Repository: knative/serving
Pull request #10080 (2020-11-10 11:08:43)

[Automated] Update net-kourier nightly
Produced via:
```shell
for x in kourier.yaml; do
  curl https://storage.googleapis.com/knative-nightly/net-kourier/latest/$x > ${GITHUB_WORKSPACE}/./third_party/kourier-latest/$x
done
```
/assign @knative/networking-wg-leads
/cc @knative/networking-wg-leads

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10080#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **markusthoemmes** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @markusthoemmes` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["markusthoemmes"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=h1) Report
> Merging [#10080](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=desc) (2f902cd) into [master](https://codecov.io/gh/knative/serving/commit/db4879e0f615816e2796e0ebd4ad908492abd159?el=desc) (db4879e) will **decrease** coverage by `0.02%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/10080/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui)](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master   #10080      +/-   ##
==========================================
- Coverage   88.01%   87.99%   -0.03%     
==========================================
  Files         185      185              
  Lines        8686     8686              
==========================================
- Hits         7645     7643       -2     
- Misses        793      795       +2     
  Partials      248      248              
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/autoscaling/kpa/scaler.go](https://codecov.io/gh/knative/serving/pull/10080/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcva3BhL3NjYWxlci5nbw==) | `88.57% <0.00%> (-1.43%)` | :arrow_down: |
| [pkg/activator/net/revision\_backends.go](https://codecov.io/gh/knative/serving/pull/10080/diff?src=pr&el=tree#diff-cGtnL2FjdGl2YXRvci9uZXQvcmV2aXNpb25fYmFja2VuZHMuZ28=) | `90.49% <0.00%> (-0.91%)` | :arrow_down: |
| [pkg/autoscaler/statforwarder/forwarder.go](https://codecov.io/gh/knative/serving/pull/10080/diff?src=pr&el=tree#diff-cGtnL2F1dG9zY2FsZXIvc3RhdGZvcndhcmRlci9mb3J3YXJkZXIuZ28=) | `82.44% <0.00%> (+1.06%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=footer). Last update [db4879e...f85b407](https://codecov.io/gh/knative/serving/pull/10080?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

knative-prow-robot: @knative-automation: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-unit-tests | f85b407e26606321238ba5aaaf675ad6cf959d24 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10080/pull-knative-serving-unit-tests/1326119618539950080) | `/test pull-knative-serving-unit-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10080). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/pkg/reconciler/revision/revision.go b/pkg/reconciler/revision/revision.go
index 90a41b415..aea2a0e88 100644
--- a/pkg/reconciler/revision/revision.go
+++ b/pkg/reconciler/revision/revision.go
@@ -21,7 +21,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/davecgh/go-spew/spew"
 	"github.com/google/go-containerregistry/pkg/authn/k8schain"
+	"go.uber.org/zap/zapcore"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -136,6 +138,15 @@ func (c *Reconciler) ReconcileKind(ctx context.Context, rev *v1.Revision) pkgrec
 		return nil
 	}
 
+	// Spew is an expensive operation so guard the computation on the debug level
+	// being enabled.
+	// Some things, like PA reachability, etc are computed based on various labels/annotations
+	// of revision. So it is useful to provide this information for debugging.
+	logger := logging.FromContext(ctx).Desugar()
+	if logger.Core().Enabled(zapcore.DebugLevel) {
+		logger.Debug("Revision meta: " + spew.Sdump(rev.ObjectMeta))
+	}
+
 	for _, phase := range []func(context.Context, *v1.Revision) error{
 		c.reconcileDeployment,
 		c.reconcileImageCache,
@@ -147,10 +158,12 @@ func (c *Reconciler) ReconcileKind(ctx context.Context, rev *v1.Revision) pkgrec
 	}
 	readyAfterReconcile := rev.Status.GetCondition(v1.RevisionConditionReady).IsTrue()
 	if !readyBeforeReconcile && readyAfterReconcile {
-		logging.FromContext(ctx).Info("Revision became ready")
+		logger.Info("Revision became ready")
 		controller.GetEventRecorder(ctx).Event(
 			rev, corev1.EventTypeNormal, "RevisionReady",
 			"Revision becomes ready upon all resources being ready")
+	} else if readyBeforeReconcile && !readyAfterReconcile {
+		logger.Info("Revision stopped being ready")
 	}
 
 	return nil
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index 61ffb5256..d72263fb6 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -143,6 +143,31 @@ func (cur *Rollout) Step(prev *Rollout) *Rollout {
 	return ro
 }
 
+// adjustPercentage updates the rollout with the new percentage values.
+// If new percentage is larger than the previous, the last revision gets
+// the difference, if it is decreasing then we start removing traffic from
+// the older revisions.
+func adjustPercentage(goal int, cr *ConfigurationRollout) {
+	switch diff := goal - cr.Percent; {
+	case diff > 0:
+		cr.Revisions[len(cr.Revisions)-1].Percent += diff
+	case diff < 0:
+		diff = -diff // To make logic more natural.
+		i := 0
+		for diff > 0 && i < len(cr.Revisions) {
+			if cr.Revisions[i].Percent > diff {
+				cr.Revisions[i].Percent -= diff
+				break
+			}
+			diff -= cr.Revisions[i].Percent
+			i++
+		}
+		cr.Revisions = cr.Revisions[i:]
+	default: // diff = 0
+		// noop
+	}
+}
+
 // stepConfig takes previous and goal configuration shapes and returns a new
 // config rollout, after computing the percetage allocations.
 func stepConfig(goal, prev *ConfigurationRollout) *ConfigurationRollout {
@@ -151,6 +176,11 @@ func stepConfig(goal, prev *ConfigurationRollout) *ConfigurationRollout {
 		ConfigurationName: goal.ConfigurationName,
 		Tag:               goal.Tag,
 		Percent:           goal.Percent,
+		Revisions:         goal.Revisions,
+	}
+
+	if len(prev.Revisions) > 0 {
+		adjustPercentage(goal.Percent, prev)
 	}
 	// goal will always have just one revision in the list – the current desired revision.
 	// If it matches the last revision of the previous rollout state (or there were no revisions)
@@ -158,9 +188,9 @@ func stepConfig(goal, prev *ConfigurationRollout) *ConfigurationRollout {
 	if len(prev.Revisions) == 0 || goal.Revisions[0].RevisionName == prev.Revisions[pc-1].RevisionName {
 		// TODO(vagababov): here would go the logic to compute new percentages for the rollout,
 		// i.e step function, so return value will change, depending on that.
-		// TODO(vagababov): percentage might change, so this should trigger recompute of existing
-		// revision rollouts.
-		ret.Revisions = goal.Revisions
+		if len(prev.Revisions) > 0 {
+			ret.Revisions = prev.Revisions
+		}
 		return ret
 	}
 


Test patch:
diff --git a/pkg/reconciler/route/traffic/rollout_test.go b/pkg/reconciler/route/traffic/rollout_test.go
index 6e4a0b5f5..dd73569e8 100644
--- a/pkg/reconciler/route/traffic/rollout_test.go
+++ b/pkg/reconciler/route/traffic/rollout_test.go
@@ -193,6 +193,88 @@ func TestStep(t *testing.T) {
 				}},
 			}},
 		},
+	}, {
+		name: "roll with percentage change down",
+		cur: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           33,
+				Revisions: []RevisionRollout{{
+					RevisionName: "let-it-bleed",
+					Percent:      33,
+				}},
+			}},
+		},
+		prev: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           42,
+				Revisions: []RevisionRollout{{
+					RevisionName: "goat-head-soup",
+					Percent:      11,
+				}, {
+					RevisionName: "aftermath",
+					Percent:      31,
+				}},
+			}},
+		},
+		want: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           33,
+				Revisions: []RevisionRollout{{
+					RevisionName: "goat-head-soup",
+					Percent:      2,
+				}, {
+					RevisionName: "aftermath",
+					Percent:      30,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      1,
+				}},
+			}},
+		},
+	}, {
+		name: "roll with percentage change up",
+		cur: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           75,
+				Revisions: []RevisionRollout{{
+					RevisionName: "let-it-bleed",
+					Percent:      75,
+				}},
+			}},
+		},
+		prev: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           25,
+				Revisions: []RevisionRollout{{
+					RevisionName: "goat-head-soup",
+					Percent:      11,
+				}, {
+					RevisionName: "aftermath",
+					Percent:      14,
+				}},
+			}},
+		},
+		want: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           75,
+				Revisions: []RevisionRollout{{
+					RevisionName: "goat-head-soup",
+					Percent:      11,
+				}, {
+					RevisionName: "aftermath",
+					Percent:      63,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      1,
+				}},
+			}},
+		},
 	}, {
 		name: "roll, where sum < 100% (one route targets a revision, e.g.)",
 		cur: &Rollout{
@@ -528,3 +610,130 @@ func TestStep(t *testing.T) {
 		})
 	}
 }
+
+func TestAdjustPercentage(t *testing.T) {
+	tests := []struct {
+		name string
+		goal int
+		prev *ConfigurationRollout
+		want []RevisionRollout
+	}{{
+		name: "noop, 100%",
+		goal: 100,
+		prev: &ConfigurationRollout{
+			Percent: 100,
+			Revisions: []RevisionRollout{{
+				Percent: 71,
+			}, {
+				Percent: 29,
+			}},
+		},
+		want: []RevisionRollout{{
+			Percent: 71,
+		}, {
+			Percent: 29,
+		}},
+	}, {
+		name: "noop, 42%",
+		goal: 42,
+		prev: &ConfigurationRollout{
+			Percent: 42,
+			Revisions: []RevisionRollout{{
+				Percent: 21,
+			}, {
+				Percent: 21,
+			}},
+		},
+		want: []RevisionRollout{{
+			Percent: 21,
+		}, {
+			Percent: 21,
+		}},
+	}, {
+		name: "raise, 42% -> 75%",
+		goal: 75,
+		prev: &ConfigurationRollout{
+			Percent: 42,
+			Revisions: []RevisionRollout{{
+				Percent: 21,
+			}, {
+				Percent: 21,
+			}},
+		},
+		want: []RevisionRollout{{
+			Percent: 21,
+		}, {
+			Percent: 54,
+		}},
+	}, {
+		name: "lower, 75%->42%, lose 1",
+		goal: 42,
+		prev: &ConfigurationRollout{
+			Percent: 75,
+			Revisions: []RevisionRollout{{
+				Percent: 21,
+			}, {
+				Percent: 54,
+			}},
+		},
+		want: []RevisionRollout{{
+			Percent: 42,
+		}},
+	}, {
+		name: "lower, 75%->42%, lose 1, update 2, keep 3",
+		goal: 42,
+		prev: &ConfigurationRollout{
+			Percent: 75,
+			Revisions: []RevisionRollout{{
+				Percent: 21,
+			}, {
+				Percent: 22,
+			}, {
+				Percent: 32,
+			}},
+		},
+		want: []RevisionRollout{{
+			Percent: 10,
+		}, {
+			Percent: 32,
+		}},
+	}, {
+		name: "lower, 75%->42%, lose 2, update 3",
+		goal: 42,
+		prev: &ConfigurationRollout{
+			Percent: 75,
+			Revisions: []RevisionRollout{{
+				Percent: 10,
+			}, {
+				Percent: 5,
+			}, {
+				Percent: 60,
+			}},
+		},
+		want: []RevisionRollout{{
+			Percent: 42,
+		}},
+	}, {
+		name: "go to 0%",
+		goal: 0,
+		prev: &ConfigurationRollout{
+			Percent: 75,
+			Revisions: []RevisionRollout{{
+				Percent: 10,
+			}, {
+				Percent: 5,
+			}, {
+				Percent: 60,
+			}},
+		},
+		want: []RevisionRollout{},
+	}}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			adjustPercentage(tc.goal, tc.prev)
+			if got, want := tc.prev.Revisions, tc.want; !cmp.Equal(got, want) {
+				t.Errorf("Rollout Mistmatch(-want,+got):\n%s", cmp.Diff(want, got))
+			}
+		})
+	}
+}
diff --git a/test/config/100-namespace.yaml b/test/config/100-namespace.yaml
index b1414b416..1fcb556f4 100644
--- a/test/config/100-namespace.yaml
+++ b/test/config/100-namespace.yaml
@@ -24,10 +24,5 @@ metadata:
 ---
 apiVersion: v1
 kind: Namespace
-metadata:
-  name: serving-tests-security
----
-apiVersion: v1
-kind: Namespace
 metadata:
   name: tls
diff --git a/test/config/security/peerauthentication.yaml b/test/config/security/peerauthentication.yaml
deleted file mode 100644
index ab285965a..000000000
--- a/test/config/security/peerauthentication.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright 2019 The Knative Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: "security.istio.io/v1beta1"
-kind: "PeerAuthentication"
-metadata:
-  name: "default"
-  namespace: "istio-system"
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  mtls:
-    mode: STRICT
----
-apiVersion: "security.istio.io/v1beta1"
-kind: "PeerAuthentication"
-metadata:
-  name: "default"
-  namespace: "serving-tests"
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  mtls:
-    mode: STRICT
----
-apiVersion: "security.istio.io/v1beta1"
-kind: "PeerAuthentication"
-metadata:
-  name: "default"
-  namespace: "knative-serving"
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  mtls:
-    mode: PERMISSIVE
diff --git a/test/e2e-common.sh b/test/e2e-common.sh
index 36a4f8885..b1e238095 100644
--- a/test/e2e-common.sh
+++ b/test/e2e-common.sh
@@ -406,8 +406,6 @@ function test_setup() {
   if (( MESH )); then
     kubectl label namespace serving-tests istio-injection=enabled
     kubectl label namespace serving-tests-alt istio-injection=enabled
-    kubectl label namespace serving-tests-security istio-injection=enabled
-    ko apply ${KO_FLAGS} -f ${TEST_CONFIG_DIR}/security/ --selector=test.knative.dev/dependency=istio-sidecar || return 1
   fi
 
   echo ">> Uploading test images..."
@@ -420,6 +418,12 @@ function test_setup() {
   wait_until_ingress_running || return 1
 }
 
+# Apply the logging config for testing. This should be called after test_setup has been triggered.
+function test_logging_config_setup() {
+  echo ">> Setting up test logging config..."
+  ko apply ${KO_FLAGS} -f ${TMP_DIR}/test/config/config/config-logging.yaml || return 1
+}
+
 # Delete test resources
 function test_teardown() {
   local TEST_CONFIG_DIR=${TMP_DIR}/test/config
@@ -433,8 +437,6 @@ function test_teardown() {
   kubectl delete --ignore-not-found --now --timeout 60s namespace serving-tests
   kubectl delete all --all --ignore-not-found --now --timeout 60s -n serving-tests-alt
   kubectl delete --ignore-not-found --now --timeout 60s namespace serving-tests-alt
-  kubectl delete all --all --ignore-not-found --now --timeout 60s -n serving-tests-security
-  kubectl delete --ignore-not-found --now --timeout 60s namespace serving-tests-security
 }
 
 # Dump more information when test fails.
diff --git a/test/e2e-upgrade-tests.sh b/test/e2e-upgrade-tests.sh
index 462e176be..c6d1d43ee 100755
--- a/test/e2e-upgrade-tests.sh
+++ b/test/e2e-upgrade-tests.sh
@@ -53,6 +53,7 @@ function install_latest_release() {
 
   install_knative_serving latest-release \
       || fail_test "Knative latest release installation failed"
+  test_logging_config_setup
   wait_until_pods_running ${SYSTEM_NAMESPACE}
   wait_until_batch_job_complete ${SYSTEM_NAMESPACE}
 }
@@ -60,6 +61,7 @@ function install_latest_release() {
 function install_head() {
   header "Installing Knative head release"
   install_knative_serving || fail_test "Knative head release installation failed"
+  test_logging_config_setup
   wait_until_pods_running ${SYSTEM_NAMESPACE}
   wait_until_batch_job_complete ${SYSTEM_NAMESPACE}
 }
diff --git a/test/e2e/activator_probe_permitted_test.go b/test/e2e/activator_probe_permitted_test.go
deleted file mode 100644
index a1a8cb820..000000000
--- a/test/e2e/activator_probe_permitted_test.go
+++ /dev/null
@@ -1,73 +0,0 @@
-// +build e2e
-
-/*
-Copyright 2020 The Knative Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package e2e
-
-import (
-	"context"
-	"net/http"
-	"testing"
-
-	pkgTest "knative.dev/pkg/test"
-	"knative.dev/serving/test"
-	v1test "knative.dev/serving/test/v1"
-)
-
-//This test checks if the activator can probe
-//the service when istio end user auth policy is
-//applied on the service.
-//This test needs istio side car injected and
-//istio policy check enabled.
-//policy is present in test/config/security/policy.yaml
-//apply policy before running this test
-func TestAllowedProbes(t *testing.T) {
-	t.Parallel()
-
-	clients := SetupServingNamespaceforSecurityTesting(t)
-
-	names := test.ResourceNames{
-		Service: test.ObjectNameForTest(t),
-		Image:   "helloworld",
-	}
-
-	test.EnsureTearDown(t, clients, &names)
-
-	t.Log("Creating a new Service")
-	resources, err := v1test.CreateServiceReady(t, clients, &names)
-	if err != nil {
-		t.Fatalf("Failed to create initial Service: %v: %v", names.Service, err)
-	}
-
-	url := resources.Route.Status.URL.URL()
-	if _, err := pkgTest.WaitForEndpointState(
-		context.Background(),
-		clients.KubeClient,
-		t.Logf,
-		url,
-		v1test.RetryingRouteInconsistency(pkgTest.MatchesAllOf(pkgTest.IsOneOfStatusCodes(http.StatusUnauthorized))),
-		"HelloWorldServesAuthFailed",
-		test.ServingFlags.ResolvableDomain,
-		test.AddRootCAtoTransport(context.Background(), t.Logf, clients, test.ServingFlags.HTTPS),
-	); err != nil {
-		// check if side car is injected before reporting error
-		if _, err := getContainer(clients.KubeClient, resources.Service.Name, "istio-proxy", resources.Service.Namespace); err != nil {
-			t.Skip("Side car not enabled, skipping test")
-		}
-		t.Fatalf("The endpoint %s for Route %s didn't serve the expected status %d: %v", url, names.Route, http.StatusUnauthorized, err)
-	}
-}
diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go
index 22817f92e..02572a22b 100644
--- a/test/e2e/e2e.go
+++ b/test/e2e/e2e.go
@@ -58,12 +58,6 @@ func SetupAlternativeNamespace(t *testing.T) *test.Clients {
 	return SetupWithNamespace(t, test.AlternativeServingNamespace)
 }
 
-//SetupServingNamespaceforSecurityTesting creates the client objects needed in e2e tests
-// under the security testing namespace.
-func SetupServingNamespaceforSecurityTesting(t *testing.T) *test.Clients {
-	return SetupWithNamespace(t, test.ServingNamespaceforSecurityTesting)
-}
-
 // SetupWithNamespace creates the client objects needed in the e2e tests under the specified namespace.
 func SetupWithNamespace(t *testing.T, namespace string) *test.Clients {
 	t.Helper()
diff --git a/test/e2e_constants.go b/test/e2e_constants.go
index b58e1fd93..d1fb41e31 100644
--- a/test/e2e_constants.go
+++ b/test/e2e_constants.go
@@ -28,9 +28,6 @@ const (
 	// namespace tests in.
 	AlternativeServingNamespace = "serving-tests-alt"
 
-	// ServingNamespaceforSecurityTesting is the namespace for security tests.
-	ServingNamespaceforSecurityTesting = "serving-tests-security"
-
 	// TLSNamespace is the namespace for serving tls tests
 	TLSNamespace = "tls"
 
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 713147b08..43bb920b1 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
 webhooks:
   - admissionReviewVersions:
       - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,7 +168,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20201109-859a9fd"
+        serving.knative.dev/release: "v20201110-859a9fd"
     spec:
       serviceAccountName: controller
       containers:
@@ -213,7 +213,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -250,7 +250,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
 spec:
   selector:
     matchLabels:
@@ -263,7 +263,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20201109-859a9fd"
+        serving.knative.dev/release: "v20201110-859a9fd"
     spec:
       serviceAccountName: controller
       containers:
@@ -329,7 +329,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20201109-859a9fd"
+    serving.knative.dev/release: "v20201110-859a9fd"
 spec:
   ports:
     # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 530d67fc2..00330d23c 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -34,7 +34,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: contour
-    serving.knative.dev/release: "v20201109-2ae0c66f"
+    serving.knative.dev/release: "v20201110-2ae0c66f"
 data:
   _example: |
     ################################
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 4da5c7516..5700608d6 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: cluster-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -125,7 +125,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -145,7 +145,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -160,7 +160,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -189,7 +189,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -225,7 +225,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -263,7 +263,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -287,7 +287,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -357,7 +357,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -373,7 +373,7 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20201109-40b59920"
+        serving.knative.dev/release: "v20201110-40b59920"
     spec:
       serviceAccountName: controller
       containers:
@@ -437,7 +437,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -451,7 +451,7 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20201109-40b59920"
+        serving.knative.dev/release: "v20201110-40b59920"
     spec:
       serviceAccountName: controller
       containers:
@@ -512,7 +512,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20201109-40b59920"
+    serving.knative.dev/release: "v20201110-40b59920"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index cb79663b3..c0b798f01 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -117,7 +117,7 @@ spec:
         app: 3scale-kourier-control
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:435b6f43a21b412e25aeac5206a304444189d1b7507150abb5f4de942f6a81b1
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:c54e716803231005fd3d4b946013d139e5c5ac7d9921924efb41974a25eb9cc0
           name: kourier-control
           env:
             - name: CERTS_SECRET_NAMESPACE