Repository: knative-sandbox/net-kourier
Pull request #332 (2020-11-04 12:18:35)

Reduce unnecessary RBAC rules
I don't think we ever update or create ConfigMaps, nor do we need to do anything with CRDs or Namespaces, I believe.

knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/332#" title="Author self-approved">markusthoemmes</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/master/OWNERS)~~ [markusthoemmes]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=h1) Report
> Merging [#332](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=desc) into [master](https://codecov.io/gh/knative-sandbox/net-kourier/commit/0b3d2897a373bff8b4f9ce2ee811b0792bd00ca1?el=desc) will **increase** coverage by `1.74%`.
> The diff coverage is `90.90%`.

[![Impacted file tree graph](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332/graphs/tree.svg?width=650&height=150&src=pr&token=KmlRo23zX4)](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #332      +/-   ##
==========================================
+ Coverage   68.18%   69.92%   +1.74%     
==========================================
  Files          15       13       -2     
  Lines         572      552      -20     
==========================================
- Hits          390      386       -4     
+ Misses        154      138      -16     
  Partials       28       28              
```


| [Impacted Files](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/generator/ingress\_translator.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332/diff?src=pr&el=tree#diff-cGtnL2dlbmVyYXRvci9pbmdyZXNzX3RyYW5zbGF0b3IuZ28=) | `67.25% <83.33%> (+0.58%)` | :arrow_up: |
| [pkg/envoy/api/listener.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332/diff?src=pr&el=tree#diff-cGtnL2Vudm95L2FwaS9saXN0ZW5lci5nbw==) | `81.05% <100.00%> (ø)` | |
| [pkg/generator/generator.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332/diff?src=pr&el=tree#diff-cGtnL2dlbmVyYXRvci9nZW5lcmF0b3IuZ28=) | `47.76% <100.00%> (-1.52%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=footer). Last update [0b3d289...53201df](https://codecov.io/gh/knative-sandbox/net-kourier/pull/332?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

davidor: Namespaces and configmaps were added to avoid some errors/warnings that don't make the tests fail: https://github.com/knative-sandbox/net-kourier/pull/132
Not sure if that has changed.

Patch:
diff --git a/.github/workflows/knative-releasability.yaml b/.github/workflows/knative-releasability.yaml
index 43f864dd..f13cc479 100644
--- a/.github/workflows/knative-releasability.yaml
+++ b/.github/workflows/knative-releasability.yaml
@@ -104,8 +104,25 @@ jobs:
       - name: Verify
         if: steps.exists.outputs.release-branch == 'false' && env.current == 'true'
         run: |
+          # If we don't run `git status` before the "git diff-index" it seems
+          # to list every file that's been touched by codegen.
+          git status
+          FOUND_DIFF=0
+          for x in $(git diff-index --name-only HEAD --); do
+            if [ "$(basename $x)" = "go.mod" ]; then
+              continue
+            elif [ "$(basename $x)" = "go.sum" ]; then
+              continue
+            elif [ "$(basename $x)" = "modules.txt" ]; then
+              continue
+            fi
+            echo "Found non-module diff: $x"
+            FOUND_DIFF=1
+            break
+          done
+
           # If we see no changes after the upgrade, then we are up to date.
-          if [[ -z "$(git status --porcelain)" ]]; then
+          if [[ "$FOUND_DIFF" -eq "0"  ]]; then
               echo "VERIFY_MESSAGE=${{ github.repository }} up to date." >> $GITHUB_ENV
           else
               echo "VERIFY_MESSAGE=${{ github.repository }} is out of date." >> $GITHUB_ENV
diff --git a/config/200-serviceaccount.yaml b/config/200-serviceaccount.yaml
index 8a0824fa..2d4d8c7e 100644
--- a/config/200-serviceaccount.yaml
+++ b/config/200-serviceaccount.yaml
@@ -30,13 +30,13 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["events"]
-    verbs: ["create","update","patch"]
+    verbs: ["create", "update", "patch"]
   - apiGroups: [""]
-    resources: ["pods", "endpoints", "namespaces", "services", "secrets"]
+    resources: ["pods", "endpoints", "services", "secrets"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["configmaps"]
-    verbs: ["get", "list", "watch", "update","create"]
+    verbs: ["get", "list", "watch"]
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
     verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
@@ -46,9 +46,6 @@ rules:
   - apiGroups: ["networking.internal.knative.dev"]
     resources: ["ingresses/status"]
     verbs: ["update"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
diff --git a/pkg/envoy/api/http_connection_manager.go b/pkg/envoy/api/http_connection_manager.go
index b9eaffb8..7cb0ee9e 100644
--- a/pkg/envoy/api/http_connection_manager.go
+++ b/pkg/envoy/api/http_connection_manager.go
@@ -30,7 +30,6 @@ import (
 )
 
 func NewHTTPConnectionManager(virtualHosts []*route.VirtualHost) httpconnectionmanagerv2.HttpConnectionManager {
-
 	var filters []*httpconnectionmanagerv2.HttpFilter
 
 	if config.ExternalAuthz.Enabled {
@@ -80,14 +79,12 @@ func accessLogs() []*envoy_accesslog_v2.AccessLog {
 		Path: "/dev/stdout",
 	})
 
-	return []*envoy_accesslog_v2.AccessLog{
-		{
-			Name: "envoy.file_access_log",
-			ConfigType: &envoy_accesslog_v2.AccessLog_TypedConfig{
-				TypedConfig: accessLog,
-			},
+	return []*envoy_accesslog_v2.AccessLog{{
+		Name: "envoy.file_access_log",
+		ConfigType: &envoy_accesslog_v2.AccessLog_TypedConfig{
+			TypedConfig: accessLog,
 		},
-	}
+	}}
 }
 
 // Returns a copy of the HttpConnectionManager received in the params changing
diff --git a/pkg/envoy/api/listener.go b/pkg/envoy/api/listener.go
index ebd6e2b4..02600391 100644
--- a/pkg/envoy/api/listener.go
+++ b/pkg/envoy/api/listener.go
@@ -48,17 +48,13 @@ func NewHTTPListener(manager *httpconnmanagerv2.HttpConnectionManager, port uint
 		return nil, err
 	}
 
-	envoyListener := &v2.Listener{
+	return &v2.Listener{
 		Name:    fmt.Sprintf("listener_%d", port),
 		Address: createAddress(port),
-		FilterChains: []*listener.FilterChain{
-			{
-				Filters: filters,
-			},
-		},
-	}
-
-	return envoyListener, nil
+		FilterChains: []*listener.FilterChain{{
+			Filters: filters,
+		}},
+	}, nil
 }
 
 func NewHTTPSListener(manager *httpconnmanagerv2.HttpConnectionManager,
@@ -77,21 +73,17 @@ func NewHTTPSListener(manager *httpconnmanagerv2.HttpConnectionManager,
 		return nil, err
 	}
 
-	envoyListener := v2.Listener{
+	return &v2.Listener{
 		Name:    fmt.Sprintf("listener_%d", port),
 		Address: createAddress(port),
-		FilterChains: []*listener.FilterChain{
-			{
-				Filters: filters,
-				TransportSocket: &core.TransportSocket{
-					Name:       "tls",
-					ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: tlsAny},
-				},
+		FilterChains: []*listener.FilterChain{{
+			Filters: filters,
+			TransportSocket: &core.TransportSocket{
+				Name:       "tls",
+				ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: tlsAny},
 			},
-		},
-	}
-
-	return &envoyListener, nil
+		}},
+	}, nil
 }
 
 // Configures a Listener with SNI.
@@ -102,21 +94,17 @@ func NewHTTPSListenerWithSNI(manager *httpconnmanagerv2.HttpConnectionManager, p
 		return nil, err
 	}
 
-	envoyListener := v2.Listener{
+	return &v2.Listener{
 		Name:         fmt.Sprintf("listener_%d", port),
 		Address:      createAddress(port),
 		FilterChains: filterChains,
-		ListenerFilters: []*listener.ListenerFilter{
-			{
-				// TLS Inspector listener filter must be configured in order to
-				// detect requested SNI.
-				// Ref: https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni.html
-				Name: wellknown.TlsInspector,
-			},
-		},
-	}
-
-	return &envoyListener, nil
+		ListenerFilters: []*listener.ListenerFilter{{
+			// TLS Inspector listener filter must be configured in order to
+			// detect requested SNI.
+			// Ref: https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni.html
+			Name: wellknown.TlsInspector,
+		}},
+	}, nil
 }
 
 func createAddress(port uint32) *core.Address {
@@ -139,14 +127,10 @@ func createFilters(manager *httpconnmanagerv2.HttpConnectionManager) ([]*listene
 		return []*listener.Filter{}, err
 	}
 
-	filters := []*listener.Filter{
-		{
-			Name:       wellknown.HTTPConnectionManager,
-			ConfigType: &listener.Filter_TypedConfig{TypedConfig: managerAny},
-		},
-	}
-
-	return filters, nil
+	return []*listener.Filter{{
+		Name:       wellknown.HTTPConnectionManager,
+		ConfigType: &listener.Filter_TypedConfig{TypedConfig: managerAny},
+	}}, nil
 }
 
 func createFilterChainsForTLS(manager *httpconnmanagerv2.HttpConnectionManager, sniMatches []*SNIMatch) ([]*listener.FilterChain, error) {
@@ -187,16 +171,14 @@ func createFilterChainsForTLS(manager *httpconnmanagerv2.HttpConnectionManager,
 func createTLSContext(certificate []byte, privateKey []byte) *auth.DownstreamTlsContext {
 	return &auth.DownstreamTlsContext{
 		CommonTlsContext: &auth.CommonTlsContext{
-			TlsCertificates: []*auth.TlsCertificate{
-				{
-					CertificateChain: &core.DataSource{
-						Specifier: &core.DataSource_InlineBytes{InlineBytes: certificate},
-					},
-					PrivateKey: &core.DataSource{
-						Specifier: &core.DataSource_InlineBytes{InlineBytes: privateKey},
-					},
+			TlsCertificates: []*auth.TlsCertificate{{
+				CertificateChain: &core.DataSource{
+					Specifier: &core.DataSource_InlineBytes{InlineBytes: certificate},
 				},
-			},
+				PrivateKey: &core.DataSource{
+					Specifier: &core.DataSource_InlineBytes{InlineBytes: privateKey},
+				},
+			}},
 		},
 	}
 }
diff --git a/pkg/envoy/api/route.go b/pkg/envoy/api/route.go
index 30f5fe15..acd271a5 100644
--- a/pkg/envoy/api/route.go
+++ b/pkg/envoy/api/route.go
@@ -40,18 +40,20 @@ func NewRoute(name string,
 			},
 			Headers: headersMatch,
 		},
-		Action: &route.Route_Route{Route: &route.RouteAction{
-			ClusterSpecifier: &route.RouteAction_WeightedClusters{
-				WeightedClusters: &route.WeightedCluster{
-					Clusters: wrs,
+		Action: &route.Route_Route{
+			Route: &route.RouteAction{
+				ClusterSpecifier: &route.RouteAction_WeightedClusters{
+					WeightedClusters: &route.WeightedCluster{
+						Clusters: wrs,
+					},
 				},
+				Timeout: ptypes.DurationProto(routeTimeout),
+				UpgradeConfigs: []*route.RouteAction_UpgradeConfig{{
+					UpgradeType: "websocket",
+					Enabled:     &wrappers.BoolValue{Value: true},
+				}},
 			},
-			Timeout: ptypes.DurationProto(routeTimeout),
-			UpgradeConfigs: []*route.RouteAction_UpgradeConfig{{
-				UpgradeType: "websocket",
-				Enabled:     &wrappers.BoolValue{Value: true},
-			}},
-		}},
+		},
 		RequestHeadersToAdd: headersToAdd(headers),
 	}
 }
diff --git a/pkg/envoy/api/virtual_host.go b/pkg/envoy/api/virtual_host.go
index a37078e3..918fda86 100644
--- a/pkg/envoy/api/virtual_host.go
+++ b/pkg/envoy/api/virtual_host.go
@@ -32,7 +32,10 @@ func NewVirtualHost(name string, domains []string, routes []*route.Route) *route
 	}
 }
 
-func NewVirtualHostWithExtAuthz(name string, contextExtensions map[string]string, domains []string,
+func NewVirtualHostWithExtAuthz(
+	name string,
+	contextExtensions map[string]string,
+	domains []string,
 	routes []*route.Route) *route.VirtualHost {
 
 	perFilterConfig := extAuthService.ExtAuthzPerRoute{
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index aa97d6fb..464e707b 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -27,7 +27,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
-	kubeclient "k8s.io/client-go/kubernetes"
 	envoy "knative.dev/net-kourier/pkg/envoy/api"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	"knative.dev/pkg/kmeta"
@@ -44,19 +43,19 @@ type translatedIngress struct {
 }
 
 type IngressTranslator struct {
-	kubeclient      kubeclient.Interface
+	secretGetter    func(ns, name string) (*corev1.Secret, error)
 	endpointsGetter func(ns, name string) (*corev1.Endpoints, error)
 	serviceGetter   func(ns, name string) (*corev1.Service, error)
 	tracker         tracker.Interface
 }
 
 func NewIngressTranslator(
-	kubeclient kubeclient.Interface,
+	secretGetter func(ns, name string) (*corev1.Secret, error),
 	endpointsGetter func(ns, name string) (*corev1.Endpoints, error),
 	serviceGetter func(ns, name string) (*corev1.Service, error),
 	tracker tracker.Interface) IngressTranslator {
 	return IngressTranslator{
-		kubeclient:      kubeclient,
+		secretGetter:    secretGetter,
 		endpointsGetter: endpointsGetter,
 		serviceGetter:   serviceGetter,
 		tracker:         tracker,
@@ -68,18 +67,17 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 
 	sniMatches := make([]*envoy.SNIMatch, 0, len(ingress.Spec.TLS))
 	for _, ingressTLS := range ingress.Spec.TLS {
-		sniMatch, err := sniMatchFromIngressTLS(ctx, ingressTLS, translator.kubeclient)
+		if err := trackSecret(translator.tracker, ingressTLS.SecretNamespace, ingressTLS.SecretName, ingress); err != nil {
+			return nil, err
+		}
+
+		secret, err := translator.secretGetter(ingressTLS.SecretNamespace, ingressTLS.SecretName)
 		if err != nil {
-			// We need to propagate this error to the reconciler so the current
-			// event can be retried. This error might be caused because the
-			// secrets referenced in the TLS section of the spec do not exist
-			// yet. That's expected when auto TLS is configured.
-			// See the "TestPerKsvcCert_localCA" test in Knative Serving. It's a
-			// test that fails if this error is not propagated:
-			// https://github.com/knative/serving/blob/571e4db2392839082c559870ea8d4b72ef61e59d/test/e2e/autotls/auto_tls_test.go#L68
-			return nil, fmt.Errorf("failed to get sniMatch: %w", err)
+			return nil, fmt.Errorf("failed to fetch secret: %w", err)
 		}
-		sniMatches = append(sniMatches, sniMatch)
+
+		sniMatch := envoy.NewSNIMatch(ingressTLS.Hosts, secret.Data[certFieldInSecret], secret.Data[keyFieldInSecret])
+		sniMatches = append(sniMatches, &sniMatch)
 	}
 
 	internalHosts := make([]*route.VirtualHost, 0, len(ingress.Spec.Rules))
@@ -183,6 +181,15 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 	}, nil
 }
 
+func trackSecret(t tracker.Interface, ns, name string, ingress *v1alpha1.Ingress) error {
+	return t.TrackReference(tracker.Reference{
+		Kind:       "Secret",
+		APIVersion: "v1",
+		Namespace:  ns,
+		Name:       name,
+	}, ingress)
+}
+
 func trackService(t tracker.Interface, svcName string, ingress *v1alpha1.Ingress) error {
 	if err := t.TrackReference(tracker.Reference{
 		Kind:       "Service",
@@ -241,19 +248,6 @@ func matchHeadersFromHTTPPath(httpPath v1alpha1.HTTPIngressPath) []*route.Header
 	return matchHeaders
 }
 
-func sniMatchFromIngressTLS(ctx context.Context, ingressTLS v1alpha1.IngressTLS, kubeClient kubeclient.Interface) (*envoy.SNIMatch, error) {
-	certChain, privateKey, err := sslCreds(
-		ctx, kubeClient, ingressTLS.SecretNamespace, ingressTLS.SecretName,
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	sniMatch := envoy.NewSNIMatch(ingressTLS.Hosts, certChain, privateKey)
-	return &sniMatch, nil
-}
-
 // domainsForRule returns all domains for the given rule.
 //
 // For example, external domains returns domains with the following formats:
diff --git a/pkg/reconciler/ingress/controller.go b/pkg/reconciler/ingress/controller.go
index 640a0eb0..edd8b855 100644
--- a/pkg/reconciler/ingress/controller.go
+++ b/pkg/reconciler/ingress/controller.go
@@ -38,6 +38,7 @@ import (
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
 	endpointsinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/endpoints"
 	podinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/pod"
+	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 	serviceinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/service"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
@@ -67,6 +68,7 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 	endpointsInformer := endpointsinformer.Get(ctx)
 	serviceInformer := serviceinformer.Get(ctx)
 	podInformer := podinformer.Get(ctx)
+	secretInformer := secretinformer.Get(ctx)
 
 	// Create a new Cache, with the Readiness endpoint enabled, and the list of current Ingresses.
 	caches, err := generator.NewCaches(ctx, kubernetesClient, config.ExternalAuthz.Enabled)
@@ -114,7 +116,9 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 	tracker := tracker.New(impl.EnqueueKey, controller.GetTrackerLease(ctx))
 
 	ingressTranslator := generator.NewIngressTranslator(
-		kubernetesClient,
+		func(ns, name string) (*corev1.Secret, error) {
+			return secretInformer.Lister().Secrets(ns).Get(name)
+		},
 		func(ns, name string) (*corev1.Endpoints, error) {
 			return endpointsInformer.Lister().Endpoints(ns).Get(name)
 		},
@@ -144,7 +148,9 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 	// The startup translator uses clients instead of listeners to correctly list all
 	// resources at startup.
 	startupTranslator := generator.NewIngressTranslator(
-		kubernetesClient,
+		func(ns, name string) (*corev1.Secret, error) {
+			return kubernetesClient.CoreV1().Secrets(ns).Get(ctx, name, metav1.GetOptions{})
+		},
 		func(ns, name string) (*corev1.Endpoints, error) {
 			return kubernetesClient.CoreV1().Endpoints(ns).Get(ctx, name, metav1.GetOptions{})
 		},
@@ -193,6 +199,13 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 		),
 	))
 
+	secretInformer.Informer().AddEventHandler(controller.HandleAll(
+		controller.EnsureTypeMeta(
+			tracker.OnChanged,
+			corev1.SchemeGroupVersion.WithKind("Secrets"),
+		),
+	))
+
 	podInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
 		FilterFunc: knativeReconciler.LabelFilterFunc(gatewayLabelKey, gatewayLabelValue, false),
 		Handler: cache.ResourceEventHandlerFuncs{
diff --git a/pkg/reconciler/ingress/lister.go b/pkg/reconciler/ingress/lister.go
index 4dbdc33e..e788ff25 100644
--- a/pkg/reconciler/ingress/lister.go
+++ b/pkg/reconciler/ingress/lister.go
@@ -43,7 +43,6 @@ type gatewayPodTargetLister struct {
 }
 
 func (l *gatewayPodTargetLister) ListProbeTargets(ctx context.Context, ing *v1alpha1.Ingress) ([]status.ProbeTarget, error) {
-
 	eps, err := l.endpointsLister.Endpoints(config.GatewayNamespace()).Get(config.InternalServiceName)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get internal service: %w", err)
diff --git a/vendor/knative.dev/pkg/client/injection/kube/informers/core/v1/secret/secret.go b/vendor/knative.dev/pkg/client/injection/kube/informers/core/v1/secret/secret.go
new file mode 100644
index 00000000..5442d08b
--- /dev/null
+++ b/vendor/knative.dev/pkg/client/injection/kube/informers/core/v1/secret/secret.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2020 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by injection-gen. DO NOT EDIT.
+
+package secret
+
+import (
+	context "context"
+
+	v1 "k8s.io/client-go/informers/core/v1"
+	factory "knative.dev/pkg/client/injection/kube/informers/factory"
+	controller "knative.dev/pkg/controller"
+	injection "knative.dev/pkg/injection"
+	logging "knative.dev/pkg/logging"
+)
+
+func init() {
+	injection.Default.RegisterInformer(withInformer)
+}
+
+// Key is used for associating the Informer inside the context.Context.
+type Key struct{}
+
+func withInformer(ctx context.Context) (context.Context, controller.Informer) {
+	f := factory.Get(ctx)
+	inf := f.Core().V1().Secrets()
+	return context.WithValue(ctx, Key{}, inf), inf.Informer()
+}
+
+// Get extracts the typed informer from the context.
+func Get(ctx context.Context) v1.SecretInformer {
+	untyped := ctx.Value(Key{})
+	if untyped == nil {
+		logging.FromContext(ctx).Panic(
+			"Unable to fetch k8s.io/client-go/informers/core/v1.SecretInformer from context.")
+	}
+	return untyped.(v1.SecretInformer)
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c2fe0059..df7e1c5b 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -786,6 +786,7 @@ knative.dev/pkg/changeset
 knative.dev/pkg/client/injection/kube/client
 knative.dev/pkg/client/injection/kube/informers/core/v1/endpoints
 knative.dev/pkg/client/injection/kube/informers/core/v1/pod
+knative.dev/pkg/client/injection/kube/informers/core/v1/secret
 knative.dev/pkg/client/injection/kube/informers/core/v1/service
 knative.dev/pkg/client/injection/kube/informers/factory
 knative.dev/pkg/configmap


Test patch:
diff --git a/pkg/envoy/api/http_connection_manager_test.go b/pkg/envoy/api/http_connection_manager_test.go
index e9282fb2..82e35a08 100644
--- a/pkg/envoy/api/http_connection_manager_test.go
+++ b/pkg/envoy/api/http_connection_manager_test.go
@@ -27,17 +27,15 @@ import (
 	"gotest.tools/assert"
 )
 
-var testVirtualHosts = []*route.VirtualHost{
-	{
-		Name:    "helloworld-go",
-		Domains: []string{"helloworld-go.default.127.0.0.1.nip.io"},
-		Routes: []*route.Route{
-			{
-				Name: "helloworld-route",
-			},
+var testVirtualHosts = []*route.VirtualHost{{
+	Name:    "helloworld-go",
+	Domains: []string{"helloworld-go.default.127.0.0.1.nip.io"},
+	Routes: []*route.Route{
+		{
+			Name: "helloworld-route",
 		},
 	},
-}
+}}
 
 func TestCreatesManagerWithVirtualHosts(t *testing.T) {
 	connManager := NewHTTPConnectionManager(testVirtualHosts)
diff --git a/pkg/envoy/api/listener_test.go b/pkg/envoy/api/listener_test.go
index 9b7e5574..f7a7e241 100644
--- a/pkg/envoy/api/listener_test.go
+++ b/pkg/envoy/api/listener_test.go
@@ -70,18 +70,15 @@ func TestNewHTTPSListener(t *testing.T) {
 }
 
 func TestNewHTTPSListenerWithSNI(t *testing.T) {
-	sniMatches := []*SNIMatch{
-		{
-			hosts:            []string{"some_host.com"},
-			certificateChain: []byte("cert1"),
-			privateKey:       []byte("key1"),
-		},
-		{
-			hosts:            []string{"another_host.com"},
-			certificateChain: []byte("cert2"),
-			privateKey:       []byte("key2"),
-		},
-	}
+	sniMatches := []*SNIMatch{{
+		hosts:            []string{"some_host.com"},
+		certificateChain: []byte("cert1"),
+		privateKey:       []byte("key1"),
+	}, {
+		hosts:            []string{"another_host.com"},
+		certificateChain: []byte("cert2"),
+		privateKey:       []byte("key2"),
+	}}
 
 	vHost1 := NewVirtualHost(
 		"vHost1", []string{"some_host.com", "some_host.com:*"}, []*route.Route{},
diff --git a/pkg/envoy/api/route_test.go b/pkg/envoy/api/route_test.go
index 79bcab8d..0a11dc46 100644
--- a/pkg/envoy/api/route_test.go
+++ b/pkg/envoy/api/route_test.go
@@ -25,17 +25,14 @@ import (
 )
 
 func TestNewRouteHeaderMatch(t *testing.T) {
-
 	name := "testRoute_12345"
 	path := "/my_route"
-	headerMatch := []*envoy_api_v2_route.HeaderMatcher{
-		{
-			Name: "myHeader",
-			HeaderMatchSpecifier: &envoy_api_v2_route.HeaderMatcher_ExactMatch{
-				ExactMatch: "strict",
-			},
+	headerMatch := []*envoy_api_v2_route.HeaderMatcher{{
+		Name: "myHeader",
+		HeaderMatchSpecifier: &envoy_api_v2_route.HeaderMatcher_ExactMatch{
+			ExactMatch: "strict",
 		},
-	}
+	}}
 	AppendHeaders := map[string]string{}
 	var wrs []*envoy_api_v2_route.WeightedCluster_ClusterWeight
 
@@ -46,7 +43,6 @@ func TestNewRouteHeaderMatch(t *testing.T) {
 }
 
 func TestNewRouteStatusOK(t *testing.T) {
-
 	name := "testRoute_12345"
 	path := "/my_route"
 
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index a1f3d7cb..acb99707 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -57,48 +57,41 @@ func TestTrafficSplits(t *testing.T) {
 			Name: "hello-world",
 		},
 		Spec: v1alpha1.IngressSpec{
-			Rules: []v1alpha1.IngressRule{
-				{
-					HTTP: &v1alpha1.HTTPIngressRuleValue{
-						Paths: []v1alpha1.HTTPIngressPath{
-							{
-								Splits: []v1alpha1.IngressBackendSplit{
-									{
-										IngressBackend: v1alpha1.IngressBackend{
-											ServiceNamespace: "default",
-											ServiceName:      "hello-world-rev1",
-											ServicePort: intstr.IntOrString{
-												Type:   intstr.Int,
-												IntVal: 80,
-											},
-										},
-										Percent: 60,
-										AppendHeaders: map[string]string{
-											"Knative-Serving-Namespace": "default",
-											"Knative-Serving-Revision":  "hello-world-rev1",
-										},
-									},
-									{
-										IngressBackend: v1alpha1.IngressBackend{
-											ServiceNamespace: "default",
-											ServiceName:      "hello-world-rev2",
-											ServicePort: intstr.IntOrString{
-												Type:   intstr.Int,
-												IntVal: 80,
-											},
-										},
-										Percent: 40,
-										AppendHeaders: map[string]string{
-											"Knative-Serving-Namespace": "default",
-											"Knative-Serving-Revision":  "hello-world-rev2",
-										},
-									},
+			Rules: []v1alpha1.IngressRule{{
+				HTTP: &v1alpha1.HTTPIngressRuleValue{
+					Paths: []v1alpha1.HTTPIngressPath{{
+						Splits: []v1alpha1.IngressBackendSplit{{
+							IngressBackend: v1alpha1.IngressBackend{
+								ServiceNamespace: "default",
+								ServiceName:      "hello-world-rev1",
+								ServicePort: intstr.IntOrString{
+									Type:   intstr.Int,
+									IntVal: 80,
 								},
 							},
-						},
-					},
+							Percent: 60,
+							AppendHeaders: map[string]string{
+								"Knative-Serving-Namespace": "default",
+								"Knative-Serving-Revision":  "hello-world-rev1",
+							},
+						}, {
+							IngressBackend: v1alpha1.IngressBackend{
+								ServiceNamespace: "default",
+								ServiceName:      "hello-world-rev2",
+								ServicePort: intstr.IntOrString{
+									Type:   intstr.Int,
+									IntVal: 80,
+								},
+							},
+							Percent: 40,
+							AppendHeaders: map[string]string{
+								"Knative-Serving-Namespace": "default",
+								"Knative-Serving-Revision":  "hello-world-rev2",
+							},
+						}},
+					}},
 				},
-			},
+			}},
 		},
 		Status: v1alpha1.IngressStatus{},
 	}
@@ -117,7 +110,7 @@ func TestTrafficSplits(t *testing.T) {
 	}
 
 	ingressTranslator := NewIngressTranslator(
-		kubeClient, mockedEndpointsGetter, mockedServiceGetter, &pkgtest.FakeTracker{})
+		mockedSecretGetter, mockedEndpointsGetter, mockedServiceGetter, &pkgtest.FakeTracker{})
 
 	ingressTranslation, err := ingressTranslator.translateIngress(ctx, &ingress, false)
 	if err != nil {
@@ -197,7 +190,7 @@ func TestIngressVisibility(t *testing.T) {
 			}
 
 			ingressTranslator := NewIngressTranslator(
-				kubeClient, mockedEndpointsGetter, mockedServiceGetter, &pkgtest.FakeTracker{})
+				mockedSecretGetter, mockedEndpointsGetter, mockedServiceGetter, &pkgtest.FakeTracker{})
 
 			translatedIngress, err := ingressTranslator.translateIngress(ctx, ingress, false)
 			if err != nil {
@@ -245,13 +238,22 @@ func TestIngressWithTLS(t *testing.T) {
 	}
 
 	// Create secret with TLS data
-	err := createSecret(ctx, kubeClient, tlsSecretNamespace, tlsSecretName, tlsCert, tlsKey)
-	if err != nil {
-		t.Error(err)
+	tlsSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: tlsSecretName,
+		},
+		Data: map[string][]byte{
+			certFieldInSecret: tlsCert,
+			keyFieldInSecret:  tlsKey,
+		},
 	}
-
 	ingressTranslator := NewIngressTranslator(
-		kubeClient, mockedEndpointsGetter, mockedServiceGetter, &pkgtest.FakeTracker{})
+		func(ns, name string) (*corev1.Secret, error) {
+			return tlsSecret, nil
+		},
+		mockedEndpointsGetter,
+		mockedServiceGetter,
+		&pkgtest.FakeTracker{})
 
 	translatedIngress, err := ingressTranslator.translateIngress(ctx, ingress, false)
 	if err != nil {
@@ -285,11 +287,20 @@ func TestReturnsErrorWhenTLSSecretDoesNotExist(t *testing.T) {
 	}
 
 	ingressTranslator := NewIngressTranslator(
-		kubeClient, mockedEndpointsGetter, mockedServiceGetter, &pkgtest.FakeTracker{})
+		func(ns, name string) (*corev1.Secret, error) {
+			return nil, fmt.Errorf("secrets %q not found", name)
+		},
+		mockedEndpointsGetter,
+		mockedServiceGetter,
+		&pkgtest.FakeTracker{})
 
 	_, err := ingressTranslator.translateIngress(ctx, ingress, false)
 
-	assert.Error(t, err, fmt.Sprintf("failed to get sniMatch: secrets \"%s\" not found", tlsSecretName))
+	assert.Error(t, err, fmt.Sprintf("failed to fetch secret: secrets %q not found", tlsSecretName))
+}
+
+var mockedSecretGetter = func(ns, name string) (*corev1.Secret, error) {
+	return &corev1.Secret{}, nil
 }
 
 var mockedEndpointsGetter = func(ns, name string) (*corev1.Endpoints, error) {
@@ -344,54 +355,33 @@ func createIngressWithTLS(hosts []string, secretName string, secretNamespace str
 				SecretName:      secretName,
 				SecretNamespace: secretNamespace,
 			}},
-			Rules: []v1alpha1.IngressRule{
-				{
-					Visibility: v1alpha1.IngressVisibilityExternalIP,
-					HTTP: &v1alpha1.HTTPIngressRuleValue{
-						Paths: []v1alpha1.HTTPIngressPath{
-							{
-								Splits: []v1alpha1.IngressBackendSplit{
-									{
-										IngressBackend: v1alpha1.IngressBackend{
-											ServiceNamespace: svcNamespace,
-											ServiceName:      "hello-world",
-											ServicePort: intstr.IntOrString{
-												Type:   intstr.Int,
-												IntVal: 80,
-											},
-										},
-										AppendHeaders: map[string]string{
-											"Knative-Serving-Namespace": svcNamespace,
-											"Knative-Serving-Revision":  "hello-world",
-										},
-									},
+			Rules: []v1alpha1.IngressRule{{
+				Visibility: v1alpha1.IngressVisibilityExternalIP,
+				HTTP: &v1alpha1.HTTPIngressRuleValue{
+					Paths: []v1alpha1.HTTPIngressPath{{
+						Splits: []v1alpha1.IngressBackendSplit{{
+							IngressBackend: v1alpha1.IngressBackend{
+								ServiceNamespace: svcNamespace,
+								ServiceName:      "hello-world",
+								ServicePort: intstr.IntOrString{
+									Type:   intstr.Int,
+									IntVal: 80,
 								},
 							},
-						},
-					},
+							AppendHeaders: map[string]string{
+								"Knative-Serving-Namespace": svcNamespace,
+								"Knative-Serving-Revision":  "hello-world",
+							},
+						}},
+					}},
 				},
-			},
+			}},
 		},
 		Status: v1alpha1.IngressStatus{},
 	}
 
 }
 
-func createSecret(ctx context.Context, kubeClient kubernetes.Interface, secretNamespace string, secretName string, cert []byte, key []byte) error {
-	tlsSecret := corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: secretName,
-		},
-		Data: map[string][]byte{
-			certFieldInSecret: cert,
-			keyFieldInSecret:  key,
-		},
-	}
-
-	_, err := kubeClient.CoreV1().Secrets(secretNamespace).Create(ctx, &tlsSecret, metav1.CreateOptions{})
-	return err
-}
-
 func createServicesWithNames(ctx context.Context, kubeclient kubernetes.Interface, names []string, namespace string) error {
 	for _, serviceName := range names {
 		service := corev1.Service{