Repository: knative-sandbox/net-kourier
Pull request #943 (2022-10-27 04:16:47)

Fix deprecated warning
This patch fixes the following warning message:

```
[2022-10-27 04:14:05.527][1][warning][misc] [external/envoy/source/common/protobuf/message_validator_impl.cc:21] Deprecated field: type envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext Using deprecated option 'envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.match_subject_alt_names' from file common.proto. This configuration will be removed from Envoy soon. Please see https://www.envoyproxy.io/docs/envoy/latest/version_history/version_history for details. If continued use of this field is absolutely necessary, see https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime#using-runtime-overrides-for-deprecated-features for how to apply a temporary and highly discouraged override.
```

```
[2022-10-27 04:14:05.551][1][warning][misc] [external/envoy/source/common/protobuf/message_validator_impl.cc:21] Deprecated field: type envoy.config.route.v3.HeaderMatcher Using deprecated option 'envoy.config.route.v3.HeaderMatcher.exact_match' from file route_components.proto. This configuration will be removed from Envoy soon. Please see https://www.envoyproxy.io/docs/envoy/latest/version_history/version_history for details. If continued use of this field is absolutely necessary, see https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime#using-runtime-overrides-for-deprecated-features for how to apply a temporary and highly discouraged override.
```

```
[2022-10-27 04:15:42.325][1][warning][misc] [external/envoy/source/common/protobuf/message_validator_impl.cc:21] Deprecated field: type envoy.config.bootstrap.v3.Admin Using deprecated option 'envoy.config.bootstrap.v3.Admin.access_log_path' from file bootstrap.proto. This configuration will be removed from Envoy soon. Please see https://www.envoyproxy.io/docs/envoy/latest/version_history/version_history for details. If continued use of this field is absolutely necessary, see https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime#using-runtime-overrides-for-deprecated-features for how to apply a temporary and highly discouraged override.
```

knative-prow[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/943#" title="Author self-approved">nak3</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)~~ [nak3]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/943?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#943](https://codecov.io/gh/knative-sandbox/net-kourier/pull/943?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (23f6577) into [main](https://codecov.io/gh/knative-sandbox/net-kourier/commit/24b2fa5ec247505ddce6800b6375bd2e5fca5bee?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (24b2fa5) will **increase** coverage by `0.12%`.
> The diff coverage is `100.00%`.

```diff
@@            Coverage Diff             @@
##             main     #943      +/-   ##
==========================================
+ Coverage   80.93%   81.05%   +0.12%     
==========================================
  Files          18       18              
  Lines        1243     1251       +8     
==========================================
+ Hits         1006     1014       +8     
  Misses        190      190              
  Partials       47       47              
```


| [Impacted Files](https://codecov.io/gh/knative-sandbox/net-kourier/pull/943?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) | Coverage Δ | |
|---|---|---|
| [pkg/generator/ingress\_translator.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/943/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-cGtnL2dlbmVyYXRvci9pbmdyZXNzX3RyYW5zbGF0b3IuZ28=) | `83.00% <100.00%> (+0.46%)` | :arrow_up: |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)

nak3: /hold
We need to bump maistra image to include this but it has a bug on the newer image. We are working on the fix internally.
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/943#" title="Author self-approved">nak3</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign dprotaso for approval by writing `/assign @dprotaso` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["dprotaso"]} -->
nak3: /hold cancel
/cc @skonto @ReToCode
knative-prow[bot]: @nak3: GitHub didn't allow me to request PR reviews from the following users: ReToCode.

Note that only [knative-sandbox members](https://github.com/orgs/knative-sandbox/people) and repo collaborators can review this PR, and authors cannot review their own PRs.

<details>

In response to [this](https://github.com/knative-sandbox/net-kourier/pull/943#issuecomment-1384794163):

>/hold cancel
>/cc @skonto @ReToCode


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
nak3: /cc @ReToCode 
ReToCode: /lgtm
/approve
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/943#" title="Author self-approved">nak3</a>*, *<a href="https://github.com/knative-sandbox/net-kourier/pull/943#issuecomment-1386681011" title="Approved">ReToCode</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign dprotaso for approval by writing `/assign @dprotaso` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["dprotaso"]} -->

Patch:
diff --git a/config/200-bootstrap.yaml b/config/200-bootstrap.yaml
index 890c66b1..1b966595 100644
--- a/config/200-bootstrap.yaml
+++ b/config/200-bootstrap.yaml
@@ -107,7 +107,10 @@ data:
                       port_value: 18000
           type: STRICT_DNS
     admin:
-      access_log_path: "/dev/stdout"
+      access_log:
+      - name: envoy.access_loggers.stdout
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
       address:
         pipe:
           path: /tmp/envoy.admin
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 6fcf86d1..a8e34148 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -316,7 +316,7 @@ func (translator *IngressTranslator) createUpstreamTransportSocket(http2 bool) (
 	if http2 {
 		alpnProtocols = "h2"
 	}
-	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[certificates.SecretCaCertKey], alpnProtocols))
+	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[certificates.CaCertName], alpnProtocols))
 	if err != nil {
 		return nil, err
 	}
@@ -342,11 +342,14 @@ func createUpstreamTLSContext(caCertificate []byte, alpnProtocols ...string) *tl
 							InlineBytes: caCertificate,
 						},
 					},
-					MatchSubjectAltNames: []*envoymatcherv3.StringMatcher{{
-						MatchPattern: &envoymatcherv3.StringMatcher_Exact{
-							Exact: certificates.FakeDnsName,
-						}},
-					},
+					MatchTypedSubjectAltNames: []*tls.SubjectAltNameMatcher{{
+						SanType: tls.SubjectAltNameMatcher_DNS,
+						Matcher: &envoymatcherv3.StringMatcher{
+							MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+								Exact: certificates.FakeDnsName,
+							},
+						},
+					}},
 				},
 			},
 		},
@@ -411,8 +414,13 @@ func matchHeadersFromHTTPPath(httpPath v1alpha1.HTTPIngressPath) []*route.Header
 			Name: header,
 		}
 		if matchType.Exact != "" {
-			matchHeader.HeaderMatchSpecifier = &route.HeaderMatcher_ExactMatch{
-				ExactMatch: matchType.Exact,
+
+			matchHeader.HeaderMatchSpecifier = &route.HeaderMatcher_StringMatch{
+				StringMatch: &envoymatcherv3.StringMatcher{
+					MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+						Exact: matchType.Exact,
+					},
+				},
 			}
 		}
 		matchHeaders = append(matchHeaders, matchHeader)


Test patch:
diff --git a/pkg/generator/caches_test.go b/pkg/generator/caches_test.go
index 28834bf0..259bc472 100644
--- a/pkg/generator/caches_test.go
+++ b/pkg/generator/caches_test.go
@@ -268,7 +268,7 @@ func TestTLSListenerWithInternalCertSecret(t *testing.T) {
 			Name: "test-ca",
 		},
 		Data: map[string][]byte{
-			certificates.SecretCaCertKey: cert,
+			certificates.CaCertName: cert,
 		},
 	}
 
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index 9feb08fd..8a3d7d55 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -70,9 +70,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
-							},
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								}},
 						}},
 						"/test",
 						[]*route.WeightedCluster_ClusterWeight{
@@ -130,8 +133,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -199,8 +206,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -221,8 +232,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test"),
@@ -286,8 +301,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -371,8 +390,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -444,8 +467,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/",
@@ -499,8 +526,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -555,8 +586,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -688,8 +723,12 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -758,8 +797,12 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -864,8 +907,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -933,8 +980,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1003,8 +1054,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1073,8 +1128,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1284,8 +1343,12 @@ func TestIngressTranslatorDomainMappingDisableHTTP2(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1540,7 +1603,7 @@ var (
 			Name:      netconfig.ServingInternalCertName,
 		},
 		Data: map[string][]byte{
-			certificates.SecretCaCertKey: cert,
+			certificates.CaCertName: cert,
 		},
 	}
 )
@@ -1563,11 +1626,14 @@ func typedConfig(http2 bool) *envoycorev3.TransportSocket_TypedConfig {
 							InlineBytes: cert,
 						},
 					},
-					MatchSubjectAltNames: []*envoymatcherv3.StringMatcher{{
-						MatchPattern: &envoymatcherv3.StringMatcher_Exact{
-							Exact: certificates.FakeDnsName,
-						}},
-					},
+					MatchTypedSubjectAltNames: []*auth.SubjectAltNameMatcher{{
+						SanType: auth.SubjectAltNameMatcher_DNS,
+						Matcher: &envoymatcherv3.StringMatcher{
+							MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+								Exact: certificates.FakeDnsName,
+							},
+						},
+					}},
 				},
 			},
 		},
diff --git a/test/generate-upstream-cert.sh b/test/generate-upstream-cert.sh
index 7542ffa0..8ab979ee 100755
--- a/test/generate-upstream-cert.sh
+++ b/test/generate-upstream-cert.sh
@@ -32,8 +32,11 @@ openssl req -out "${out_dir}"/tls.csr -newkey rsa:2048 -nodes -keyout "${out_dir
 openssl x509 -req -extfile <(printf "subjectAltName=DNS:$san") -days 365 -in "${out_dir}"/tls.csr -CA "${out_dir}"/root.crt -CAkey "${out_dir}"/root.key -CAcreateserial -out "${out_dir}"/tls.crt
 
 # Create secret
+# TODO: drop ca-cert.pem after v1.9 released. It is used for upgrade e2e test since previous version uses the old file name.
 kubectl create -n ${SERVING_SYSTEM_NAMESPACE} secret generic knative-serving-certs \
-    --from-file=ca-cert.pem="${out_dir}"/root.crt --dry-run=client -o yaml |  \
+    --from-file=ca.crt="${out_dir}"/root.crt \
+    --from-file=ca-cert.pem="${out_dir}"/root.crt \
+    --dry-run=client -o yaml |  \
     sed  '/^metadata:/a\ \ labels: {"networking.internal.knative.dev/certificate-uid":"test-id"}' | kubectl apply -f -
 
 kubectl create -n ${TEST_NAMESPACE} secret tls server-certs \