Repository: knative-sandbox/net-kourier
Pull request #761 (2022-01-26 14:22:10)

All Hops Encrypted: alpha Kourier support for encrypted backends
This patch adds the TLS support between Kourier and Activator.

TODO:
- [x] Update networking repo (currently manually modified `vendor` direcotry 
  - https://github.com/knative/networking/pull/608
  - https://github.com/knative/networking/pull/609
- [x] Add unit test.
- [x] Fix host-rewrite test.

Fix https://github.com/knative-sandbox/net-kourier/issues/750

knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/761#" title="Author self-approved">nak3</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)~~ [nak3]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486343720935624704/artifacts/line-cov.html#file1) | 88.0% | 77.6% | -10.4
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486343720935624704/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | e8eb4b47e58ee783dbe55d6c0bc89becdd882cfd | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486343720935624704) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#761](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (e8eb4b4) into [main](https://codecov.io/gh/knative-sandbox/net-kourier/commit/8d34ddec013644482a6aa26cc76e395b1e4ef089?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (8d34dde) will **decrease** coverage by `3.88%`.
> The diff coverage is `12.76%`.

[![Impacted file tree graph](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761/graphs/tree.svg?width=650&height=150&src=pr&token=KmlRo23zX4&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)

```diff
@@            Coverage Diff             @@
##             main     #761      +/-   ##
==========================================
- Coverage   71.97%   68.08%   -3.89%     
==========================================
  Files          18       18              
  Lines         685      730      +45     
==========================================
+ Hits          493      497       +4     
- Misses        163      203      +40     
- Partials       29       30       +1     
```


| [Impacted Files](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) | Coverage Δ | |
|---|---|---|
| [pkg/generator/ingress\_translator.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-cGtnL2dlbmVyYXRvci9pbmdyZXNzX3RyYW5zbGF0b3IuZ28=) | `65.80% <4.65%> (-17.65%)` | :arrow_down: |
| [pkg/envoy/api/cluster.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-cGtnL2Vudm95L2FwaS9jbHVzdGVyLmdv) | `100.00% <100.00%> (ø)` | |
| [pkg/reconciler/ingress/config/store.go](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-cGtnL3JlY29uY2lsZXIvaW5ncmVzcy9jb25maWcvc3RvcmUuZ28=) | `80.00% <100.00%> (+2.22%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Last update [8d34dde...e8eb4b4](https://codecov.io/gh/knative-sandbox/net-kourier/pull/761?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox).

knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | e8eb4b47e58ee783dbe55d6c0bc89becdd882cfd | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486343720935624704) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`
pull-knative-sandbox-net-kourier-build-tests | e8eb4b47e58ee783dbe55d6c0bc89becdd882cfd | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486343720839155712) | true | `/test pull-knative-sandbox-net-kourier-build-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486558957236391936/artifacts/line-cov.html#file1) | 88.0% | 77.6% | -10.4
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486558957236391936/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-build-tests | e8eb4b47e58ee783dbe55d6c0bc89becdd882cfd | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486343720839155712) | true | `/test pull-knative-sandbox-net-kourier-build-tests`
pull-knative-sandbox-net-kourier-go-coverage | 496e1f05275060f9910955446739f984ebd54249 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486558957236391936) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 496e1f05275060f9910955446739f984ebd54249 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486558957236391936) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`
pull-knative-sandbox-net-kourier-build-tests | 496e1f05275060f9910955446739f984ebd54249 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486558957135728640) | true | `/test pull-knative-sandbox-net-kourier-build-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486655929360322560/artifacts/line-cov.html#file1) | 88.0% | 77.8% | -10.2
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486655929360322560/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486655929360322560/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-build-tests | 496e1f05275060f9910955446739f984ebd54249 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486558957135728640) | true | `/test pull-knative-sandbox-net-kourier-build-tests`
pull-knative-sandbox-net-kourier-go-coverage | ffd498f8fc12dadf5350694d987037e650ffd2b5 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486655929360322560) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | ffd498f8fc12dadf5350694d987037e650ffd2b5 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486655929360322560) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`
pull-knative-sandbox-net-kourier-build-tests | ffd498f8fc12dadf5350694d987037e650ffd2b5 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486655929268047872) | true | `/test pull-knative-sandbox-net-kourier-build-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486663373994070016/artifacts/line-cov.html#file1) | 88.0% | 77.8% | -10.2
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486663373994070016/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486663373994070016/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-build-tests | ffd498f8fc12dadf5350694d987037e650ffd2b5 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486655929268047872) | true | `/test pull-knative-sandbox-net-kourier-build-tests`
pull-knative-sandbox-net-kourier-go-coverage | 95f15e0bfd5ba26f32e05d443b009233434dce3e | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486663373994070016) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 95f15e0bfd5ba26f32e05d443b009233434dce3e | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486663373994070016) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`
pull-knative-sandbox-net-kourier-build-tests | 95f15e0bfd5ba26f32e05d443b009233434dce3e | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486663373897601024) | true | `/test pull-knative-sandbox-net-kourier-build-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486664265413693440/artifacts/line-cov.html#file1) | 88.0% | 77.8% | -10.2
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486664265413693440/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486664265413693440/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-build-tests | 95f15e0bfd5ba26f32e05d443b009233434dce3e | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486663373897601024) | true | `/test pull-knative-sandbox-net-kourier-build-tests`
pull-knative-sandbox-net-kourier-go-coverage | 7e04f1fadf1f2eb6f59732967cd51eab250785de | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486664265413693440) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 7e04f1fadf1f2eb6f59732967cd51eab250785de | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1486664265413693440) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`
pull-knative-sandbox-net-kourier-build-tests | 7e04f1fadf1f2eb6f59732967cd51eab250785de | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486664265317224448) | true | `/test pull-knative-sandbox-net-kourier-build-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @nak3: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-build-tests | 7e04f1fadf1f2eb6f59732967cd51eab250785de | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1486664265317224448) | true | `/test pull-knative-sandbox-net-kourier-build-tests`
pull-knative-sandbox-net-kourier-go-coverage | e5a79ccfe4dd6ff5a0b17b02f68a50bd5c6ce1d2 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1498913536460460032) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503562086259625984/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503562086259625984/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503562086259625984/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-build-tests | e5a79ccfe4dd6ff5a0b17b02f68a50bd5c6ce1d2 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-build-tests/1498913536334630912) | true | `/test pull-knative-sandbox-net-kourier-build-tests`
pull-knative-sandbox-net-kourier-go-coverage | 447d0bb8540f56f9f9fedebd4e7109ee450e735f | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503562086259625984) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503565714903011328/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503565714903011328/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503565714903011328/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | d1629f2e28426c276f33c20270ea8f80fe5447ca | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503565714903011328) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503596501715128320/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503596501715128320/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503596501715128320/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 46ea6e9ea32959ca8b9e1f2ae52110eae5c87552 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503596501715128320) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503603625065189376/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503603625065189376/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503603625065189376/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 49c5249a3685ac6433fd3138b9f067e3e939d537 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503603625065189376) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503609256740392960/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503609256740392960/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503609256740392960/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 14922531a45ef756b238182db44f0f081766fb61 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503609256740392960) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503610970889523200/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503610970889523200/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503610970889523200/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 134dfa758d4da8324f062976ab20c881a4d9daeb | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503610970889523200) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503614915410137088/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503614915410137088/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503614915410137088/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 73fbc305a437047fb992183ed86b727fd5d6f75a | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503614915410137088) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503620167664406528/artifacts/line-cov.html#file1) | 90.9% | 80.5% | -10.4
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503620167664406528/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503620167664406528/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 8a6449695e4552cf8ec0f57e59c384dbc5d8a7f9 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503620167664406528) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503646609458597888/artifacts/line-cov.html#file1) | 90.9% | 89.8% | -1.1
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503646609458597888/artifacts/line-cov.html#file2) | 66.7% | 60.0% | -6.7
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503646609458597888/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 1f917944ca406645dd8e2a3de8b7354120360c40 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503646609458597888) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503650442075181056/artifacts/line-cov.html#file1) | 90.9% | 89.8% | -1.1
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503650442075181056/artifacts/line-cov.html#file2) | 66.7% | 90.0% | 23.3
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503650442075181056/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 2589dbb1abefe0c29abf890d8e5418ba3b6f8f2d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1503650442075181056) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
nak3: This PR may be too big. I will separate it.
nak3: I started to send a separated PR as https://github.com/knative-sandbox/net-kourier/pull/795
(Of course, it would be great if we get a review for this PR though :wink: )
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504417683335024640/artifacts/line-cov.html#file1) | 90.9% | 89.8% | -1.1
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504417683335024640/artifacts/line-cov.html#file2) | 66.7% | 90.0% | 23.3
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504417683335024640/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 9c95a04a1d70fbaf1666d0db3bf63172ed05980e | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504417683335024640) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504441597629042688/artifacts/line-cov.html#file1) | 90.9% | 89.8% | -1.1
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504441597629042688/artifacts/line-cov.html#file2) | 66.7% | 90.0% | 23.3
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504441597629042688/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 524e83e9e68b38a1cbc0bad66afd926f6e18d4dd | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504441597629042688) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 26ff71f8ffd6033f15d2327ef155ada17e7a90da | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504445424839168000) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
nak3: Sorry, I tried to understand but didn't get it. Do you mean we can omit
`Exact: activatorSAN`? Then, how to validate the SAN?

On Thu, Mar 17, 2022 at 10:53 PM Stavros Kontopoulos <
***@***.***> wrote:

> ***@***.**** commented on this pull request.
> ------------------------------
>
> In pkg/generator/ingress_translator.go
> <https://github.com/knative-sandbox/net-kourier/pull/761#discussion_r829141758>
> :
>
> > +	return &auth.UpstreamTlsContext{
> +		CommonTlsContext: &auth.CommonTlsContext{
> +			AlpnProtocols: alpnProtocols,
> +			TlsParams: &auth.TlsParameters{
> +				TlsMinimumProtocolVersion: auth.TlsParameters_TLSv1_2,
> +			},
> +			ValidationContextType: &auth.CommonTlsContext_ValidationContext{
> +				ValidationContext: &auth.CertificateValidationContext{
> +					TrustedCa: &envoy_core_v3.DataSource{
> +						Specifier: &envoy_core_v3.DataSource_InlineBytes{
> +							InlineBytes: caCertificate,
> +						},
> +					},
> +					MatchSubjectAltNames: []*envoy_matcher_v3.StringMatcher{{
> +						MatchPattern: &envoy_matcher_v3.StringMatcher_Exact{
> +							Exact: activatorSAN,
>
> Could it be the case that ActivatorCa != "" and ActivatorSAN="" ? If so
> then this part could be omitted?
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/knative-sandbox/net-kourier/pull/761#pullrequestreview-913177203>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAQKBY7S34NJJIDDWRDOBGTVAM2NHANCNFSM5M3FKLSQ>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>


-- 
Kenjiro NAKAYAMA ***@***.***>
GPG Key fingerprint = ED8F 049D E67A 727D 9A44  8E25 F44B E208 C946 5EB9

knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504483301606297600/artifacts/line-cov.html#file1) | 90.9% | 89.8% | -1.1
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504483301606297600/artifacts/line-cov.html#file2) | 66.7% | 90.0% | 23.3
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504483301606297600/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 8bbcbab80ee42a027c28073dcda67142f968af4c | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1504483301606297600) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
nak3: /hold cancel
skonto: Shouldn't the autogenerated file being ignored because of https://github.com/knative-sandbox/net-kourier/blob/8bbcbab80ee42a027c28073dcda67142f968af4c/.codecov.yaml#L15?
nak3: `pull-knative-sandbox-net-kourier-go-coverage` is an optional test so I think we can try to fix it by the follow up PR.
skonto: Ok wfm.
skonto: /lgtm /hold @rhuss may want to take a look too.
knative-metrics-robot: The following is the coverage report on the affected files.
Say `/test pull-knative-sandbox-net-kourier-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/generator/ingress_translator.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1506439909622157312/artifacts/line-cov.html#file1) | 90.9% | 89.8% | -1.1
[pkg/reconciler/ingress/config/store.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1506439909622157312/artifacts/line-cov.html#file2) | 66.7% | 90.0% | 23.3
[pkg/reconciler/ingress/config/zz_generated.deepcopy.go](https://storage.cloud.google.com/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1506439909622157312/artifacts/line-cov.html#file3) | Do not exist | 0.0% | 

knative-prow-robot: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-knative-sandbox-net-kourier-go-coverage | 5ef250e1a0bb21c60be7e8c62040725700152616 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/761/pull-knative-sandbox-net-kourier-go-coverage/1506439909622157312) | false | `/test pull-knative-sandbox-net-kourier-go-coverage`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_net-kourier/761). [Your PR dashboard](https://gubernator.knative.dev/pr/nak3).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 7722315d..1b34b098 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -119,6 +119,14 @@ aliases:
   - odacremolbap
   - pierDipi
   - vaikas
+  func-tastic-approvers:
+  - lance
+  - lkingland
+  - matejvasek
+  - nainaz
+  - omerbensaadon
+  - salaboy
+  - zroubalik
   homebrew-kn-plugins-approvers:
   - dsimansk
   - maximilien
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 27e18c80..d0e28140 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -31,7 +31,8 @@ group "Deepcopy Gen"
 ${GOPATH}/bin/deepcopy-gen \
   -O zz_generated.deepcopy \
   --go-header-file "${REPO_ROOT_DIR}/hack/boilerplate/boilerplate.go.txt" \
-  -i knative.dev/net-kourier/pkg/config
+  -i knative.dev/net-kourier/pkg/config \
+  -i knative.dev/net-kourier/pkg/reconciler/ingress/config
 
 # Make sure our dependencies are up-to-date
 ${REPO_ROOT_DIR}/hack/update-deps.sh
diff --git a/pkg/envoy/api/cluster.go b/pkg/envoy/api/cluster.go
index 3b6068ae..a27220ce 100644
--- a/pkg/envoy/api/cluster.go
+++ b/pkg/envoy/api/cluster.go
@@ -19,7 +19,9 @@ package envoy
 import (
 	"time"
 
-	envoyCluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	envoyclusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	envoycorev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+
 	endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
 	httpOptions "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3"
 	"google.golang.org/protobuf/types/known/anypb"
@@ -31,12 +33,12 @@ func NewCluster(
 	name string,
 	connectTimeout time.Duration,
 	endpoints []*endpoint.LbEndpoint,
-	isHTTP2 bool,
-	discoveryType envoyCluster.Cluster_DiscoveryType) *envoyCluster.Cluster {
+	isHTTP2 bool, transportSocket *envoycorev3.TransportSocket,
+	discoveryType envoyclusterv3.Cluster_DiscoveryType) *envoyclusterv3.Cluster {
 
-	cluster := &envoyCluster.Cluster{
+	cluster := &envoyclusterv3.Cluster{
 		Name: name,
-		ClusterDiscoveryType: &envoyCluster.Cluster_Type{
+		ClusterDiscoveryType: &envoyclusterv3.Cluster_Type{
 			Type: discoveryType,
 		},
 		ConnectTimeout: durationpb.New(connectTimeout),
@@ -46,6 +48,7 @@ func NewCluster(
 				LbEndpoints: endpoints,
 			}},
 		},
+		TransportSocket: transportSocket,
 	}
 
 	if isHTTP2 {
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 0176a4c9..828a6e9d 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -24,18 +24,29 @@ import (
 	"time"
 
 	v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	envoycorev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
 	route "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	envoymatcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"google.golang.org/protobuf/types/known/anypb"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	envoy "knative.dev/net-kourier/pkg/envoy/api"
+	"knative.dev/net-kourier/pkg/reconciler/ingress/config"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	"knative.dev/pkg/kmeta"
 	"knative.dev/pkg/logging"
+	"knative.dev/pkg/system"
 	"knative.dev/pkg/tracker"
 )
 
+const (
+	caDataName = "ca.crt"
+)
+
 type translatedIngress struct {
 	name                    types.NamespacedName
 	sniMatches              []*envoy.SNIMatch
@@ -169,7 +180,23 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 				}
 
 				connectTimeout := 5 * time.Second
-				cluster := envoy.NewCluster(splitName, connectTimeout, publicLbEndpoints, http2, typ)
+
+				var transportSocket *envoycorev3.TransportSocket
+
+				// This has to be "OrDefaults" because this path is called before the informers are
+				// running when booting the controller up and prefilling the config before making it
+				// ready.
+				cfg := config.FromContextOrDefaults(ctx)
+
+				// As Ingress with RewriteHost points to ExternalService(kourier-internal), we don't enable TLS.
+				if activatorCA := cfg.Network.ActivatorCA; activatorCA != "" && httpPath.RewriteHost == "" {
+					var err error
+					transportSocket, err = translator.createUpstreamTransportSocket(activatorCA, config.FromContext(ctx).Network.ActivatorSAN, http2)
+					if err != nil {
+						return nil, err
+					}
+				}
+				cluster := envoy.NewCluster(splitName, connectTimeout, publicLbEndpoints, http2, transportSocket, typ)
 				clusters = append(clusters, cluster)
 
 				weightedCluster := envoy.NewWeightedCluster(splitName, uint32(split.Percent), split.AppendHeaders)
@@ -241,6 +268,52 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 	}, nil
 }
 
+func (translator *IngressTranslator) createUpstreamTransportSocket(activatorCA, activatorSAN string, http2 bool) (*envoycorev3.TransportSocket, error) {
+	caSecret, err := translator.secretGetter(system.Namespace(), activatorCA)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch activator CA secret: %w", err)
+	}
+	var alpnProtocols string
+	if http2 {
+		alpnProtocols = "h2"
+	}
+	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[caDataName], activatorSAN, alpnProtocols))
+	if err != nil {
+		return nil, err
+	}
+	return &envoycorev3.TransportSocket{
+		Name: wellknown.TransportSocketTls,
+		ConfigType: &envoycorev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsAny,
+		},
+	}, nil
+}
+
+func createUpstreamTLSContext(caCertificate []byte, activatorSAN string, alpnProtocols ...string) *tls.UpstreamTlsContext {
+	return &tls.UpstreamTlsContext{
+		CommonTlsContext: &tls.CommonTlsContext{
+			AlpnProtocols: alpnProtocols,
+			TlsParams: &tls.TlsParameters{
+				TlsMinimumProtocolVersion: tls.TlsParameters_TLSv1_2,
+			},
+			ValidationContextType: &tls.CommonTlsContext_ValidationContext{
+				ValidationContext: &tls.CertificateValidationContext{
+					TrustedCa: &envoycorev3.DataSource{
+						Specifier: &envoycorev3.DataSource_InlineBytes{
+							InlineBytes: caCertificate,
+						},
+					},
+					MatchSubjectAltNames: []*envoymatcherv3.StringMatcher{{
+						MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+							Exact: activatorSAN,
+						}},
+					},
+				},
+			},
+		},
+	}
+}
+
 func trackSecret(t tracker.Interface, ns, name string, ingress *v1alpha1.Ingress) error {
 	return t.TrackReference(tracker.Reference{
 		Kind:       "Secret",
diff --git a/pkg/reconciler/ingress/config/store.go b/pkg/reconciler/ingress/config/store.go
index 844c0f82..de9c15b1 100644
--- a/pkg/reconciler/ingress/config/store.go
+++ b/pkg/reconciler/ingress/config/store.go
@@ -20,14 +20,17 @@ import (
 	"context"
 
 	"knative.dev/net-kourier/pkg/config"
+	network "knative.dev/networking/pkg"
 	"knative.dev/pkg/configmap"
 )
 
 type cfgKey struct{}
 
 // Config contains the configmaps requires for revision reconciliation.
+// +k8s:deepcopy-gen=false
 type Config struct {
 	Kourier *config.Kourier
+	Network *network.Config
 }
 
 // FromContext loads the configuration from the context.
@@ -41,6 +44,14 @@ func FromContextOrDefaults(ctx context.Context) *Config {
 	}
 	return &Config{
 		Kourier: config.DefaultConfig(),
+		Network: defaultConfig(),
+	}
+}
+
+func defaultConfig() *network.Config {
+	return &network.Config{
+		ActivatorCA:  "",
+		ActivatorSAN: "",
 	}
 }
 
@@ -50,6 +61,7 @@ func ToContext(ctx context.Context, c *Config) context.Context {
 }
 
 // Store is a typed wrapper around configmap.UntypedStore to handle our configmaps.
+// +k8s:deepcopy-gen=false
 type Store struct {
 	*configmap.UntypedStore
 }
@@ -61,7 +73,8 @@ func NewStore(logger configmap.Logger, onAfterStore ...func(name string, value i
 			"kourier",
 			logger,
 			configmap.Constructors{
-				config.ConfigName: config.NewConfigFromConfigMap,
+				config.ConfigName:  config.NewConfigFromConfigMap,
+				network.ConfigName: network.NewConfigFromConfigMap,
 			},
 			onAfterStore...,
 		),
@@ -78,5 +91,6 @@ func (s *Store) ToContext(ctx context.Context) context.Context {
 func (s *Store) Load() *Config {
 	return &Config{
 		Kourier: s.UntypedLoad(config.ConfigName).(*config.Kourier).DeepCopy(),
+		Network: s.UntypedLoad(network.ConfigName).(*network.Config).DeepCopy(),
 	}
 }
diff --git a/pkg/reconciler/ingress/config/zz_generated.deepcopy.go b/pkg/reconciler/ingress/config/zz_generated.deepcopy.go
new file mode 100644
index 00000000..98b1bd41
--- /dev/null
+++ b/pkg/reconciler/ingress/config/zz_generated.deepcopy.go
@@ -0,0 +1,53 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright 2021 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package config
+
+import (
+	pkgconfig "knative.dev/net-kourier/pkg/config"
+	pkg "knative.dev/networking/pkg"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Config) DeepCopyInto(out *Config) {
+	*out = *in
+	if in.Kourier != nil {
+		in, out := &in.Kourier, &out.Kourier
+		*out = new(pkgconfig.Kourier)
+		**out = **in
+	}
+	if in.Network != nil {
+		in, out := &in.Network, &out.Network
+		*out = new(pkg.Config)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
+func (in *Config) DeepCopy() *Config {
+	if in == nil {
+		return nil
+	}
+	out := new(Config)
+	in.DeepCopyInto(out)
+	return out
+}


Test patch:
diff --git a/.github/workflows/kind-e2e-upgrade.yaml b/.github/workflows/kind-e2e-upgrade.yaml
index 74fe4db0..06dee89e 100644
--- a/.github/workflows/kind-e2e-upgrade.yaml
+++ b/.github/workflows/kind-e2e-upgrade.yaml
@@ -24,6 +24,11 @@ jobs:
         - v1.22.0
         - v1.23.0
 
+        upstream-traffic:
+        - plain
+        # TODO: Enable tls after 1.14 release.
+        # - tls
+
         # Map between K8s and KinD versions.
         # This is attempting to make it a bit clearer what's being tested.
         # See: https://github.com/kubernetes-sigs/kind/releases
@@ -116,6 +121,13 @@ jobs:
         # Create a cluster!
         kind create cluster --config kind.yaml
 
+    - name: Deploy certificates for upstream traffic
+      if: matrix.upstream-tls == 'tls'
+      run: |
+        set -o pipefail
+        echo ">> Deploy certificate for upstream traffic"
+        ./test/generate-upstream-cert.sh
+
     - name: Run upgrade tests
       run: |
         ./test/e2e-upgrade-kind.sh
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index 6fc0c5f9..e0aeb9ed 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -29,6 +29,10 @@ jobs:
         - docker.io/envoyproxy/envoy:v1.19-latest
         - docker.io/envoyproxy/envoy:v1.20-latest
 
+        upstream-tls:
+        - plain
+        - tls
+
         # Map between K8s and KinD versions.
         # This is attempting to make it a bit clearer what's being tested.
         # See: https://github.com/kubernetes-sigs/kind/releases
@@ -118,6 +122,13 @@ jobs:
         # Create a cluster!
         kind create cluster --config kind.yaml
 
+    - name: Deploy certificates for upstream traffic
+      if: matrix.upstream-tls == 'tls'
+      run: |
+        set -o pipefail
+        echo ">> Deploy certificate for upstream traffic"
+        ./test/generate-upstream-cert.sh
+
     - name: Install Knative net-kourier
       run: |
         set -o pipefail
diff --git a/pkg/envoy/api/cluster_test.go b/pkg/envoy/api/cluster_test.go
index 626e9a3b..1fac8de8 100644
--- a/pkg/envoy/api/cluster_test.go
+++ b/pkg/envoy/api/cluster_test.go
@@ -35,13 +35,13 @@ func TestNewCluster(t *testing.T) {
 	endpoints := []*endpoint.LbEndpoint{endpoint1, endpoint2}
 
 	// With HTTP2
-	c := NewCluster(name, connectTimeout, endpoints, true, v3Cluster.Cluster_STATIC)
+	c := NewCluster(name, connectTimeout, endpoints, true, nil, v3Cluster.Cluster_STATIC)
 	assert.Equal(t, c.GetConnectTimeout().Seconds, int64(connectTimeout.Seconds()))
 	assert.Assert(t, c.TypedExtensionProtocolOptions["envoy.extensions.upstreams.http.v3.HttpProtocolOptions"] != nil)
 	assert.Equal(t, c.GetName(), name)
 	assert.DeepEqual(t, c.LoadAssignment.Endpoints[0].LbEndpoints, endpoints, protocmp.Transform())
 
 	// Without HTTP2
-	c = NewCluster(name, connectTimeout, endpoints, false, v3Cluster.Cluster_STATIC)
+	c = NewCluster(name, connectTimeout, endpoints, false, nil, v3Cluster.Cluster_STATIC)
 	assert.Assert(t, c.TypedExtensionProtocolOptions["envoy.extensions.upstreams.http.v3.HttpProtocolOptions"] == nil)
 }
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index d9f6abe9..ee6413fb 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -17,14 +17,20 @@ limitations under the License.
 package generator
 
 import (
+	"context"
 	"testing"
 	"time"
 
 	v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	envoycorev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
 	route "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	auth "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	envoymatcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
 	"github.com/google/go-cmp/cmp"
 	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/anypb"
 	"gotest.tools/v3/assert"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,6 +39,8 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/client-go/kubernetes/fake"
 	envoy "knative.dev/net-kourier/pkg/envoy/api"
+	"knative.dev/net-kourier/pkg/reconciler/ingress/config"
+	network "knative.dev/networking/pkg"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	pkgtest "knative.dev/pkg/reconciler/testing"
 )
@@ -86,6 +94,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -152,6 +161,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -235,6 +245,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -304,6 +315,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -381,6 +393,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 					envoy.NewCluster(
@@ -388,6 +401,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 					envoy.NewCluster(
@@ -395,6 +409,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						[]*endpoint.LbEndpoint{envoy.NewLBEndpoint("example.com", 80)},
 						false,
+						nil,
 						v3.Cluster_LOGICAL_DNS,
 					),
 				},
@@ -448,6 +463,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -501,6 +517,7 @@ func TestIngressTranslator(t *testing.T) {
 						5*time.Second,
 						[]*endpoint.LbEndpoint{envoy.NewLBEndpoint("example.com", 80)},
 						false,
+						nil,
 						v3.Cluster_LOGICAL_DNS,
 					),
 				},
@@ -520,7 +537,9 @@ func TestIngressTranslator(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			ctx, _ := pkgtest.SetupFakeContext(t)
+			cfg := defaultConfig.DeepCopy()
+			ctx := (&testConfigStore{config: cfg}).ToContext(context.Background())
+
 			kubeclient := fake.NewSimpleClientset(test.state...)
 
 			translator := NewIngressTranslator(
@@ -546,6 +565,29 @@ func TestIngressTranslator(t *testing.T) {
 	}
 }
 
+type testConfigStore struct {
+	config *config.Config
+}
+
+func (t *testConfigStore) ToContext(ctx context.Context) context.Context {
+	return config.ToContext(ctx, t.config)
+}
+
+var (
+	defaultConfig = &config.Config{
+		Network: &network.Config{
+			AutoTLS: false,
+		},
+	}
+	upstreamTLSConfig = &config.Config{
+		Network: &network.Config{
+			AutoTLS:      false,
+			ActivatorCA:  "test-ca",
+			ActivatorSAN: "test-san",
+		},
+	}
+)
+
 // TestIngressTranslatorWithHTTPOptionDisabled runs same redirect test in TestIngressTranslator with KOURIER_HTTPOPTION_DISABLED env value.
 func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 	tests := []struct {
@@ -611,6 +653,7 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -680,6 +723,7 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 						5*time.Second,
 						lbEndpoints,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -693,7 +737,167 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			t.Setenv("KOURIER_HTTPOPTION_DISABLED", "true")
-			ctx, _ := pkgtest.SetupFakeContext(t)
+			cfg := defaultConfig.DeepCopy()
+			ctx := (&testConfigStore{config: cfg}).ToContext(context.Background())
+			kubeclient := fake.NewSimpleClientset(test.state...)
+
+			translator := NewIngressTranslator(
+				func(ns, name string) (*corev1.Secret, error) {
+					return kubeclient.CoreV1().Secrets(ns).Get(ctx, name, metav1.GetOptions{})
+				},
+				func(ns, name string) (*corev1.Endpoints, error) {
+					return kubeclient.CoreV1().Endpoints(ns).Get(ctx, name, metav1.GetOptions{})
+				},
+				func(ns, name string) (*corev1.Service, error) {
+					return kubeclient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
+				},
+				&pkgtest.FakeTracker{},
+			)
+
+			got, err := translator.translateIngress(ctx, test.in, false)
+			assert.NilError(t, err)
+			assert.DeepEqual(t, got, test.want,
+				cmp.AllowUnexported(translatedIngress{}),
+				protocmp.Transform(),
+			)
+		})
+	}
+}
+
+func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
+	tests := []struct {
+		name  string
+		in    *v1alpha1.Ingress
+		state []runtime.Object
+		want  *translatedIngress
+	}{{
+		name: "simple",
+		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
+			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
+		}),
+		state: []runtime.Object{
+			svc("servicens", "servicename"),
+			eps("servicens", "servicename"),
+			caSecret,
+		},
+		want: func() *translatedIngress {
+			vHosts := []*route.VirtualHost{
+				envoy.NewVirtualHost(
+					"(simplens/simplename).Rules[0]",
+					[]string{"foo.example.com", "foo.example.com:*"},
+					[]*route.Route{envoy.NewRoute(
+						"(simplens/simplename).Rules[0].Paths[/test]",
+						[]*route.HeaderMatcher{{
+							Name: "testheader",
+							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
+								ExactMatch: "foo",
+							},
+						}},
+						"/test",
+						[]*route.WeightedCluster_ClusterWeight{
+							envoy.NewWeightedCluster("servicens/servicename", 100, map[string]string{"baz": "gna"}),
+						},
+						0,
+						map[string]string{"foo": "bar"},
+						""),
+					},
+				),
+			}
+
+			return &translatedIngress{
+				name: types.NamespacedName{
+					Namespace: "simplens",
+					Name:      "simplename",
+				},
+				sniMatches: []*envoy.SNIMatch{},
+				clusters: []*v3.Cluster{
+					envoy.NewCluster(
+						"servicens/servicename",
+						5*time.Second,
+						lbEndpoints,
+						false,
+						&envoycorev3.TransportSocket{
+							Name:       wellknown.TransportSocketTls,
+							ConfigType: typedConfig(false /* http2 */),
+						},
+						v3.Cluster_STATIC,
+					),
+				},
+				externalVirtualHosts:    vHosts,
+				externalTLSVirtualHosts: []*route.VirtualHost{},
+				internalVirtualHosts:    vHosts,
+			}
+		}(),
+	}, {
+		name: "http2",
+		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
+			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
+		}),
+		state: []runtime.Object{
+			svc("servicens", "servicename", func(service *corev1.Service) {
+				service.Spec.Ports = []corev1.ServicePort{{
+					Name:       "http2",
+					TargetPort: intstr.FromInt(8080),
+				}}
+			}),
+			eps("servicens", "servicename"),
+			caSecret,
+		},
+		want: func() *translatedIngress {
+			vHosts := []*route.VirtualHost{
+				envoy.NewVirtualHost(
+					"(simplens/simplename).Rules[0]",
+					[]string{"foo.example.com", "foo.example.com:*"},
+					[]*route.Route{envoy.NewRoute(
+						"(simplens/simplename).Rules[0].Paths[/test]",
+						[]*route.HeaderMatcher{{
+							Name: "testheader",
+							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
+								ExactMatch: "foo",
+							},
+						}},
+						"/test",
+						[]*route.WeightedCluster_ClusterWeight{
+							envoy.NewWeightedCluster("servicens/servicename", 100, map[string]string{"baz": "gna"}),
+						},
+						0,
+						map[string]string{"foo": "bar"},
+						""),
+					},
+				),
+			}
+
+			return &translatedIngress{
+				name: types.NamespacedName{
+					Namespace: "simplens",
+					Name:      "simplename",
+				},
+				sniMatches: []*envoy.SNIMatch{},
+				clusters: []*v3.Cluster{
+					envoy.NewCluster(
+						"servicens/servicename",
+						5*time.Second,
+						lbEndpoints,
+						true, /* http2 */
+						&envoycorev3.TransportSocket{
+							Name:       wellknown.TransportSocketTls,
+							ConfigType: typedConfig(true /* http2 */),
+						},
+						v3.Cluster_STATIC,
+					),
+				},
+				externalVirtualHosts:    vHosts,
+				externalTLSVirtualHosts: []*route.VirtualHost{},
+				internalVirtualHosts:    vHosts,
+			}
+		}(),
+	}}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cfg := upstreamTLSConfig.DeepCopy()
+			ctx := (&testConfigStore{config: cfg}).ToContext(context.Background())
+
 			kubeclient := fake.NewSimpleClientset(test.state...)
 
 			translator := NewIngressTranslator(
@@ -775,6 +979,7 @@ func TestIngressTranslatorHTTP01Challenge(t *testing.T) {
 						5*time.Second,
 						lbEndpointHTTP01Challenge,
 						false,
+						nil,
 						v3.Cluster_STATIC,
 					),
 				},
@@ -970,4 +1175,45 @@ var (
 			"tls.key": privateKey,
 		},
 	}
+	caSecret = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "knative-testing",
+			Name:      "test-ca",
+		},
+		Data: map[string][]byte{
+			caDataName: cert,
+		},
+	}
 )
+
+func typedConfig(http2 bool) *envoycorev3.TransportSocket_TypedConfig {
+	alpn := []string{""}
+	if http2 {
+		alpn = []string{"h2"}
+	}
+	tlsAny, _ := anypb.New(&auth.UpstreamTlsContext{
+		CommonTlsContext: &auth.CommonTlsContext{
+			AlpnProtocols: alpn,
+			TlsParams: &auth.TlsParameters{
+				TlsMinimumProtocolVersion: auth.TlsParameters_TLSv1_2,
+			},
+			ValidationContextType: &auth.CommonTlsContext_ValidationContext{
+				ValidationContext: &auth.CertificateValidationContext{
+					TrustedCa: &envoycorev3.DataSource{
+						Specifier: &envoycorev3.DataSource_InlineBytes{
+							InlineBytes: cert,
+						},
+					},
+					MatchSubjectAltNames: []*envoymatcherv3.StringMatcher{{
+						MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+							Exact: "test-san",
+						}},
+					},
+				},
+			},
+		},
+	})
+	return &envoycorev3.TransportSocket_TypedConfig{
+		TypedConfig: tlsAny,
+	}
+}
diff --git a/pkg/reconciler/ingress/config/store_test.go b/pkg/reconciler/ingress/config/store_test.go
index 10b004ce..cf762df3 100644
--- a/pkg/reconciler/ingress/config/store_test.go
+++ b/pkg/reconciler/ingress/config/store_test.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"knative.dev/net-kourier/pkg/config"
+	network "knative.dev/networking/pkg"
 	logtesting "knative.dev/pkg/logging/testing"
 
 	. "knative.dev/pkg/configmap/testing"
@@ -30,7 +31,9 @@ import (
 func TestStoreLoadWithContext(t *testing.T) {
 	store := NewStore(logtesting.TestLogger(t))
 	kourierConfig := ConfigMapFromTestFile(t, config.ConfigName)
+	networkConfig := ConfigMapFromTestFile(t, network.ConfigName)
 	store.OnConfigChanged(kourierConfig)
+	store.OnConfigChanged(networkConfig)
 
 	cfg := FromContext(store.ToContext(context.Background()))
 
@@ -40,9 +43,21 @@ func TestStoreLoadWithContext(t *testing.T) {
 	}
 }
 
+func TestStoreLoadWithDefaults(t *testing.T) {
+	cfg := FromContextOrDefaults(context.Background())
+
+	if diff := cmp.Diff(config.DefaultConfig(), cfg.Kourier); diff != "" {
+		t.Errorf("Unexpected defaults config (-want, +got):\n%v", diff)
+	}
+	if diff := cmp.Diff(defaultConfig(), cfg.Network); diff != "" {
+		t.Errorf("Unexpected defaults config (-want, +got):\n%v", diff)
+	}
+}
+
 func TestStoreImmutableConfig(t *testing.T) {
 	store := NewStore(logtesting.TestLogger(t))
 	store.OnConfigChanged(ConfigMapFromTestFile(t, config.ConfigName))
+	store.OnConfigChanged(ConfigMapFromTestFile(t, network.ConfigName))
 	config := store.Load()
 
 	config.Kourier.EnableServiceAccessLogging = false
diff --git a/pkg/reconciler/ingress/config/testdata/config-network.yaml b/pkg/reconciler/ingress/config/testdata/config-network.yaml
new file mode 120000
index 00000000..69c02b68
--- /dev/null
+++ b/pkg/reconciler/ingress/config/testdata/config-network.yaml
@@ -0,0 +1,1 @@
+../../../../../vendor/knative.dev/networking/config/config-network.yaml
\ No newline at end of file
diff --git a/test/config/config-network.yaml b/test/config/config-network.yaml
new file mode 120000
index 00000000..992b252b
--- /dev/null
+++ b/test/config/config-network.yaml
@@ -0,0 +1,1 @@
+../../vendor/knative.dev/networking/config/config-network.yaml
\ No newline at end of file
diff --git a/test/config/tls/config-network.yaml b/test/config/tls/config-network.yaml
new file mode 100644
index 00000000..51c849bf
--- /dev/null
+++ b/test/config/tls/config-network.yaml
@@ -0,0 +1,26 @@
+# Copyright 2022 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-network
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: devel
+    serving.knative.dev/release: devel
+data:
+  activator-ca: "serving-ca"
+  activator-san: "knative"
diff --git a/test/e2e-kind.sh b/test/e2e-kind.sh
index 68f33b9b..f290bb56 100755
--- a/test/e2e-kind.sh
+++ b/test/e2e-kind.sh
@@ -20,12 +20,18 @@ set -euo pipefail
 
 KOURIER_GATEWAY_NAMESPACE=kourier-system
 KOURIER_CONTROL_NAMESPACE=knative-serving
+TEST_NAMESPACE=serving-tests
 CLUSTER_SUFFIX=${CLUSTER_SUFFIX:-cluster.local}
 
 $(dirname $0)/upload-test-images.sh
 
 echo ">> Setup test resources"
 ko apply -f test/config
+if [[ $(kubectl get secret server-certs -n "${TEST_NAMESPACE}" -o name | wc -l) -eq 1 ]]; then
+  echo ">> Enable tls against upstream"
+  ko apply -f test/config/tls
+  export "UPSTREAM_TLS_CERT=server-certs"
+fi
 
 IPS=( $(kubectl get nodes -lkubernetes.io/hostname!=kind-control-plane -ojsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}') )
 
diff --git a/test/e2e-upgrade-kind.sh b/test/e2e-upgrade-kind.sh
index 510999b3..cc8cb16f 100755
--- a/test/e2e-upgrade-kind.sh
+++ b/test/e2e-upgrade-kind.sh
@@ -29,6 +29,11 @@ $(dirname $0)/upload-test-images.sh
 
 echo ">> Setup test resources"
 ko apply -f test/config
+if [[ $(kubectl get secret server-certs -n "${TEST_NAMESPACE}" -o name | wc -l) -eq 1 ]]; then
+  echo ">> Enable tls against upstream"
+  ko apply -f test/config/tls
+  export "UPSTREAM_TLS_CERT=server-certs"
+fi
 
 # Exclude the control-plane node, which doesn't seem to expose the nodeport service.
 IPS=( $(kubectl get nodes -lkubernetes.io/hostname!=kind-control-plane -ojsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}') )
diff --git a/test/generate-upstream-cert.sh b/test/generate-upstream-cert.sh
new file mode 100755
index 00000000..46472eb8
--- /dev/null
+++ b/test/generate-upstream-cert.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# Copyright 2022 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+SERVING_SYSTEM_NAMESPACE=knative-serving
+TEST_NAMESPACE=serving-tests
+out_dir="$(mktemp -d /tmp/certs-XXX)"
+san="knative"
+
+kubectl create ns $SERVING_SYSTEM_NAMESPACE
+kubectl create ns $TEST_NAMESPACE
+
+# Generate Root key and cert.
+openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=Example/CN=Example' -keyout "${out_dir}"/root.key -out "${out_dir}"/root.crt
+
+# Create server key
+openssl req -out "${out_dir}"/tls.csr -newkey rsa:2048 -nodes -keyout "${out_dir}"/tls.key -subj "/CN=Example/O=Example" -addext "subjectAltName = DNS:$san"
+
+# Create server certs
+openssl x509 -req -extfile <(printf "subjectAltName=DNS:$san") -days 365 -in "${out_dir}"/tls.csr -CA "${out_dir}"/root.crt -CAkey "${out_dir}"/root.key -CAcreateserial -out "${out_dir}"/tls.crt
+
+# Create secret
+kubectl create -n ${SERVING_SYSTEM_NAMESPACE} secret generic serving-ca \
+    --from-file=ca.crt="${out_dir}"/root.crt --dry-run=client -o yaml | kubectl apply -f -
+
+kubectl create -n ${TEST_NAMESPACE} secret tls server-certs \
+    --key="${out_dir}"/tls.key \
+    --cert="${out_dir}"/tls.crt --dry-run=client -o yaml | kubectl apply -f -