Repository: knative-sandbox/net-kourier
Pull request #949 (2022-11-09 21:35:37)

Use new key names for internal encryption secret
<!-- Thanks for sending a pull request! -->

# Changes
:broom: Update or clean up current behavior
- New key names were added in https://github.com/knative-sandbox/control-protocol/pull/220
- Knative Serving was updated to use these new key names in https://github.com/knative/serving/pull/13388

<!--
In addition, categorize the changes you're making using the "/kind" Prow command, example:

/kind cleanup
Supported kinds are: api-change, bug, cleanup, deprecation, removal, documentation, enhancement, performance

-->
/kind cleanup

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #

<!-- Please include the 'why' behind your changes if no issue exists -->

**Release Note**

<!--
:page_facing_up: If this change has user-visible impact, write a release note in the block
below. Include the string "action required" if additional action is required of
users switching to the new release, for example in case of a breaking change.

Write as if you are speaking to users, not other Knative contributors. If this
change has no user-visible impact, no release-note is needed.
-->
```release-note
N/A
```

**Docs**

<!--
:book: If this change has user-visible impact, link to an issue or PR in
https://github.com/knative/docs.

See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files

Please use the following format for linking documentation:
- [knative/docs]: <issue or pr link>
- [Feature Track]: <link>
- [Usage]: <link>
- [Other doc]: <link>
-->
```docs
N/A
```


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/949#" title="Author self-approved">KauzClay</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign nak3 for approval by writing `/assign @nak3` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["nak3"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/949?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#949](https://codecov.io/gh/knative-sandbox/net-kourier/pull/949?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (052d056) into [main](https://codecov.io/gh/knative-sandbox/net-kourier/commit/d80b785e341bdba83d8ace80f19099179716233a?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (d80b785) will **not change** coverage.
> The diff coverage is `100.00%`.

```diff
@@           Coverage Diff           @@
##             main     #949   +/-   ##
=======================================
  Coverage   80.93%   80.93%           
=======================================
  Files          18       18           
  Lines        1243     1243           
=======================================
  Hits         1006     1006           
  Misses        190      190           
  Partials       47       47           
```


| [Impacted Files](https://codecov.io/gh/knative-sandbox/net-kourier/pull/949?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) | Coverage Δ | |
|---|---|---|
| [pkg/generator/ingress\_translator.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/949/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-cGtnL2dlbmVyYXRvci9pbmdyZXNzX3RyYW5zbGF0b3IuZ28=) | `82.53% <100.00%> (ø)` | |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)

dprotaso: Can you run `./hack/update-codegen.sh` but with go1.19 ?
knative-prow[bot]: @KauzClay: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | 6f8ae46368da7f800a8834eea6791365f30c57c7 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/949/unit-tests_net-kourier_main/1590729864527220736) | true | `/test unit-tests`
build-tests_net-kourier_main | 6f8ae46368da7f800a8834eea6791365f30c57c7 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/949/build-tests_net-kourier_main/1590729864464306176) | true | `/test build-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @KauzClay: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | 6f8ae46368da7f800a8834eea6791365f30c57c7 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/949/unit-tests_net-kourier_main/1590729864527220736) | true | `/test unit-tests`
build-tests_net-kourier_main | 6f8ae46368da7f800a8834eea6791365f30c57c7 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/949/build-tests_net-kourier_main/1590729864464306176) | true | `/test build-tests`
integration-tests_net-kourier_main | 6f8ae46368da7f800a8834eea6791365f30c57c7 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/949/integration-tests_net-kourier_main/1590729864590135296) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
dprotaso: Looks like all the e2e tests with TLS are failing consistently 
knative-prow-robot: @KauzClay: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/949#" title="Author self-approved">KauzClay</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign skonto for approval by writing `/assign @skonto` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["skonto"]} -->

Patch:
diff --git a/.github/workflows/knative-releasability.yaml b/.github/workflows/knative-releasability.yaml
index 9c20538e..be5f765e 100644
--- a/.github/workflows/knative-releasability.yaml
+++ b/.github/workflows/knative-releasability.yaml
@@ -25,8 +25,8 @@ jobs:
   releasability:
     uses: knative/actions/.github/workflows/releasability.yaml@main
     with:
-      releaseFamily: ${{ github.event.inputs.releaseFamily || 'v1.8' }}
-      moduleReleaseFamily: ${{ github.event.inputs.moduleReleaseFamily || 'v0.35' }}
+      releaseFamily: ${{ github.event.inputs.releaseFamily || 'v1.9' }}
+      moduleReleaseFamily: ${{ github.event.inputs.moduleReleaseFamily || 'v0.36' }}
       slackChannel: ${{ github.event.inputs.slackChannel || 'release' }}
     secrets:
       SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index f8d5f606..1d0b1109 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -4,7 +4,6 @@
 aliases:
   async-component-approvers:
   - AngeloDanducci
-  - bvennam
   - julz
   - maximilien
   client-wg-leads:
@@ -38,8 +37,6 @@ aliases:
   eventing-awssqs-approvers:
   - lberk
   - matzew
-  eventing-camel-approvers:
-  - nicolaferraro
   eventing-ceph-approvers:
   - lberk
   - matzew
@@ -57,11 +54,9 @@ aliases:
   - tzununbekov
   eventing-kafka-approvers:
   - aliok
-  - davyodom
   - eric-sap
   - lberk
   - matzew
-  - phamilton
   - pierDipi
   - steven0711dong
   - travis-minke-sap
@@ -88,7 +83,6 @@ aliases:
   - chunyilyu
   - gab-satchi
   - gabo1208
-  - gvmw
   - ikvmw
   - salaboy
   - xtreme-sameer-vohra
@@ -118,6 +112,20 @@ aliases:
   - nainaz
   - salaboy
   - zroubalik
+  function-runtime-approvers:
+  - lance
+  - lkingland
+  - matejvasek
+  - nainaz
+  - salaboy
+  - zroubalik
+  function-runtime-writers:
+  - lance
+  - lkingland
+  - matejvasek
+  - nainaz
+  - salaboy
+  - zroubalik
   homebrew-kn-plugins-approvers:
   - dsimansk
   - maximilien
@@ -136,7 +144,6 @@ aliases:
   - rhuss
   kn-plugin-migration-approvers:
   - maximilien
-  - zhangtbj
   kn-plugin-operator-approvers:
   - dsimansk
   - houshengbo
@@ -162,7 +169,6 @@ aliases:
   - rhuss
   kn-plugin-source-kamelet-approvers:
   - christophd
-  - nicolaferraro
   - rhuss
   knative-admin:
   - csantanapr
@@ -177,11 +183,10 @@ aliases:
   - knative-test-reporter-robot
   - kvmware
   - lance
-  - pmorie
+  - nainaz
   - psschwei
-  - thisisnotapril
+  - salaboy
   - upodroid
-  - vaikas
   - zroubalik
   knative-release-leads:
   - evankanderson
@@ -224,8 +229,6 @@ aliases:
   - vagababov
   net-kourier-approvers:
   - carlisia
-  - davidor
-  - jmprusi
   - skonto
   - tcnghia
   networking-wg-leads: []
@@ -269,9 +272,8 @@ aliases:
   - csantanapr
   - itsmurugappan
   - lance
-  - pmorie
-  - thisisnotapril
-  - vaikas
+  - nainaz
+  - salaboy
   technical-oversight-committee:
   - dprotaso
   - dsimansk
diff --git a/config/300-controller.yaml b/config/300-controller.yaml
index f3464a7b..ed129602 100644
--- a/config/300-controller.yaml
+++ b/config/300-controller.yaml
@@ -23,6 +23,11 @@ metadata:
     app.kubernetes.io/version: devel
     app.kubernetes.io/name: knative-serving
 spec:
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 100%
   replicas: 1
   selector:
     matchLabels:
diff --git a/config/300-gateway.yaml b/config/300-gateway.yaml
index 60f00de3..969c0b73 100644
--- a/config/300-gateway.yaml
+++ b/config/300-gateway.yaml
@@ -27,7 +27,7 @@ spec:
     type: RollingUpdate
     rollingUpdate:
       maxUnavailable: 0
-      maxSurge: 1
+      maxSurge: 100%
   selector:
     matchLabels:
       app: 3scale-kourier-gateway
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 1ead69fc..e2cddae4 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -144,9 +144,10 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 				// Match the ingress' port with a port on the Service to find the target.
 				// Also find out if the target supports HTTP2.
 				var (
-					externalPort = int32(80)
-					targetPort   = int32(80)
-					http2        = false
+					externalPort       = int32(80)
+					targetPort         = int32(80)
+					http2              = false
+					internalEncryption = false
 				)
 				for _, port := range service.Spec.Ports {
 					if port.Port == split.ServicePort.IntVal || port.Name == split.ServicePort.StrVal {
@@ -156,6 +157,9 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 					if port.Name == "http2" || port.Name == "h2c" {
 						http2 = true
 					}
+					if port.Port == split.ServicePort.IntVal && port.Name == "https" {
+						internalEncryption = true
+					}
 				}
 
 				// Disable HTTP2 if the annotation is specified.
@@ -192,13 +196,20 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 
 				var transportSocket *envoycorev3.TransportSocket
 
-				// This has to be "OrDefaults" because this path is called before the informers are
+				// This has to be "OrDefaults" because this path could be called before the informers are
 				// running when booting the controller up and prefilling the config before making it
 				// ready.
+				//
+				// TODO:
+				// Drop this configmap check - issues/968
+				// We can determin whether internal-encryption is enabled or disabled via `internalEncryption` only,
+				// but all conformance tests need to be updated to have the port name so check the configmap as well.
+				//
+				// TODO: Or fetch configmap before the loop as per https://github.com/knative-sandbox/net-kourier/pull/959#discussion_r1048441513
 				cfg := config.FromContextOrDefaults(ctx)
 
 				// As Ingress with RewriteHost points to ExternalService(kourier-internal), we don't enable TLS.
-				if cfg.Network.InternalEncryption && httpPath.RewriteHost == "" {
+				if (cfg.Network.InternalEncryption || internalEncryption) && httpPath.RewriteHost == "" {
 					var err error
 					transportSocket, err = translator.createUpstreamTransportSocket(http2)
 					if err != nil {
@@ -305,7 +316,7 @@ func (translator *IngressTranslator) createUpstreamTransportSocket(http2 bool) (
 	if http2 {
 		alpnProtocols = "h2"
 	}
-	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[certificates.SecretCaCertKey], alpnProtocols))
+	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[certificates.CaCertName], alpnProtocols))
 	if err != nil {
 		return nil, err
 	}


Test patch:
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index bb9c718b..996e05dc 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -24,7 +24,7 @@ jobs:
         - v1.25.3
 
         gateway:
-        - quay.io/maistra/proxyv2-ubi8:2.1.0
+        - quay.io/maistra-dev/proxyv2-ubi8:2.3-daily # The image suffix will be added later.
         - docker.io/envoyproxy/envoy:v1.21-latest
         - docker.io/envoyproxy/envoy:v1.22-latest
 
@@ -121,6 +121,15 @@ jobs:
         echo ">> Deploy certificate for upstream traffic"
         ./test/generate-upstream-cert.sh
 
+    - name: Set current datetime as env variable for maistra image
+      id: image
+      run: |
+        if [[ "${{ matrix.gateway }}" =~ "maistra" ]]; then
+          echo "::set-output name=image::${{ matrix.gateway }}-$(date --date '1 day ago' +'%Y-%m-%d')"
+        else
+          echo "::set-output name=image::${{ matrix.gateway }}"
+        fi
+
     - name: Install Knative net-kourier
       run: |
         set -o pipefail
@@ -128,7 +137,7 @@ jobs:
         # Build and Publish our containers to the docker daemon (including test assets)
         ko resolve -f test/config/ -f config/ | \
           sed 's/LoadBalancer/NodePort/g' | \
-          sed "s|docker.io/envoyproxy/envoy:.*|${{ matrix.gateway }}|" | \
+          sed "s|docker.io/envoyproxy/envoy:.*|${{ steps.image.outputs.image }}|" | \
           kubectl apply -f -
 
     - name: Wait for Ready
diff --git a/pkg/generator/caches_test.go b/pkg/generator/caches_test.go
index 28834bf0..259bc472 100644
--- a/pkg/generator/caches_test.go
+++ b/pkg/generator/caches_test.go
@@ -268,7 +268,7 @@ func TestTLSListenerWithInternalCertSecret(t *testing.T) {
 			Name: "test-ca",
 		},
 		Data: map[string][]byte{
-			certificates.SecretCaCertKey: cert,
+			certificates.CaCertName: cert,
 		},
 	}
 
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index c7510e4c..e444632f 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -650,8 +650,7 @@ var (
 	}
 	upstreamTLSConfig = &config.Config{
 		Network: &netconfig.Config{
-			AutoTLS:            false,
-			InternalEncryption: true,
+			AutoTLS: false,
 		},
 		Kourier: pkgconfig.DefaultConfig(),
 	}
@@ -848,6 +847,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "simple",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -889,7 +889,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 					envoy.NewCluster(
 						"servicens/servicename",
 						5*time.Second,
-						lbEndpoints,
+						lbHTTPSEndpoints,
 						false,
 						&envoycorev3.TransportSocket{
 							Name:       wellknown.TransportSocketTls,
@@ -907,6 +907,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "http2",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -914,6 +915,10 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				service.Spec.Ports = []corev1.ServicePort{{
 					Name:       "http2",
 					TargetPort: intstr.FromInt(8080),
+				}, {
+					Name:       "https",
+					Port:       443,
+					TargetPort: intstr.FromInt(8443),
 				}}
 			}),
 			eps("servicens", "servicename"),
@@ -953,7 +958,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 					envoy.NewCluster(
 						"servicens/servicename",
 						5*time.Second,
-						lbEndpoints,
+						lbHTTPSEndpoints,
 						true, /* http2 */
 						&envoycorev3.TransportSocket{
 							Name:       wellknown.TransportSocketTls,
@@ -971,7 +976,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "http and https",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
-			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromString("https")
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -983,7 +988,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				}, {
 					Name:       "https",
 					Port:       443,
-					TargetPort: intstr.FromInt(443),
+					TargetPort: intstr.FromInt(8443),
 				}}
 			}),
 			eps("servicens", "servicename"),
@@ -1041,7 +1046,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "http2 and https",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
-			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromString("https")
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -1053,7 +1058,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				}, {
 					Name:       "https",
 					Port:       443,
-					TargetPort: intstr.FromInt(443),
+					TargetPort: intstr.FromInt(8443),
 				}}
 			}),
 			eps("servicens", "servicename"),
@@ -1411,6 +1416,10 @@ func svc(ns, name string, opts ...func(*corev1.Service)) *corev1.Service {
 				Name:       "http",
 				Port:       80,
 				TargetPort: intstr.FromInt(8080),
+			}, {
+				Name:       "https",
+				Port:       443,
+				TargetPort: intstr.FromInt(8443),
 			}},
 		},
 	}
@@ -1502,10 +1511,10 @@ var lbEndpoints = []*endpoint.LbEndpoint{
 }
 
 var lbHTTPSEndpoints = []*endpoint.LbEndpoint{
-	envoy.NewLBEndpoint("2.2.2.2", 443),
-	envoy.NewLBEndpoint("3.3.3.3", 443),
-	envoy.NewLBEndpoint("4.4.4.4", 443),
-	envoy.NewLBEndpoint("5.5.5.5", 443),
+	envoy.NewLBEndpoint("2.2.2.2", 8443),
+	envoy.NewLBEndpoint("3.3.3.3", 8443),
+	envoy.NewLBEndpoint("4.4.4.4", 8443),
+	envoy.NewLBEndpoint("5.5.5.5", 8443),
 }
 
 var lbEndpointHTTP01Challenge = []*endpoint.LbEndpoint{
@@ -1531,7 +1540,7 @@ var (
 			Name:      netconfig.ServingInternalCertName,
 		},
 		Data: map[string][]byte{
-			certificates.SecretCaCertKey: cert,
+			certificates.CaCertName: cert,
 		},
 	}
 )
diff --git a/test/generate-upstream-cert.sh b/test/generate-upstream-cert.sh
index 7542ffa0..8ab979ee 100755
--- a/test/generate-upstream-cert.sh
+++ b/test/generate-upstream-cert.sh
@@ -32,8 +32,11 @@ openssl req -out "${out_dir}"/tls.csr -newkey rsa:2048 -nodes -keyout "${out_dir
 openssl x509 -req -extfile <(printf "subjectAltName=DNS:$san") -days 365 -in "${out_dir}"/tls.csr -CA "${out_dir}"/root.crt -CAkey "${out_dir}"/root.key -CAcreateserial -out "${out_dir}"/tls.crt
 
 # Create secret
+# TODO: drop ca-cert.pem after v1.9 released. It is used for upgrade e2e test since previous version uses the old file name.
 kubectl create -n ${SERVING_SYSTEM_NAMESPACE} secret generic knative-serving-certs \
-    --from-file=ca-cert.pem="${out_dir}"/root.crt --dry-run=client -o yaml |  \
+    --from-file=ca.crt="${out_dir}"/root.crt \
+    --from-file=ca-cert.pem="${out_dir}"/root.crt \
+    --dry-run=client -o yaml |  \
     sed  '/^metadata:/a\ \ labels: {"networking.internal.knative.dev/certificate-uid":"test-id"}' | kubectl apply -f -
 
 kubectl create -n ${TEST_NAMESPACE} secret tls server-certs \
diff --git a/test/upgrade/probe_test.go b/test/upgrade/probe_test.go
index ea14e499..27bd945e 100644
--- a/test/upgrade/probe_test.go
+++ b/test/upgrade/probe_test.go
@@ -26,14 +26,18 @@ import (
 	"io/ioutil"
 	"net/http"
 	"os"
+	"strings"
 	"syscall"
 	"testing"
 
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"knative.dev/networking/pkg/apis/networking"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
+	"knative.dev/networking/pkg/config"
 	"knative.dev/networking/test"
 	"knative.dev/networking/test/conformance/ingress"
+	"knative.dev/pkg/system"
 )
 
 const probePipe = "/tmp/prober-signal"
@@ -53,7 +57,20 @@ func TestProbe(t *testing.T) {
 	clients := test.Setup(t)
 	ctx := context.Background()
 
-	name, port, _ := ingress.CreateRuntimeService(ctx, t, clients, networking.ServicePortNameHTTP1)
+	portName := networking.ServicePortNameHTTP1
+
+	// Set "https" to the port name when internal-encryption is enabled.
+	// Controller determines the internal-encryption is enabled or not by the port instead of configmap.
+	// ConfigMap does not work during the upgrade test - issues/968.
+	cm, err := clients.KubeClient.CoreV1().ConfigMaps(system.Namespace()).Get(ctx, "config-network", metav1.GetOptions{})
+	if err != nil {
+		t.Fatal("Failed to fetch configmap:", err)
+	}
+	if strings.EqualFold(cm.Data[config.InternalEncryptionKey], "true") {
+		portName = networking.ServicePortNameHTTPS
+	}
+
+	name, port, _ := ingress.CreateRuntimeService(ctx, t, clients, portName)
 	_, client, _ := ingress.CreateIngressReady(ctx, t, clients, v1alpha1.IngressSpec{
 		Rules: []v1alpha1.IngressRule{{
 			Hosts:      []string{name + ".example.com"},