash` load balancing strategies cannot be used here.
                   properties:
                     requestHashPolicies:
-                      description: RequestHashPolicies contains a list of hash policies to apply when the `RequestHash` load balancing strategy is chosen. If an element of the supplied list of hash policies is invalid, it will be ignored. If the list of hash policies is empty after validation, the load balancing strategy will fall back the the default `RoundRobin`.
+                      description: RequestHashPolicies contains a list of hash policies to apply when the `RequestHash` load balancing strategy is chosen. If an element of the supplied list of hash policies is invalid, it will be ignored. If the list of hash policies is empty after validation, the load balancing strategy will fall back to the default `RoundRobin`.
                       items:
                         description: RequestHashPolicy contains configuration for an individual hash policy on a request attribute.
                         properties:
@@ -2776,8 +2979,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.11.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.11.4
   name: httpproxies.projectcontour.io
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -2835,8 +3037,11 @@ spec:
                       conditions:
                         description: 'Conditions are a set of rules that are applied to included HTTPProxies. In effect, they are added onto the Conditions of included HTTPProxy Route structs. When applied, they are merged using AND, with one exception: There can be only one Prefix MatchCondition per Conditions slice. More than one Prefix, or contradictory Conditions, will make the include invalid.'
                         items:
-                          description: MatchCondition are a general holder for matching rules for HTTPProxies. One of Prefix or Header must be provided.
+                          description: MatchCondition are a general holder for matching rules for HTTPProxies. One of Prefix, Exact, Header or QueryParameter must be provided.
                           properties:
+                            exact:
+                              description: Exact defines a exact match for a request. This field is not allowed in include match conditions.
+                              type: string
                             header:
                               description: Header specifies the header condition to match.
                               properties:
@@ -2867,6 +3072,36 @@ spec:
                             prefix:
                               description: Prefix defines a prefix match for a request.
                               type: string
+                            queryParameter:
+                              description: QueryParameter specifies the query parameter condition to match.
+                              properties:
+                                contains:
+                                  description: Contains specifies a substring that must be present in the query parameter value.
+                                  type: string
+                                exact:
+                                  description: Exact specifies a string that the query parameter value must be equal to.
+                                  type: string
+                                ignoreCase:
+                                  description: IgnoreCase specifies that string matching should be case insensitive. Note that this has no effect on the Regex parameter.
+                                  type: boolean
+                                name:
+                                  description: Name is the name of the query parameter to match against. Name is required. Query parameter names are case insensitive.
+                                  type: string
+                                prefix:
+                                  description: Prefix defines a prefix match for the query parameter value.
+                                  type: string
+                                present:
+                                  description: Present specifies that condition is true when the named query parameter is present, regardless of its value. Note that setting Present to false does not make the condition true if the named query parameter is absent.
+                                  type: boolean
+                                regex:
+                                  description: Regex specifies a regular expression pattern that must match the query parameter value.
+                                  type: string
+                                suffix:
+                                  description: Suffix defines a suffix match for a query parameter value.
+                                  type: string
+                              required:
+                                - name
+                              type: object
                           type: object
                         type: array
                       name:
@@ -2902,8 +3137,11 @@ spec:
                       conditions:
                         description: 'Conditions are a set of rules that are applied to a Route. When applied, they are merged using AND, with one exception: There can be only one Prefix MatchCondition per Conditions slice. More than one Prefix, or contradictory Conditions, will make the route invalid.'
                         items:
-                          description: MatchCondition are a general holder for matching rules for HTTPProxies. One of Prefix or Header must be provided.
+                          description: MatchCondition are a general holder for matching rules for HTTPProxies. One of Prefix, Exact, Header or QueryParameter must be provided.
                           properties:
+                            exact:
+                              description: Exact defines a exact match for a request. This field is not allowed in include match conditions.
+                              type: string
                             header:
                               description: Header specifies the header condition to match.
                               properties:
@@ -2934,6 +3172,36 @@ spec:
                             prefix:
                               description: Prefix defines a prefix match for a request.
                               type: string
+                            queryParameter:
+                              description: QueryParameter specifies the query parameter condition to match.
+                              properties:
+                                contains:
+                                  description: Contains specifies a substring that must be present in the query parameter value.
+                                  type: string
+                                exact:
+                                  description: Exact specifies a string that the query parameter value must be equal to.
+                                  type: string
+                                ignoreCase:
+                                  description: IgnoreCase specifies that string matching should be case insensitive. Note that this has no effect on the Regex parameter.
+                                  type: boolean
+                                name:
+                                  description: Name is the name of the query parameter to match against. Name is required. Query parameter names are case insensitive.
+                                  type: string
+                                prefix:
+                                  description: Prefix defines a prefix match for the query parameter value.
+                                  type: string
+                                present:
+                                  description: Present specifies that condition is true when the named query parameter is present, regardless of its value. Note that setting Present to false does not make the condition true if the named query parameter is absent.
+                                  type: boolean
+                                regex:
+                                  description: Regex specifies a regular expression pattern that must match the query parameter value.
+                                  type: string
+                                suffix:
+                                  description: Suffix defines a suffix match for a query parameter value.
+                                  type: string
+                              required:
+                                - name
+                              type: object
                           type: object
                         type: array
                       cookieRewritePolicies:
@@ -3031,6 +3299,74 @@ spec:
                         required:
                           - path
                         type: object
+                      internalRedirectPolicy:
+                        description: The policy to define when to handle redirects responses internally.
+                        properties:
+                          allowCrossSchemeRedirect:
+                            default: Never
+                            description: AllowCrossSchemeRedirect Allow internal redirect to follow a target URI with a different scheme than the value of x-forwarded-proto. SafeOnly allows same scheme redirect and safe cross scheme redirect, which means if the downstream scheme is HTTPS, both HTTPS and HTTP redirect targets are allowed, but if the downstream scheme is HTTP, only HTTP redirect targets are allowed.
+                            enum:
+                              - Always
+                              - Never
+                              - SafeOnly
+                            type: string
+                          denyRepeatedRouteRedirect:
+                            description: If DenyRepeatedRouteRedirect is true, rejects redirect targets that are pointing to a route that has been followed by a previous redirect from the current route.
+                            type: boolean
+                          maxInternalRedirects:
+                            description: MaxInternalRedirects An internal redirect is not handled, unless the number of previous internal redirects that a downstream request has encountered is lower than this value.
+                            format: int32
+                            type: integer
+                          redirectResponseCodes:
+                            description: RedirectResponseCodes If unspecified, only 302 will be treated as internal redirect. Only 301, 302, 303, 307 and 308 are valid values.
+                            items:
+                              description: RedirectResponseCode is a uint32 type alias with validation to ensure that the value is valid.
+                              enum:
+                                - 301
+                                - 302
+                                - 303
+                                - 307
+                                - 308
+                              format: int32
+                              type: integer
+                            type: array
+                        type: object
+                      ipAllowPolicy:
+                        description: IPAllowFilterPolicy is a list of ipv4/6 filter rules for which matching requests should be allowed. All other requests will be denied. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy can be defined. The rules defined here override any rules set on the root HTTPProxy.
+                        items:
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR block of ipv4 or ipv6 addresses to filter on. This can also be a bare IP address (without a mask) to filter on exactly one address.
+                              type: string
+                            source:
+                              description: 'Source indicates how to determine the ip address to filter on, and can be one of two values: - `Remote` filters on the ip address of the client, accounting for PROXY and X-Forwarded-For as needed. - `Peer` filters on the ip of the network request, ignoring PROXY and X-Forwarded-For.'
+                              enum:
+                                - Peer
+                                - Remote
+                              type: string
+                          required:
+                            - cidr
+                            - source
+                          type: object
+                        type: array
+                      ipDenyPolicy:
+                        description: IPDenyFilterPolicy is a list of ipv4/6 filter rules for which matching requests should be denied. All other requests will be allowed. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy can be defined. The rules defined here override any rules set on the root HTTPProxy.
+                        items:
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR block of ipv4 or ipv6 addresses to filter on. This can also be a bare IP address (without a mask) to filter on exactly one address.
+                              type: string
+                            source:
+                              description: 'Source indicates how to determine the ip address to filter on, and can be one of two values: - `Remote` filters on the ip address of the client, accounting for PROXY and X-Forwarded-For as needed. - `Peer` filters on the ip of the network request, ignoring PROXY and X-Forwarded-For.'
+                              enum:
+                                - Peer
+                                - Remote
+                              type: string
+                          required:
+                            - cidr
+                            - source
+                          type: object
+                        type: array
                       jwtVerificationPolicy:
                         description: The policy for verifying JWTs for requests to this route.
                         properties:
@@ -3045,7 +3381,7 @@ spec:
                         description: The load balancing policy for this route.
                         properties:
                           requestHashPolicies:
-                            description: RequestHashPolicies contains a list of hash policies to apply when the `RequestHash` load balancing strategy is chosen. If an element of the supplied list of hash policies is invalid, it will be ignored. If the list of hash policies is empty after validation, the load balancing strategy will fall back the the default `RoundRobin`.
+                            description: RequestHashPolicies contains a list of hash policies to apply when the `RequestHash` load balancing strategy is chosen. If an element of the supplied list of hash policies is invalid, it will be ignored. If the list of hash policies is empty after validation, the load balancing strategy will fall back to the default `RoundRobin`.
                             items:
                               description: RequestHashPolicy contains configuration for an individual hash policy on a request attribute.
                               properties:
@@ -3450,7 +3786,7 @@ spec:
                                 - tls
                               type: string
                             requestHeadersPolicy:
-                              description: The policy for managing request headers during proxying. Rewriting the 'Host' header is not supported.
+                              description: The policy for managing request headers during proxying.
                               properties:
                                 remove:
                                   description: Remove specifies a list of HTTP header names to remove.
@@ -3617,7 +3953,7 @@ spec:
                       description: The load balancing policy for the backend services. Note that the `Cookie` and `RequestHash` load balancing strategies cannot be used here.
                       properties:
                         requestHashPolicies:
-                          description: RequestHashPolicies contains a list of hash policies to apply when the `RequestHash` load balancing strategy is chosen. If an element of the supplied list of hash policies is invalid, it will be ignored. If the list of hash policies is empty after validation, the load balancing strategy will fall back the the default `RoundRobin`.
+                          description: RequestHashPolicies contains a list of hash policies to apply when the `RequestHash` load balancing strategy is chosen. If an element of the supplied list of hash policies is invalid, it will be ignored. If the list of hash policies is empty after validation, the load balancing strategy will fall back to the default `RoundRobin`.
                           items:
                             description: RequestHashPolicy contains configuration for an individual hash policy on a request attribute.
                             properties:
@@ -3727,7 +4063,7 @@ spec:
                               - tls
                             type: string
                           requestHeadersPolicy:
-                            description: The policy for managing request headers during proxying. Rewriting the 'Host' header is not supported.
+                            description: The policy for managing request headers during proxying.
                             properties:
                               remove:
                                 description: Remove specifies a list of HTTP header names to remove.
@@ -3883,8 +4219,6 @@ spec:
                               description: If PackAsBytes is true, the body sent to Authorization Server is in raw bytes.
                               type: boolean
                           type: object
-                      required:
-                        - extensionRef
                       type: object
                     corsPolicy:
                       description: Specifies the cross-origin policy to apply to the VirtualHost.
@@ -3914,6 +4248,9 @@ spec:
                             type: string
                           minItems: 1
                           type: array
+                        allowPrivateNetwork:
+                          description: AllowPrivateNetwork specifies whether to allow private network requests. See https://developer.chrome.com/blog/private-network-access-preflight.
+                          type: boolean
                         exposeHeaders:
                           description: ExposeHeaders Specifies the content for the *access-control-expose-headers* header.
                           items:
@@ -3934,6 +4271,42 @@ spec:
                       description: The fully qualified domain name of the root of the ingress tree all leaves of the DAG rooted at this object relate to the fqdn.
                       pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
+                    ipAllowPolicy:
+                      description: IPAllowFilterPolicy is a list of ipv4/6 filter rules for which matching requests should be allowed. All other requests will be denied. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy can be defined. The rules defined here may be overridden in a Route.
+                      items:
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR block of ipv4 or ipv6 addresses to filter on. This can also be a bare IP address (without a mask) to filter on exactly one address.
+                            type: string
+                          source:
+                            description: 'Source indicates how to determine the ip address to filter on, and can be one of two values: - `Remote` filters on the ip address of the client, accounting for PROXY and X-Forwarded-For as needed. - `Peer` filters on the ip of the network request, ignoring PROXY and X-Forwarded-For.'
+                            enum:
+                              - Peer
+                              - Remote
+                            type: string
+                        required:
+                          - cidr
+                          - source
+                        type: object
+                      type: array
+                    ipDenyPolicy:
+                      description: IPDenyFilterPolicy is a list of ipv4/6 filter rules for which matching requests should be denied. All other requests will be allowed. Only one of IPAllowFilterPolicy and IPDenyFilterPolicy can be defined. The rules defined here may be overridden in a Route.
+                      items:
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR block of ipv4 or ipv6 addresses to filter on. This can also be a bare IP address (without a mask) to filter on exactly one address.
+                            type: string
+                          source:
+                            description: 'Source indicates how to determine the ip address to filter on, and can be one of two values: - `Remote` filters on the ip address of the client, accounting for PROXY and X-Forwarded-For as needed. - `Peer` filters on the ip of the network request, ignoring PROXY and X-Forwarded-For.'
+                            enum:
+                              - Peer
+                              - Remote
+                            type: string
+                        required:
+                          - cidr
+                          - source
+                        type: object
+                      type: array
                     jwtProviders:
                       description: Providers to use for verifying JSON Web Tokens (JWTs) on the virtual host.
                       items:
@@ -4379,8 +4752,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.11.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.11.4
   name: tlscertificatedelegations.projectcontour.io
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -4420,7 +4792,7 @@ spec:
                         description: required, the name of a secret in the current namespace.
                         type: string
                       targetNamespaces:
-                        description: required, the namespaces the authority to reference the the secret will be delegated to. If TargetNamespaces is nil or empty, the CertificateDelegation' is ignored. If the TargetNamespace list contains the character, "*" the secret will be delegated to all namespaces.
+                        description: required, the namespaces the authority to reference the secret will be delegated to. If TargetNamespaces is nil or empty, the CertificateDelegation' is ignored. If the TargetNamespace list contains the character, "*" the secret will be delegated to all namespaces.
                         items:
                           type: string
                         type: array
@@ -4603,7 +4975,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1.24.2
+  name: contour-certgen-v1.25.0
   namespace: contour-external
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -4615,7 +4987,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -4659,7 +5031,6 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  creationTimestamp: null
   name: knative-contour
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -4680,6 +5051,7 @@ rules:
     resources:
       - gatewayclasses
       - gateways
+      - grpcroutes
       - httproutes
       - referencegrants
       - tlsroutes
@@ -4692,6 +5064,7 @@ rules:
     resources:
       - gatewayclasses/status
       - gateways/status
+      - grpcroutes/status
       - httproutes/status
       - tlsroutes/status
     verbs:
@@ -4737,7 +5110,6 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  creationTimestamp: null
   name: contour
   namespace: contour-external
   labels:
@@ -4848,7 +5220,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -4937,7 +5309,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -4965,7 +5337,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.25.2
+          image: docker.io/envoyproxy/envoy:v1.26.1
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -5027,7 +5399,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -5320,7 +5692,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1.24.2
+  name: contour-certgen-v1.25.0
   namespace: contour-internal
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -5332,7 +5704,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -5376,7 +5748,6 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  creationTimestamp: null
   name: contour
   namespace: contour-internal
   labels:
@@ -5486,7 +5857,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -5575,7 +5946,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -5603,7 +5974,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.25.2
+          image: docker.io/envoyproxy/envoy:v1.26.1
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -5665,7 +6036,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.24.2
+          image: ghcr.io/projectcontour/contour:v1.25.0
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 768966526..f31ef4c58 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-6a38dd78"
+    app.kubernetes.io/version: "20230620-3c443fc5"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,7 +38,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-6a38dd78"
+    app.kubernetes.io/version: "20230620-3c443fc5"
 data:
   _example: |
     ################################
@@ -95,7 +95,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-6a38dd78"
+    app.kubernetes.io/version: "20230620-3c443fc5"
 spec:
   replicas: 1
   selector:
@@ -107,14 +107,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230530-6a38dd78"
+        app.kubernetes.io/version: "20230620-3c443fc5"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:80a4d0cb1e1e86d0f67a8669b573c6b6bc5627306e06e844d94806633d5ef38f
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:d52e3b9c8fadc7de0a6b45b060387c96e6997a441f667fe1fe1395c9dbf8a583
           resources:
             requests:
               cpu: 40m
@@ -156,7 +156,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-6a38dd78"
+    app.kubernetes.io/version: "20230620-3c443fc5"
 spec:
   delegations:
     - secretName: knative-serving-certs
diff --git a/third_party/gateway-api-latest/istio-gateway.yaml b/third_party/gateway-api-latest/istio-gateway.yaml
index c61fed0cc..33f6c519f 100644
--- a/third_party/gateway-api-latest/istio-gateway.yaml
+++ b/third_party/gateway-api-latest/istio-gateway.yaml
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-82bdfa61"
+    app.kubernetes.io/version: "20230623-97a5189b"
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
   type: ClusterIP
diff --git a/third_party/gateway-api-latest/net-gateway-api.yaml b/third_party/gateway-api-latest/net-gateway-api.yaml
index 5d4e18c39..d1fe5fca8 100644
--- a/third_party/gateway-api-latest/net-gateway-api.yaml
+++ b/third_party/gateway-api-latest/net-gateway-api.yaml
@@ -5204,7 +5204,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-82bdfa61"
+    app.kubernetes.io/version: "20230623-97a5189b"
 aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
@@ -5220,7 +5220,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-82bdfa61"
+    app.kubernetes.io/version: "20230623-97a5189b"
 rules:
   - apiGroups: ["gateway.networking.k8s.io"]
     resources: ["httproutes", "referencegrants", "referencepolicies"]
@@ -5253,7 +5253,7 @@ metadata:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-82bdfa61"
+    app.kubernetes.io/version: "20230623-97a5189b"
 data:
   _example: |
     ################################
@@ -5307,7 +5307,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
-    app.kubernetes.io/version: "20230530-82bdfa61"
+    app.kubernetes.io/version: "20230623-97a5189b"
     app.kubernetes.io/name: knative-serving
 spec:
   replicas: 1
@@ -5334,7 +5334,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:c059c0e94eef8376b53598e1d9d4c99240347cab45e2aaceca2559958888c9f4
+          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:593d5db51713f3d27b2aa0bc1f2bb71789888aa0de734aa2fe6d1d79dd043d5d
           resources:
             requests:
               cpu: 100m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 6a0f06e5b..ecec93b1f 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 383d79018b993e41a3886386658b880f9cc88d80
+# Generated when HEAD was 43d0660bfc5c9c3c395e5179031845c81ac1fd63
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -54,7 +54,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -93,7 +93,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -114,7 +114,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -149,7 +149,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 data:
   # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
@@ -192,11 +192,6 @@ data:
     # `knative-serving`
     local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"
 
-    # If true, knative will use the Istio VirtualService's status to determine
-    # endpoint readiness. Otherwise, probe as usual.
-    # NOTE: This feature is currently experimental and should not be used in production.
-    enable-virtualservice-status: "false"
-
 ---
 # Allows the Webhooks to be reached by kube-api with or without
 # sidecar injection and with mTLS PERMISSIVE and STRICT.
@@ -208,7 +203,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -226,7 +221,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -244,7 +239,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -277,7 +272,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -286,7 +281,6 @@ spec:
   template:
     metadata:
       annotations:
-        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
         # This must be outside of the mesh to probe the gateways.
         # NOTE: this is allowed here and not elsewhere because
         # this is the Istio controller, and so it may be Istio-aware.
@@ -295,14 +289,14 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230530-383d7901"
+        app.kubernetes.io/version: "20230626-43d0660b"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:5bf8754837f272485a8ee4bc1c257f248111ecd1c45bf2a53f46aa8d60c0ec0c
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:fde8e36a95b88afb23c1d441691e2e31d7111768d0041b30611b981d0f7d96b7
           resources:
             requests:
               cpu: 30m
@@ -381,7 +375,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -390,21 +384,19 @@ spec:
       role: net-istio-webhook
   template:
     metadata:
-      annotations:
-        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
       labels:
         app: net-istio-webhook
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20230530-383d7901"
+        app.kubernetes.io/version: "20230626-43d0660b"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:4c5a2b3ec205881385b62958b5f8f0f2e87be0ba354f8a10aa89a1c4ff7e83ca
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:95b9d43d84f29cc588c9de19a6b12f45454e1734590c6c9cf3d96dd0c5cb0c58
           resources:
             requests:
               cpu: 20m
@@ -488,7 +480,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -515,7 +507,7 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -554,7 +546,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -593,7 +585,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20230530-383d7901"
+    app.kubernetes.io/version: "20230626-43d0660b"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index c17c7b2a6..4b825c80f 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -20,7 +20,7 @@ metadata:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -45,7 +45,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 data:
   envoy-bootstrap.yaml: |
@@ -168,7 +168,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 data:
   _example: |
@@ -259,7 +259,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -269,7 +269,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -301,7 +301,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -335,7 +335,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -357,7 +357,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:2fe5e0d004b022e7a46a37c0d4f22603f49e4375832bfdd8810add8a80268fe8
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:668de54410f2bee8d2fb2cc736f6fbf1125fbdcd4520f52f6251ee3db12bf254
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -378,6 +378,11 @@ spec:
             - name: http2-xds
               containerPort: 18000
               protocol: TCP
+          startupProbe:
+            grpc:
+              port: 18000
+            periodSeconds: 10
+            failureThreshold: 120
           readinessProbe:
             grpc:
               port: 18000
@@ -415,7 +420,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -450,7 +455,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   strategy:
@@ -559,7 +564,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -583,7 +588,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   ports:
@@ -607,7 +612,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   minReplicas: 1
@@ -633,7 +638,7 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20230530-502f6ad1"
+    app.kubernetes.io/version: "20230627-790358f7"
     app.kubernetes.io/name: knative-serving
 spec:
   minAvailable: 80%