Repository: knative-sandbox/net-kourier
Pull request #867 (2022-07-04 14:22:46)

[main] Upgrade to latest dependencies
Cron -knative-prow-robot

/cc knative-sandbox/networking-wg-leads
/assign knative-sandbox/networking-wg-leads

Produced by: knative-sandbox/knobots/actions/update-deps

Details:
```
bumping knative.dev/control-protocol ef4c10a...827b25d:
  > 827b25d upgrade to latest dependencies (# 195)
  > 1af6f36 upgrade to latest dependencies (# 193)
bumping knative.dev/pkg 97eb150...e60d250:
  > e60d250 upgrade to latest dependencies (# 2543)
bumping knative.dev/networking c3aef9c...f087178:
  > f087178 upgrade to latest dependencies (# 689)
  > 5bf508e generate schema for networking types (# 688)
```

knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/867#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **jmprusi** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @jmprusi` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["jmprusi"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/867?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#867](https://codecov.io/gh/knative-sandbox/net-kourier/pull/867?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (1c4ba86) into [main](https://codecov.io/gh/knative-sandbox/net-kourier/commit/00505bc3cd04b5af632b7cd3516ab810d998d71e?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (00505bc) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main     #867   +/-   ##
=======================================
  Coverage   81.39%   81.39%           
=======================================
  Files          18       18           
  Lines        1172     1172           
=======================================
  Hits          954      954           
  Misses        174      174           
  Partials       44       44           
```



------

[Continue to review full report at Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/867?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/867?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Last update [00505bc...1c4ba86](https://codecov.io/gh/knative-sandbox/net-kourier/pull/867?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox).


Patch:
diff --git a/README.md b/README.md
index 9c4940d0..0a28e3b5 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,7 @@ To change the Kourier gateway namespace, you will need to:
 - TLS
 - External Authorization support.
 - Proxy Protocol (AN EXPERIMENTAL / ALPHA FEATURE)
+- Traffic Isolation (AN EXPERIMENTAL / ALPHA FEATURE)
 
 ## Setup TLS certificate
 
@@ -190,6 +191,30 @@ spec:
   type: LoadBalancer
 ```
 
+
+## Traffic Isolation Configuration
+Note: this is an experimental/alpha feature.
+
+
+To enable the traffic isolation feature, run the following command to patch `config-kourier` ConfigMap:
+```
+kubectl patch configmap/config-kourier \
+  -n knative-serving \
+  --type merge \
+  -p '{"data":{"traffic-isolation":"port"}}'
+```
+
+Ensure that the file was updated successfully:
+```
+kubectl get configmap config-kourier --namespace knative-serving --output yaml
+```
+
+Traffic isolation works by telling the `net-kourier` controller which envoy listener to use for all ingresses
+in a given namespace. When reconciling an ingress, the controller looks for the following annotation on the
+ingress namespace:
+
+- `kourier.knative.dev/listener-port`: the envoy listener port
+
 ## Tips
 Domain Mapping is configured to explicitly use `http2` protocol only. This behaviour can be disabled by adding the following annotation to the Domain Mapping resource
 ```
diff --git a/config/200-config.yaml b/config/200-config.yaml
index 16640c91..8363d251 100644
--- a/config/200-config.yaml
+++ b/config/200-config.yaml
@@ -61,3 +61,14 @@ data:
 
     # Specifies the amount of time that Kourier waits for the incoming requests.
     stream-idle-timeout: "300s"
+
+    # Control the desired level of incoming traffic isolation.
+    #
+    # When set to an empty value (default), all incoming traffic flows through
+    # a shared ingress and listeners.
+    #
+    # When set to "port", incoming traffic is isolated by using different
+    # listener ports.
+    #
+    # NOTE: This flag is in an alpha state.
+    traffic-isolation: ""
diff --git a/config/200-serviceaccount.yaml b/config/200-serviceaccount.yaml
index 76946360..8409a2b1 100644
--- a/config/200-serviceaccount.yaml
+++ b/config/200-serviceaccount.yaml
@@ -42,6 +42,9 @@ rules:
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["configmaps"]
+    verbs: [ "get", "list", "watch" ]
+  - apiGroups: [""]
+    resources: ["namespaces"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
diff --git a/go.mod b/go.mod
index 51717422..9796f43f 100644
--- a/go.mod
+++ b/go.mod
@@ -20,10 +20,10 @@ require (
 	k8s.io/apimachinery v0.23.8
 	k8s.io/client-go v0.23.8
 	k8s.io/code-generator v0.23.8
-	knative.dev/control-protocol v0.0.0-20220701014037-ef4c10a9bc76
+	knative.dev/control-protocol v0.0.0-20220705161107-827b25dce9b8
 	knative.dev/hack v0.0.0-20220701014203-65c463ac8c98
-	knative.dev/networking v0.0.0-20220701023942-c3aef9ce275a
-	knative.dev/pkg v0.0.0-20220701013933-97eb1507655e
+	knative.dev/networking v0.0.0-20220705142707-f087178076e4
+	knative.dev/pkg v0.0.0-20220705130606-e60d250dc637
 )
 
 require (
diff --git a/go.sum b/go.sum
index 259fa622..6e7f6c39 100644
--- a/go.sum
+++ b/go.sum
@@ -1183,21 +1183,15 @@ k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 h1:HNSDgDCrr/6Ly3WEGKZftiE7IY19Vz2GdbOCyI4qqhc=
 k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/control-protocol v0.0.0-20220701014037-ef4c10a9bc76 h1:I+uVQkPK8dioYUmfZ76IBwYDr391IYamQLwWetjItV8=
-knative.dev/control-protocol v0.0.0-20220701014037-ef4c10a9bc76/go.mod h1:YNtF0hqeRGMp5Dsi6wk430yT0R/A8U14BfJrNTFpt/4=
-knative.dev/hack v0.0.0-20220524153203-12d3e2a7addc/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/hack v0.0.0-20220610014127-dc6c287516dc/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/hack v0.0.0-20220629134730-e7d63651ce8f/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
+knative.dev/control-protocol v0.0.0-20220705161107-827b25dce9b8 h1:ezF3CUSNabPYv2V1oBMrILJyEZBMqFqJiAD4l+GuxyM=
+knative.dev/control-protocol v0.0.0-20220705161107-827b25dce9b8/go.mod h1:yKqKLbEEsVfwE7eEladw/1bqk8+Ai+6sghLGpWtjK90=
 knative.dev/hack v0.0.0-20220701014203-65c463ac8c98 h1:kAwcKZOwYU0QCGEwvZrgnLrynFCWnXetwR/+a4W9R70=
 knative.dev/hack v0.0.0-20220701014203-65c463ac8c98/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20220701023942-c3aef9ce275a h1:3Yc9KOhRBdU5bdPyj1NCsYS/3YACXicC3drxkcDmcqc=
-knative.dev/networking v0.0.0-20220701023942-c3aef9ce275a/go.mod h1:7LbiecGnCK3aw2VAsB3Snk3Eqy/8rKcNYNWokE0iOWQ=
-knative.dev/pkg v0.0.0-20220621173822-9c5a7317fa9d/go.mod h1:hmwyuQ6uQlqLVEM4lJGg6LZ12gbnUQv9kH88sA5pLDg=
-knative.dev/pkg v0.0.0-20220628014530-177751338ddc/go.mod h1:hmwyuQ6uQlqLVEM4lJGg6LZ12gbnUQv9kH88sA5pLDg=
-knative.dev/pkg v0.0.0-20220630222531-5569169b0cce/go.mod h1:94rzLJg0i5UOFeqtOTkVnDEmpHC93IaOeCo3ofUpTVw=
-knative.dev/pkg v0.0.0-20220701013933-97eb1507655e h1:qYqrYdHYJoZ8cevHTRP49vYdXVM3O0iTChw4+EQdOTo=
-knative.dev/pkg v0.0.0-20220701013933-97eb1507655e/go.mod h1:94rzLJg0i5UOFeqtOTkVnDEmpHC93IaOeCo3ofUpTVw=
-knative.dev/reconciler-test v0.0.0-20220628015529-24511be23df8/go.mod h1:KTK98X+RGi33WWJMCECLmELIX3UjrinnmskHDok4hPo=
+knative.dev/networking v0.0.0-20220705142707-f087178076e4 h1:rp1NY2zlov3ioyWB/mgQG3tDnSdJ0F0+2fg7T4C//Is=
+knative.dev/networking v0.0.0-20220705142707-f087178076e4/go.mod h1:Z+EvJIWmVXA/qQjq4xRMtCjhVgyxw43y/hvkIb//bTc=
+knative.dev/pkg v0.0.0-20220705130606-e60d250dc637 h1:wvz8Y/b2Ubox0pbTLAbKags19UC72Ik+b/tIW2QP9/E=
+knative.dev/pkg v0.0.0-20220705130606-e60d250dc637/go.mod h1:MxsV3ZGdrH87zv4O9HtxzbNwmiKcGwEP7UdriLINSn0=
+knative.dev/reconciler-test v0.0.0-20220705155206-f05db88effbe/go.mod h1:ujEp+LOo2TJUM/RXBqlirvyesuLAJg3rr3iuCOBINGQ=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index b47bfb1a..b9d36975 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -30,6 +30,10 @@ const (
 
 	// InternalServiceName is the name of the internal service.
 	InternalServiceName = "kourier-internal"
+
+	// IsolationServicePrefix is the prefix of the isolated services.
+	IsolationServicePrefix = "kourier-isolation-"
+
 	// ExternalServiceName is the name of the external service.
 	ExternalServiceName = "kourier"
 
@@ -67,6 +71,10 @@ const (
 	// ServingNamespaceEnv is an env variable specifying where the serving is deployed.
 	// e.g. OpenShift deploys Kourier in different namespace so `system.Namespace()` does not work.
 	ServingNamespaceEnv = "SERVING_NAMESPACE"
+
+	// ListenerPortAnnotationKey is the annotation key for assigning the ingress to a particular
+	// envoy listener port. Only applicable to internal services.
+	ListenerPortAnnotationKey = "kourier.knative.dev/listener-port"
 )
 
 var disableHTTP2Annotation = kmap.KeyPriority{
@@ -81,6 +89,10 @@ func ServiceHostnames() (string, string) {
 		network.GetServiceHostname(InternalServiceName, GatewayNamespace())
 }
 
+func ListenerServiceHostnames(port string) string {
+	return network.GetServiceHostname(IsolationServicePrefix+port, GatewayNamespace())
+}
+
 // GatewayNamespace returns the namespace where the gateway is deployed.
 func GatewayNamespace() string {
 	namespace := os.Getenv(GatewayNamespaceEnv)
diff --git a/pkg/config/configmap.go b/pkg/config/configmap.go
index 3f479001..2fc4f996 100644
--- a/pkg/config/configmap.go
+++ b/pkg/config/configmap.go
@@ -24,6 +24,9 @@ import (
 	cm "knative.dev/pkg/configmap"
 )
 
+// TrafficIsolationType is the type for traffic isolation configuration
+type TrafficIsolationType string
+
 const (
 	// ConfigName is the name of config map for Kourier.
 	ConfigName = "config-kourier"
@@ -41,6 +44,12 @@ const (
 	// IdleTimeoutKey is the config map key for the amount of time that Kourier waits
 	// for incoming requests. This value is set to "stream_idle_timeout" in Envoy.
 	IdleTimeoutKey = "stream-idle-timeout"
+
+	// trafficIsolation is the config map key for controlling the desire level of incoming traffic isolation
+	trafficIsolation = "traffic-isolation"
+
+	// IsolationIngressPort if the config map value enabling port-level traffic isolation
+	IsolationIngressPort TrafficIsolationType = "port"
 )
 
 func DefaultConfig() *Kourier {
@@ -49,6 +58,7 @@ func DefaultConfig() *Kourier {
 		EnableProxyProtocol:        false,
 		ClusterCertSecret:          "",
 		IdleTimeout:                300 * time.Second, // default value
+		TrafficIsolation:           "",
 	}
 }
 
@@ -61,6 +71,7 @@ func NewConfigFromMap(configMap map[string]string) (*Kourier, error) {
 		cm.AsBool(enableProxyProtocol, &nc.EnableProxyProtocol),
 		cm.AsString(clusterCert, &nc.ClusterCertSecret),
 		cm.AsDuration(IdleTimeoutKey, &nc.IdleTimeout),
+		cm.AsString(trafficIsolation, (*string)(&nc.TrafficIsolation)),
 	); err != nil {
 		return nil, err
 	}
@@ -90,4 +101,6 @@ type Kourier struct {
 	// this option, for example, the "timeoutSeconds" specified in Knative service is still
 	// valid.
 	IdleTimeout time.Duration
+	// Desire level of incoming traffic isolation
+	TrafficIsolation TrafficIsolationType
 }
diff --git a/pkg/generator/caches.go b/pkg/generator/caches.go
index 11e47efd..8a453107 100644
--- a/pkg/generator/caches.go
+++ b/pkg/generator/caches.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"errors"
 	"os"
+	"strconv"
 	"sync"
 
 	v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
@@ -47,6 +48,7 @@ const (
 	externalRouteConfigName    = "external_services"
 	externalTLSRouteConfigName = "external_tls_services"
 	internalRouteConfigName    = "internal_services"
+	isolationRouteConfigName   = "isolation_services"
 	internalTLSRouteConfigName = "internal_tls_services"
 )
 
@@ -63,6 +65,11 @@ type Caches struct {
 	kubeClient kubeclient.Interface
 }
 
+type portVHost struct {
+	port  string
+	vhost []*route.VirtualHost
+}
+
 func NewCaches(ctx context.Context, kubernetesClient kubeclient.Interface, extAuthz bool) (*Caches, error) {
 	c := &Caches{
 		translatedIngresses: make(map[types.NamespacedName]*translatedIngress),
@@ -136,8 +143,18 @@ func (caches *Caches) ToEnvoySnapshot(ctx context.Context) (cache.Snapshot, erro
 	externalTLSVHosts := make([]*route.VirtualHost, 0, len(caches.translatedIngresses))
 	snis := sniMatches{}
 
+	localVHostsPerListener := make(map[string]portVHost)
+
 	for _, translatedIngress := range caches.translatedIngresses {
-		localVHosts = append(localVHosts, translatedIngress.internalVirtualHosts...)
+		if translatedIngress.listenerPort != "" {
+			localVHostsPerListener[translatedIngress.listenerPort] = portVHost{
+				port:  translatedIngress.listenerPort,
+				vhost: append(localVHostsPerListener[translatedIngress.listenerPort].vhost, translatedIngress.internalVirtualHosts...),
+			}
+		} else {
+			localVHosts = append(localVHosts, translatedIngress.internalVirtualHosts...)
+		}
+
 		externalVHosts = append(externalVHosts, translatedIngress.externalVirtualHosts...)
 		externalTLSVHosts = append(externalTLSVHosts, translatedIngress.externalTLSVirtualHosts...)
 
@@ -145,6 +162,7 @@ func (caches *Caches) ToEnvoySnapshot(ctx context.Context) (cache.Snapshot, erro
 			snis.consume(match)
 		}
 	}
+
 	// Append the statusHost too.
 	localVHosts = append(localVHosts, caches.statusVirtualHost)
 
@@ -153,6 +171,7 @@ func (caches *Caches) ToEnvoySnapshot(ctx context.Context) (cache.Snapshot, erro
 		externalVHosts,
 		externalTLSVHosts,
 		localVHosts,
+		localVHostsPerListener,
 		snis.list(),
 		caches.kubeClient,
 	)
@@ -207,6 +226,7 @@ func generateListenersAndRouteConfigs(
 	externalVirtualHosts []*route.VirtualHost,
 	externalTLSVirtualHosts []*route.VirtualHost,
 	clusterLocalVirtualHosts []*route.VirtualHost,
+	clusterLocalVirtualHostsPerListener map[string]portVHost,
 	sniMatches []*envoy.SNIMatch,
 	kubeclient kubeclient.Interface) ([]cachetypes.Resource, []cachetypes.Resource, error) {
 
@@ -220,10 +240,22 @@ func generateListenersAndRouteConfigs(
 	externalTLSRouteConfig := envoy.NewRouteConfig(externalTLSRouteConfigName, externalTLSVirtualHosts)
 	internalRouteConfig := envoy.NewRouteConfig(internalRouteConfigName, clusterLocalVirtualHosts)
 
+	internalListenersRouteConfig := make(map[string]*route.RouteConfiguration, len(clusterLocalVirtualHostsPerListener))
+	for listenerPort, portVhosts := range clusterLocalVirtualHostsPerListener {
+		routeName := isolationRouteConfigName + "_" + listenerPort
+		internalListenersRouteConfig[listenerPort] = envoy.NewRouteConfig(routeName, portVhosts.vhost)
+	}
+
 	// Now we setup connection managers, that reference the routeconfigs via RDS.
 	externalManager := envoy.NewHTTPConnectionManager(externalRouteConfig.Name, cfg.Kourier)
 	externalTLSManager := envoy.NewHTTPConnectionManager(externalTLSRouteConfig.Name, cfg.Kourier)
 	internalManager := envoy.NewHTTPConnectionManager(internalRouteConfig.Name, cfg.Kourier)
+
+	internalListenerManagers := make(map[string]*httpconnmanagerv3.HttpConnectionManager, len(internalListenersRouteConfig))
+	for listenerPort, internalListenerRouteConfig := range internalListenersRouteConfig {
+		internalListenerManagers[listenerPort] = envoy.NewHTTPConnectionManager(internalListenerRouteConfig.Name, cfg.Kourier)
+	}
+
 	externalHTTPEnvoyListener, err := envoy.NewHTTPListener(externalManager, config.HTTPPortExternal, cfg.Kourier.EnableProxyProtocol)
 	if err != nil {
 		return nil, nil, err
@@ -236,6 +268,20 @@ func generateListenersAndRouteConfigs(
 	listeners := []cachetypes.Resource{externalHTTPEnvoyListener, internalEnvoyListener}
 	routes := []cachetypes.Resource{externalRouteConfig, internalRouteConfig}
 
+	for listenerPort, portVhosts := range clusterLocalVirtualHostsPerListener {
+		port, err := strconv.ParseInt(portVhosts.port, 10, 32)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		envoyListener, err := envoy.NewHTTPListener(internalListenerManagers[listenerPort], uint32(port), false)
+		if err != nil {
+			return nil, nil, err
+		}
+		listeners = append(listeners, envoyListener)
+		routes = append(routes, internalListenersRouteConfig[listenerPort])
+	}
+
 	// create probe listeners
 	probHTTPListener, err := envoy.NewHTTPListener(externalManager, config.HTTPPortProb, false)
 	if err != nil {
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 4e1c0c0e..557825b9 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -47,6 +47,7 @@ import (
 
 type translatedIngress struct {
 	name                    types.NamespacedName
+	listenerPort            string
 	sniMatches              []*envoy.SNIMatch
 	clusters                []*v3.Cluster
 	externalVirtualHosts    []*route.VirtualHost
@@ -58,6 +59,7 @@ type IngressTranslator struct {
 	secretGetter    func(ns, name string) (*corev1.Secret, error)
 	endpointsGetter func(ns, name string) (*corev1.Endpoints, error)
 	serviceGetter   func(ns, name string) (*corev1.Service, error)
+	namespaceGetter func(name string) (*corev1.Namespace, error)
 	tracker         tracker.Interface
 }
 
@@ -65,11 +67,13 @@ func NewIngressTranslator(
 	secretGetter func(ns, name string) (*corev1.Secret, error),
 	endpointsGetter func(ns, name string) (*corev1.Endpoints, error),
 	serviceGetter func(ns, name string) (*corev1.Service, error),
+	namespaceGetter func(name string) (*corev1.Namespace, error),
 	tracker tracker.Interface) IngressTranslator {
 	return IngressTranslator{
 		secretGetter:    secretGetter,
 		endpointsGetter: endpointsGetter,
 		serviceGetter:   serviceGetter,
+		namespaceGetter: namespaceGetter,
 		tracker:         tracker,
 	}
 }
@@ -259,12 +263,31 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 			}
 		}
 	}
+	listenerPort := ""
+
+	if config.FromContextOrDefaults(ctx).Kourier.TrafficIsolation == pkgconfig.IsolationIngressPort {
+		ns, err := translator.namespaceGetter(ingress.Namespace)
+		if err != nil {
+			return nil, err
+		}
+
+		if ns.Annotations != nil {
+			if value, ok := ns.Annotations[pkgconfig.ListenerPortAnnotationKey]; ok {
+				listenerPort = value
+
+				logger.Infof("mapping ingress %s/%s to port %v", ingress.Namespace, ingress.Name, listenerPort)
+			}
+		}
+
+		// REVISIT: When neither labels/annotations if found then default to the default behavior (no isolation)
+	}
 
 	return &translatedIngress{
 		name: types.NamespacedName{
 			Namespace: ingress.Namespace,
 			Name:      ingress.Name,
 		},
+		listenerPort:            listenerPort,
 		sniMatches:              sniMatches,
 		clusters:                clusters,
 		externalVirtualHosts:    externalHosts,
diff --git a/pkg/reconciler/ingress/controller.go b/pkg/reconciler/ingress/controller.go
index 03358623..b036e7f5 100644
--- a/pkg/reconciler/ingress/controller.go
+++ b/pkg/reconciler/ingress/controller.go
@@ -42,6 +42,7 @@ import (
 	"knative.dev/networking/pkg/status"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
 	endpointsinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/endpoints"
+	nsinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/namespace"
 	podinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/pod"
 	secretfilteredinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret/filtered"
 	serviceinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/service"
@@ -76,6 +77,7 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 	serviceInformer := serviceinformer.Get(ctx)
 	podInformer := podinformer.Get(ctx)
 	secretInformer := getSecretInformer(ctx)
+	namespaceInformer := nsinformer.Get(ctx)
 
 	// Create a new Cache, with the Readiness endpoint enabled, and the list of current Ingresses.
 	caches, err := generator.NewCaches(ctx, kubernetesClient, config.ExternalAuthz.Enabled)
@@ -84,8 +86,9 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 	}
 
 	r := &Reconciler{
-		caches:   caches,
-		extAuthz: config.ExternalAuthz.Enabled,
+		caches:          caches,
+		extAuthz:        config.ExternalAuthz.Enabled,
+		namespaceLister: namespaceInformer.Lister(),
 	}
 
 	impl := v1alpha1ingress.NewImpl(ctx, r, config.KourierIngressClassName, func(impl *controller.Impl) controller.Options {
@@ -159,7 +162,7 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 
 	statusProber := status.NewProber(
 		logger.Named("status-manager"),
-		NewProbeTargetLister(logger, endpointsInformer.Lister()),
+		NewProbeTargetLister(logger, endpointsInformer.Lister(), namespaceInformer.Lister()),
 		func(ing *v1alpha1.Ingress) {
 			logger.Debugf("Ready callback triggered for ingress: %s/%s", ing.Namespace, ing.Name)
 			impl.EnqueueKey(types.NamespacedName{Namespace: ing.Namespace, Name: ing.Name})
@@ -184,6 +187,9 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 		func(ns, name string) (*corev1.Service, error) {
 			return serviceInformer.Lister().Services(ns).Get(name)
 		},
+		func(name string) (*corev1.Namespace, error) {
+			return namespaceInformer.Lister().Get(name)
+		},
 		impl.Tracker)
 	r.ingressTranslator = &ingressTranslator
 
@@ -216,6 +222,9 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl
 		func(ns, name string) (*corev1.Service, error) {
 			return kubernetesClient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
 		},
+		func(name string) (*corev1.Namespace, error) {
+			return kubernetesClient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+		},
 		impl.Tracker)
 
 	for _, ingress := range ingressesToSync {
diff --git a/pkg/reconciler/ingress/ingress.go b/pkg/reconciler/ingress/ingress.go
index 5688f3d8..4ff107ae 100644
--- a/pkg/reconciler/ingress/ingress.go
+++ b/pkg/reconciler/ingress/ingress.go
@@ -22,9 +22,11 @@ import (
 	"fmt"
 
 	"k8s.io/apimachinery/pkg/types"
+	corev1listers "k8s.io/client-go/listers/core/v1"
 	"knative.dev/net-kourier/pkg/config"
 	envoy "knative.dev/net-kourier/pkg/envoy/server"
 	"knative.dev/net-kourier/pkg/generator"
+	ingressconfig "knative.dev/net-kourier/pkg/reconciler/ingress/config"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	"knative.dev/networking/pkg/client/injection/reconciler/networking/v1alpha1/ingress"
 	"knative.dev/networking/pkg/status"
@@ -43,6 +45,7 @@ type Reconciler struct {
 	statusManager     *status.Prober
 	ingressTranslator *generator.IngressTranslator
 	extAuthz          bool
+	namespaceLister   corev1listers.NamespaceLister
 
 	// resyncConflicts triggers a filtered global resync to reenqueue all ingresses in
 	// a "Conflict" state.
@@ -77,6 +80,20 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ing *v1alpha1.Ingress) r
 		}
 		if ready {
 			external, internal := config.ServiceHostnames()
+
+			if ingressconfig.FromContextOrDefaults(ctx).Kourier.TrafficIsolation == config.IsolationIngressPort {
+				ns, err := r.namespaceLister.Get(ing.Namespace)
+				if err != nil {
+					return fmt.Errorf("failed to get namespace: %w", err)
+				}
+
+				if ns.Annotations != nil {
+					if port, ok := ns.Annotations[config.ListenerPortAnnotationKey]; ok {
+						internal = config.ListenerServiceHostnames(port)
+					}
+				}
+			}
+
 			ing.Status.MarkLoadBalancerReady(
 				[]v1alpha1.LoadBalancerIngressStatus{{DomainInternal: external}},
 				[]v1alpha1.LoadBalancerIngressStatus{{DomainInternal: internal}},
diff --git a/pkg/reconciler/ingress/lister.go b/pkg/reconciler/ingress/lister.go
index bef01f0e..8c90e5c1 100644
--- a/pkg/reconciler/ingress/lister.go
+++ b/pkg/reconciler/ingress/lister.go
@@ -26,20 +26,23 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	corev1listers "k8s.io/client-go/listers/core/v1"
 	"knative.dev/net-kourier/pkg/config"
+	ingressconfig "knative.dev/net-kourier/pkg/reconciler/ingress/config"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	"knative.dev/networking/pkg/status"
 )
 
-func NewProbeTargetLister(logger *zap.SugaredLogger, endpointsLister corev1listers.EndpointsLister) status.ProbeTargetLister {
+func NewProbeTargetLister(logger *zap.SugaredLogger, endpointsLister corev1listers.EndpointsLister, namespaceLister corev1listers.NamespaceLister) status.ProbeTargetLister {
 	return &gatewayPodTargetLister{
 		logger:          logger,
 		endpointsLister: endpointsLister,
+		namespaceLister: namespaceLister,
 	}
 }
 
 type gatewayPodTargetLister struct {
 	logger          *zap.SugaredLogger
 	endpointsLister corev1listers.EndpointsLister
+	namespaceLister corev1listers.NamespaceLister
 }
 
 func (l *gatewayPodTargetLister) ListProbeTargets(ctx context.Context, ing *v1alpha1.Ingress) ([]status.ProbeTarget, error) {
@@ -57,10 +60,10 @@ func (l *gatewayPodTargetLister) ListProbeTargets(ctx context.Context, ing *v1al
 	if len(readyIPs) == 0 {
 		return nil, fmt.Errorf("no gateway pods available")
 	}
-	return l.getIngressUrls(ing, readyIPs)
+	return l.getIngressUrls(ctx, ing, readyIPs)
 }
 
-func (l *gatewayPodTargetLister) getIngressUrls(ing *v1alpha1.Ingress, gatewayIps []string) ([]status.ProbeTarget, error) {
+func (l *gatewayPodTargetLister) getIngressUrls(ctx context.Context, ing *v1alpha1.Ingress, gatewayIps []string) ([]status.ProbeTarget, error) {
 	ips := sets.NewString(gatewayIps...)
 
 	targets := make([]status.ProbeTarget, 0, len(ing.Spec.Rules))
@@ -82,9 +85,24 @@ func (l *gatewayPodTargetLister) getIngressUrls(ing *v1alpha1.Ingress, gatewayIp
 				target.URLs = domainsToURL(domains, scheme)
 			}
 		} else {
+			podPort := strconv.Itoa(int(config.HTTPPortInternal))
+
+			if ingressconfig.FromContextOrDefaults(ctx).Kourier.TrafficIsolation == config.IsolationIngressPort {
+				ns, err := l.namespaceLister.Get(ing.Namespace)
+				if err != nil {
+					return nil, fmt.Errorf("failed to get the ingress namespace: %w", err)
+				}
+
+				if ns.Annotations != nil {
+					if value, ok := ns.Annotations[config.ListenerPortAnnotationKey]; ok {
+						podPort = value
+					}
+				}
+			}
+
 			target = status.ProbeTarget{
 				PodIPs:  ips,
-				PodPort: strconv.Itoa(int(config.HTTPPortInternal)),
+				PodPort: podPort,
 				URLs:    domainsToURL(domains, scheme),
 			}
 		}
diff --git a/vendor/knative.dev/networking/config/certificate.yaml b/vendor/knative.dev/networking/config/certificate.yaml
index 14f1fb77..d25186f0 100644
--- a/vendor/knative.dev/networking/config/certificate.yaml
+++ b/vendor/knative.dev/networking/config/certificate.yaml
@@ -24,33 +24,120 @@ metadata:
 spec:
   group: networking.internal.knative.dev
   versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    subresources:
-      status: {}
-    schema:
-      openAPIV3Schema:
-        type: object
-        # this is a work around so we don't need to flush out the
-        # schema for each version at this time
-        #
-        # see issue: https://github.com/knative/serving/issues/912
-        x-kubernetes-preserve-unknown-fields: true
-    additionalPrinterColumns:
-    - name: Ready
-      type: string
-      jsonPath: ".status.conditions[?(@.type==\"Ready\")].status"
-    - name: Reason
-      type: string
-      jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: Certificate is responsible for provisioning a SSL certificate for the given hosts. It is a Knative abstraction for various SSL certificate provisioning solutions (such as cert-manager or self-signed SSL certificate).
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'Spec is the desired state of the Certificate. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              required:
+                - dnsNames
+                - secretName
+              properties:
+                dnsNames:
+                  description: DNSNames is a list of DNS names the Certificate could support. The wildcard format of DNSNames (e.g. *.default.example.com) is supported.
+                  type: array
+                  items:
+                    type: string
+                secretName:
+                  description: SecretName is the name of the secret resource to store the SSL certificate in.
+                  type: string
+            status:
+              description: 'Status is the current state of the Certificate. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                annotations:
+                  description: Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: 'Condition defines a readiness condition for a Knative resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties'
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                http01Challenges:
+                  description: HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled in order to get the TLS certificate..
+                  type: array
+                  items:
+                    description: HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs to fulfill.
+                    type: object
+                    properties:
+                      serviceName:
+                        description: ServiceName is the name of the service to serve HTTP01 challenge requests.
+                        type: string
+                      serviceNamespace:
+                        description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests.
+                        type: string
+                      servicePort:
+                        description: ServicePort is the port of the service to serve HTTP01 challenge requests.
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        x-kubernetes-int-or-string: true
+                      url:
+                        description: URL is the URL that the HTTP01 challenge is expected to serve on.
+                        type: string
+                notAfter:
+                  description: The expiration time of the TLS certificate stored in the secret named by this resource in spec.secretName.
+                  type: string
+                  format: date-time
+                observedGeneration:
+                  description: ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.
+                  type: integer
+                  format: int64
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type==\"Ready\")].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
   names:
     kind: Certificate
     plural: certificates
     singular: certificate
     categories:
-    - knative-internal
-    - networking
+      - knative-internal
+      - networking
     shortNames:
-    - kcert
+      - kcert
   scope: Namespaced
diff --git a/vendor/knative.dev/networking/config/domain-claim.yaml b/vendor/knative.dev/networking/config/domain-claim.yaml
index 0045e2b3..33f39e57 100644
--- a/vendor/knative.dev/networking/config/domain-claim.yaml
+++ b/vendor/knative.dev/networking/config/domain-claim.yaml
@@ -24,26 +24,40 @@ metadata:
 spec:
   group: networking.internal.knative.dev
   versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    subresources:
-      status: {}
-    schema:
-      openAPIV3Schema:
-        type: object
-        # this is a work around so we don't need to flush out the
-        # schema for each version at this time
-        #
-        # see issue: https://github.com/knative/serving/issues/912
-        x-kubernetes-preserve-unknown-fields: true
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'Spec is the desired state of the ClusterDomainClaim. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              required:
+                - namespace
+              properties:
+                namespace:
+                  description: Namespace is the namespace which is allowed to create a DomainMapping using this ClusterDomainClaim's name.
+                  type: string
   names:
     kind: ClusterDomainClaim
     plural: clusterdomainclaims
     singular: clusterdomainclaim
     categories:
-    - knative-internal
-    - networking
+      - knative-internal
+      - networking
     shortNames:
-    - cdc
+      - cdc
   scope: Cluster
diff --git a/vendor/knative.dev/networking/config/domain.yaml b/vendor/knative.dev/networking/config/domain.yaml
index 87ba1e08..eed5fcb1 100644
--- a/vendor/knative.dev/networking/config/domain.yaml
+++ b/vendor/knative.dev/networking/config/domain.yaml
@@ -24,26 +24,120 @@ metadata:
 spec:
   group: networking.internal.knative.dev
   versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    subresources:
-      status: {}
-    schema:
-      openAPIV3Schema:
-        type: object
-        # this is a work around so we don't need to flush out the
-        # schema for each version at this time
-        #
-        # see issue: https://github.com/knative/serving/issues/912
-        x-kubernetes-preserve-unknown-fields: true
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: Domain is a cluster-scoped resource to configure a proxy pool for a given Route.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'Spec is the desired state of the Domain. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              required:
+                - ingressClass
+                - loadBalancers
+              properties:
+                configs:
+                  description: Configs contains additional pieces of information to configure ingress proxies.
+                  type: array
+                  items:
+                    description: IngressConfig allows KIngress implementations to add additional information needed for configuring the proxies associated with this Domain. For examples, in our Istio-based Ingress this will contains all references of Istio Gateways associated with this Domain. This could be a reference of a ConfigMap owned by the implementation as well.
+                    type: object
+                    properties:
+                      name:
+                        description: Name of the Kingress implementation resource
+                        type: string
+                      namespace:
+                        description: Namespace of the Kingress implementation resource
+                        type: string
+                      type:
+                        description: Type of the Kingress implementation resource
+                        type: string
+                ingressClass:
+                  description: IngressClass tells what Ingress class annotation to use for Routes associated with this Realm.
+                  type: string
+                loadBalancers:
+                  description: LoadBalancers provide addresses (IP addresses, domains) of the load balancers associated with this Domain.  This is used in automatic DNS provisioning like configuration of magic DNS or creating ExternalName services for cluster-local access.
+                  type: array
+                  items:
+                    description: 'LoadBalancerIngressSpec represents the spec of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.'
+                    type: object
+                    properties:
+                      domain:
+                        description: Domain is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
+                        type: string
+                      domainInternal:
+                        description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress. \n NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh."
+                        type: string
+                      ip:
+                        description: IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
+                        type: string
+                      meshOnly:
+                        description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                        type: boolean
+                suffix:
+                  description: Suffix specifies the domain suffix to be used. This field replaces the existing config-domain ConfigMap.  Internal Domains can omit this, in which case we will default to the cluster suffix.
+                  type: string
+            status:
+              description: 'Status is the current state of the Domain. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                annotations:
+                  description: Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: 'Condition defines a readiness condition for a Knative resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties'
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.
+                  type: integer
+                  format: int64
   names:
     kind: Domain
     plural: domains
     singular: domain
     categories:
-    - knative-internal
-    - networking
+      - knative-internal
+      - networking
     shortNames:
-    - dom
+      - dom
   scope: Cluster
diff --git a/vendor/knative.dev/networking/config/ingress.yaml b/vendor/knative.dev/networking/config/ingress.yaml
index 7f4cff2b..aafed926 100644
--- a/vendor/knative.dev/networking/config/ingress.yaml
+++ b/vendor/knative.dev/networking/config/ingress.yaml
@@ -24,34 +24,234 @@ metadata:
 spec:
   group: networking.internal.knative.dev
   versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    subresources:
-      status: {}
-    schema:
-      openAPIV3Schema:
-        type: object
-        # this is a work around so we don't need to flush out the
-        # schema for each version at this time
-        #
-        # see issue: https://github.com/knative/serving/issues/912
-        x-kubernetes-preserve-unknown-fields: true
-    additionalPrinterColumns:
-    - name: Ready
-      type: string
-      jsonPath: ".status.conditions[?(@.type=='Ready')].status"
-    - name: Reason
-      type: string
-      jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable URLs, load balance traffic, offer name based virtual hosting, etc. \n This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress which some highlighted modifications."
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'Spec is the desired state of the Ingress. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                httpOption:
+                  description: 'HTTPOption is the option of HTTP. It has the following two values: `HTTPOptionEnabled`, `HTTPOptionRedirected`'
+                  type: string
+                rules:
+                  description: A list of host rules used to configure the Ingress.
+                  type: array
+                  items:
+                    description: IngressRule represents the rules mapping the paths under a specified host to the related backend services. Incoming requests are first evaluated for a host match, then routed to the backend associated with the matching IngressRuleValue.
+                    type: object
+                    properties:
+                      hosts:
+                        description: 'Host is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the "host" part of the URI as defined in the RFC: 1. IPs are not allowed. Currently a rule value can only apply to the IP in the Spec of the parent . 2. The `:` delimiter is not respected because ports are not allowed. Currently the port of an Ingress is implicitly :80 for http and :443 for https. Both these may change in the future. If the host is unspecified, the Ingress routes all traffic based on the specified IngressRuleValue. If multiple matching Hosts were provided, the first rule will take precedent.'
+                        type: array
+                        items:
+                          type: string
+                      http:
+                        description: HTTP represents a rule to apply against incoming requests. If the rule is satisfied, the request is routed to the specified backend.
+                        type: object
+                        required:
+                          - paths
+                        properties:
+                          paths:
+                            description: "A collection of paths that map requests to backends. \n If they are multiple matching paths, the first match takes precedence."
+                            type: array
+                            items:
+                              description: HTTPIngressPath associates a path regex with a backend. Incoming URLs matching the path are forwarded to the backend.
+                              type: object
+                              required:
+                                - splits
+                              properties:
+                                appendHeaders:
+                                  description: "AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. \n NOTE: This differs from K8s Ingress which doesn't allow header appending."
+                                  type: object
+                                  additionalProperties:
+                                    type: string
+                                headers:
+                                  description: Headers defines header matching rules which is a map from a header name to HeaderMatch which specify a matching condition. When a request matched with all the header matching rules, the request is routed by the corresponding ingress rule. If it is empty, the headers are not used for matching
+                                  type: object
+                                  additionalProperties:
+                                    description: HeaderMatch represents a matching value of Headers in HTTPIngressPath. Currently, only the exact matching is supported.
+                                    type: object
+                                    required:
+                                      - exact
+                                    properties:
+                                      exact:
+                                        type: string
+                                path:
+                                  description: Path represents a literal prefix to which this rule should apply. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a '/'. If unspecified, the path defaults to a catch all sending traffic to the backend.
+                                  type: string
+                                rewriteHost:
+                                  description: "RewriteHost rewrites the incoming request's host header. \n This field is currently experimental and not supported by all Ingress implementations."
+                                  type: string
+                                splits:
+                                  description: Splits defines the referenced service endpoints to which the traffic will be forwarded to.
+                                  type: array
+                                  items:
+                                    description: IngressBackendSplit describes all endpoints for a given service and port.
+                                    type: object
+                                    required:
+                                      - serviceName
+                                      - serviceNamespace
+                                      - servicePort
+                                    properties:
+                                      appendHeaders:
+                                        description: "AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. \n NOTE: This differs from K8s Ingress which doesn't allow header appending."
+                                        type: object
+                                        additionalProperties:
+                                          type: string
+                                      percent:
+                                        description: "Specifies the split percentage, a number between 0 and 100.  If only one split is specified, we default to 100. \n NOTE: This differs from K8s Ingress to allow percentage split."
+                                        type: integer
+                                      serviceName:
+                                        description: Specifies the name of the referenced service.
+                                        type: string
+                                      serviceNamespace:
+                                        description: "Specifies the namespace of the referenced service. \n NOTE: This differs from K8s Ingress to allow routing to different namespaces."
+                                        type: string
+                                      servicePort:
+                                        description: Specifies the port of the referenced service.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                      visibility:
+                        description: Visibility signifies whether this rule should `ClusterLocal`. If it's not specified then it defaults to `ExternalIP`.
+                        type: string
+                tls:
+                  description: 'TLS configuration. Currently Ingress only supports a single TLS port: 443. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension, if the ingress controller fulfilling the ingress supports SNI.'
+                  type: array
+                  items:
+                    description: IngressTLS describes the transport layer security associated with an Ingress.
+                    type: object
+                    properties:
+                      hosts:
+                        description: Hosts is a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified.
+                        type: array
+                        items:
+                          type: string
+                      secretName:
+                        description: SecretName is the name of the secret used to terminate SSL traffic.
+                        type: string
+                      secretNamespace:
+                        description: SecretNamespace is the namespace of the secret used to terminate SSL traffic. If not set the namespace should be assumed to be the same as the Ingress. If set the secret should have the same namespace as the Ingress otherwise the behaviour is undefined and not supported.
+                        type: string
+            status:
+              description: 'Status is the current state of the Ingress. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                annotations:
+                  description: Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: 'Condition defines a readiness condition for a Knative resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties'
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.
+                  type: integer
+                  format: int64
+                privateLoadBalancer:
+                  description: PrivateLoadBalancer contains the current status of the load-balancer.
+                  type: object
+                  properties:
+                    ingress:
+                      description: Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
+                      type: array
+                      items:
+                        description: 'LoadBalancerIngressStatus represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.'
+                        type: object
+                        properties:
+                          domain:
+                            description: Domain is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
+                            type: string
+                          domainInternal:
+                            description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress. \n NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh."
+                            type: string
+                          ip:
+                            description: IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
+                            type: string
+                          meshOnly:
+                            description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                            type: boolean
+                publicLoadBalancer:
+                  description: PublicLoadBalancer contains the current status of the load-balancer.
+                  type: object
+                  properties:
+                    ingress:
+                      description: Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
+                      type: array
+                      items:
+                        description: 'LoadBalancerIngressStatus represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.'
+                        type: object
+                        properties:
+                          domain:
+                            description: Domain is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
+                            type: string
+                          domainInternal:
+                            description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress. \n NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh."
+                            type: string
+                          ip:
+                            description: IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
+                            type: string
+                          meshOnly:
+                            description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                            type: boolean
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
   names:
     kind: Ingress
     plural: ingresses
     singular: ingress
     categories:
-    - knative-internal
-    - networking
+      - knative-internal
+      - networking
     shortNames:
-    - kingress
-    - king
+      - kingress
+      - king
   scope: Namespaced
diff --git a/vendor/knative.dev/networking/config/realm.yaml b/vendor/knative.dev/networking/config/realm.yaml
index 93572454..71ba92f0 100644
--- a/vendor/knative.dev/networking/config/realm.yaml
+++ b/vendor/knative.dev/networking/config/realm.yaml
@@ -24,31 +24,87 @@ metadata:
 spec:
   group: networking.internal.knative.dev
   versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    subresources:
-      status: {}
-    schema:
-      openAPIV3Schema:
-        type: object
-        # this is a work around so we don't need to flush out the
-        # schema for each version at this time
-        #
-        # see issue: https://github.com/knative/serving/issues/912
-        x-kubernetes-preserve-unknown-fields: true
-    additionalPrinterColumns:
-    - name: Ready
-      type: string
-      jsonPath: ".status.conditions[?(@.type=='Ready')].status"
-    - name: Reason
-      type: string
-      jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: Realm is a cluster-scoped resource that specifies a Route visibility.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'Spec is the desired state of the Realm. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                external:
+                  description: External contains the name of the Domain resource corresponding with traffic originating from outside of the cluster.  Could be omitted for a Realm without external access.
+                  type: string
+                internal:
+                  description: Internal contains the name of the Domain resource corresponding with traffic originating from inside of the cluster.  Could be omitted for a Realm without internal access.
+                  type: string
+            status:
+              description: 'Status is the current state of the Realm. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                annotations:
+                  description: Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: 'Condition defines a readiness condition for a Knative resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties'
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.
+                  type: integer
+                  format: int64
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
   names:
     kind: Realm
     plural: realms
     singular: realm
     categories:
-    - knative-internal
-    - networking
+      - knative-internal
+      - networking
   scope: Cluster
diff --git a/vendor/knative.dev/networking/config/serverlessservice.yaml b/vendor/knative.dev/networking/config/serverlessservice.yaml
index 4626b520..9e6d6e5b 100644
--- a/vendor/knative.dev/networking/config/serverlessservice.yaml
+++ b/vendor/knative.dev/networking/config/serverlessservice.yaml
@@ -24,45 +24,140 @@ metadata:
 spec:
   group: networking.internal.knative.dev
   versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    subresources:
-      status: {}
-    schema:
-      openAPIV3Schema:
-        type: object
-        # this is a work around so we don't need to flush out the
-        # schema for each version at this time
-        #
-        # see issue: https://github.com/knative/serving/issues/912
-        x-kubernetes-preserve-unknown-fields: true
-    additionalPrinterColumns:
-    - name: Mode
-      type: string
-      jsonPath: ".spec.mode"
-    - name: Activators
-      type: integer
-      jsonPath: ".spec.numActivators"
-    - name: ServiceName
-      type: string
-      jsonPath: ".status.serviceName"
-    - name: PrivateServiceName
-      type: string
-      jsonPath: ".status.privateServiceName"
-    - name: Ready
-      type: string
-      jsonPath: ".status.conditions[?(@.type=='Ready')].status"
-    - name: Reason
-      type: string
-      jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: 'ServerlessService is a proxy for the K8s service objects containing the endpoints for the revision, whether those are endpoints of the activator or revision pods. See: https://knative.page.link/naxz for details.'
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'Spec is the desired state of the ServerlessService. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              required:
+                - objectRef
+                - protocolType
+              properties:
+                mode:
+                  description: Mode describes the mode of operation of the ServerlessService.
+                  type: string
+                numActivators:
+                  description: NumActivators contains number of Activators that this revision should be assigned. O means — assign all.
+                  type: integer
+                  format: int32
+                objectRef:
+                  description: ObjectRef defines the resource that this ServerlessService is responsible for making "serverless".
+                  type: object
+                  properties:
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    fieldPath:
+                      description: 'If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.'
+                      type: string
+                    kind:
+                      description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+                      type: string
+                    name:
+                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                      type: string
+                    namespace:
+                      description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                      type: string
+                    resourceVersion:
+                      description: 'Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
+                      type: string
+                    uid:
+                      description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
+                      type: string
+                  x-kubernetes-map-type: atomic
+                protocolType:
+                  description: The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision. serving imports networking, so just use string.
+                  type: string
+            status:
+              description: 'Status is the current state of the ServerlessService. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
+              type: object
+              properties:
+                annotations:
+                  description: Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: 'Condition defines a readiness condition for a Knative resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties'
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.
+                  type: integer
+                  format: int64
+                privateServiceName:
+                  description: PrivateServiceName holds the name of a core K8s Service resource that load balances over the user service pods backing this Revision.
+                  type: string
+                serviceName:
+                  description: ServiceName holds the name of a core K8s Service resource that load balances over the pods backing this Revision (activator or revision).
+                  type: string
+      additionalPrinterColumns:
+        - name: Mode
+          type: string
+          jsonPath: ".spec.mode"
+        - name: Activators
+          type: integer
+          jsonPath: ".spec.numActivators"
+        - name: ServiceName
+          type: string
+          jsonPath: ".status.serviceName"
+        - name: PrivateServiceName
+          type: string
+          jsonPath: ".status.privateServiceName"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
   names:
     kind: ServerlessService
     plural: serverlessservices
     singular: serverlessservice
     categories:
-    - knative-internal
-    - networking
+      - knative-internal
+      - networking
     shortNames:
-    - sks
+      - sks
   scope: Namespaced
diff --git a/vendor/knative.dev/pkg/client/injection/kube/informers/core/v1/namespace/namespace.go b/vendor/knative.dev/pkg/client/injection/kube/informers/core/v1/namespace/namespace.go
new file mode 100644
index 00000000..aa57e789
--- /dev/null
+++ b/vendor/knative.dev/pkg/client/injection/kube/informers/core/v1/namespace/namespace.go
@@ -0,0 +1,110 @@
+/*
+Copyright 2022 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by injection-gen. DO NOT EDIT.
+
+package namespace
+
+import (
+	context "context"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	v1 "k8s.io/client-go/informers/core/v1"
+	kubernetes "k8s.io/client-go/kubernetes"
+	corev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
+	client "knative.dev/pkg/client/injection/kube/client"
+	factory "knative.dev/pkg/client/injection/kube/informers/factory"
+	controller "knative.dev/pkg/controller"
+	injection "knative.dev/pkg/injection"
+	logging "knative.dev/pkg/logging"
+)
+
+func init() {
+	injection.Default.RegisterInformer(withInformer)
+	injection.Dynamic.RegisterDynamicInformer(withDynamicInformer)
+}
+
+// Key is used for associating the Informer inside the context.Context.
+type Key struct{}
+
+func withInformer(ctx context.Context) (context.Context, controller.Informer) {
+	f := factory.Get(ctx)
+	inf := f.Core().V1().Namespaces()
+	return context.WithValue(ctx, Key{}, inf), inf.Informer()
+}
+
+func withDynamicInformer(ctx context.Context) context.Context {
+	inf := &wrapper{client: client.Get(ctx), resourceVersion: injection.GetResourceVersion(ctx)}
+	return context.WithValue(ctx, Key{}, inf)
+}
+
+// Get extracts the typed informer from the context.
+func Get(ctx context.Context) v1.NamespaceInformer {
+	untyped := ctx.Value(Key{})
+	if untyped == nil {
+		logging.FromContext(ctx).Panic(
+			"Unable to fetch k8s.io/client-go/informers/core/v1.NamespaceInformer from context.")
+	}
+	return untyped.(v1.NamespaceInformer)
+}
+
+type wrapper struct {
+	client kubernetes.Interface
+
+	resourceVersion string
+}
+
+var _ v1.NamespaceInformer = (*wrapper)(nil)
+var _ corev1.NamespaceLister = (*wrapper)(nil)
+
+func (w *wrapper) Informer() cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(nil, &apicorev1.Namespace{}, 0, nil)
+}
+
+func (w *wrapper) Lister() corev1.NamespaceLister {
+	return w
+}
+
+// SetResourceVersion allows consumers to adjust the minimum resourceVersion
+// used by the underlying client.  It is not accessible via the standard
+// lister interface, but can be accessed through a user-defined interface and
+// an implementation check e.g. rvs, ok := foo.(ResourceVersionSetter)
+func (w *wrapper) SetResourceVersion(resourceVersion string) {
+	w.resourceVersion = resourceVersion
+}
+
+func (w *wrapper) List(selector labels.Selector) (ret []*apicorev1.Namespace, err error) {
+	lo, err := w.client.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{
+		LabelSelector:   selector.String(),
+		ResourceVersion: w.resourceVersion,
+	})
+	if err != nil {
+		return nil, err
+	}
+	for idx := range lo.Items {
+		ret = append(ret, &lo.Items[idx])
+	}
+	return ret, nil
+}
+
+func (w *wrapper) Get(name string) (*apicorev1.Namespace, error) {
+	return w.client.CoreV1().Namespaces().Get(context.TODO(), name, metav1.GetOptions{
+		ResourceVersion: w.resourceVersion,
+	})
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0618a6ca..1acb8d70 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -936,13 +936,13 @@ k8s.io/utils/lru
 k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/control-protocol v0.0.0-20220701014037-ef4c10a9bc76
+# knative.dev/control-protocol v0.0.0-20220705161107-827b25dce9b8
 ## explicit; go 1.17
 knative.dev/control-protocol/pkg/certificates
 # knative.dev/hack v0.0.0-20220701014203-65c463ac8c98
 ## explicit; go 1.14
 knative.dev/hack
-# knative.dev/networking v0.0.0-20220701023942-c3aef9ce275a
+# knative.dev/networking v0.0.0-20220705142707-f087178076e4
 ## explicit; go 1.17
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -982,7 +982,7 @@ knative.dev/networking/test/test_images/runtime/handlers
 knative.dev/networking/test/test_images/timeout
 knative.dev/networking/test/test_images/wsserver
 knative.dev/networking/test/types
-# knative.dev/pkg v0.0.0-20220701013933-97eb1507655e
+# knative.dev/pkg v0.0.0-20220705130606-e60d250dc637
 ## explicit; go 1.17
 knative.dev/pkg/apis
 knative.dev/pkg/apis/duck
@@ -991,6 +991,7 @@ knative.dev/pkg/apis/duck/v1
 knative.dev/pkg/changeset
 knative.dev/pkg/client/injection/kube/client
 knative.dev/pkg/client/injection/kube/informers/core/v1/endpoints
+knative.dev/pkg/client/injection/kube/informers/core/v1/namespace
 knative.dev/pkg/client/injection/kube/informers/core/v1/pod
 knative.dev/pkg/client/injection/kube/informers/core/v1/secret/filtered
 knative.dev/pkg/client/injection/kube/informers/core/v1/service


Test patch:
diff --git a/pkg/config/configmap_test.go b/pkg/config/configmap_test.go
index 8b856abe..ef5d3869 100644
--- a/pkg/config/configmap_test.go
+++ b/pkg/config/configmap_test.go
@@ -98,6 +98,18 @@ func TestKourierConfig(t *testing.T) {
 			clusterCert:                   "",
 			IdleTimeoutKey:                "200s",
 		},
+	}, {
+		name: "set isolation-traffic to port",
+		want: &Kourier{
+			EnableServiceAccessLogging: true,
+			EnableProxyProtocol:        false,
+			ClusterCertSecret:          "",
+			IdleTimeout:                300 * time.Second,
+			TrafficIsolation:           "port",
+		},
+		data: map[string]string{
+			trafficIsolation: "port",
+		},
 	}}
 
 	for _, tt := range configTests {
diff --git a/pkg/generator/caches_test.go b/pkg/generator/caches_test.go
index 9f07976a..28834bf0 100644
--- a/pkg/generator/caches_test.go
+++ b/pkg/generator/caches_test.go
@@ -377,3 +377,33 @@ func getVHostsNames(routeConfigs []*route.RouteConfiguration) []string {
 
 	return res
 }
+
+func TestAddIsolatedIngress(t *testing.T) {
+	kubeClient := fake.Clientset{}
+	ctx := context.Background()
+
+	caches, err := NewCaches(ctx, &kubeClient, false)
+	assert.NilError(t, err)
+
+	translatedIngress := translatedIngress{
+		name: types.NamespacedName{
+			Namespace: "ingress_2_namespace",
+			Name:      "ingress_2",
+		},
+		listenerPort:         "12158",
+		internalVirtualHosts: []*route.VirtualHost{{Name: "internal_host_for_ingress_2", Domains: []string{"internal_host_for_ingress_1"}}},
+	}
+
+	err = caches.addTranslatedIngress(&translatedIngress)
+	assert.NilError(t, err)
+
+	snapshot, err := caches.ToEnvoySnapshot(ctx)
+	assert.NilError(t, err)
+
+	ls := snapshot.GetResources(resource.ListenerType)
+	assert.Assert(t, ls != nil)
+
+	l, ok := ls["listener_12158"].(*listener.Listener)
+	assert.Assert(t, ok)
+	assert.Equal(t, l.GetAddress().GetSocketAddress().GetPortValue(), uint32(12158))
+}
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index ad234b04..c7510e4c 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -39,6 +39,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/client-go/kubernetes/fake"
 	"knative.dev/control-protocol/pkg/certificates"
+	pkgconfig "knative.dev/net-kourier/pkg/config"
 	envoy "knative.dev/net-kourier/pkg/envoy/api"
 	"knative.dev/net-kourier/pkg/reconciler/ingress/config"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
@@ -56,6 +57,7 @@ func TestIngressTranslator(t *testing.T) {
 		name: "simple",
 		in:   ing("simplens", "simplename"),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 		},
@@ -114,6 +116,7 @@ func TestIngressTranslator(t *testing.T) {
 			}}
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			secret,
@@ -182,6 +185,7 @@ func TestIngressTranslator(t *testing.T) {
 			ing.Spec.HTTPOption = v1alpha1.HTTPOptionRedirected
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			secret,
@@ -268,6 +272,7 @@ func TestIngressTranslator(t *testing.T) {
 			ing.Spec.Rules[0].Visibility = v1alpha1.IngressVisibilityClusterLocal
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			secret,
@@ -347,6 +352,7 @@ func TestIngressTranslator(t *testing.T) {
 			})
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			svc("servicens2", "servicename2"),
@@ -425,6 +431,7 @@ func TestIngressTranslator(t *testing.T) {
 			ing.Spec.Rules[0].HTTP.Paths[0].Path = ""
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 		},
@@ -477,6 +484,7 @@ func TestIngressTranslator(t *testing.T) {
 		name: "external service",
 		in:   ing("testspace", "testname"),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename", func(svc *corev1.Service) {
 				svc.Spec.Type = corev1.ServiceTypeExternalName
 				svc.Spec.ExternalName = "example.com"
@@ -531,6 +539,7 @@ func TestIngressTranslator(t *testing.T) {
 		name: "external service without service port",
 		in:   ing("testspace", "testname"),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename", func(svc *corev1.Service) {
 				svc.Spec.Type = corev1.ServiceTypeExternalName
 				svc.Spec.ExternalName = "example.com"
@@ -608,6 +617,9 @@ func TestIngressTranslator(t *testing.T) {
 				func(ns, name string) (*corev1.Service, error) {
 					return kubeclient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
 				},
+				func(name string) (*corev1.Namespace, error) {
+					return kubeclient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+				},
 				&pkgtest.FakeTracker{},
 			)
 
@@ -634,12 +646,14 @@ var (
 		Network: &netconfig.Config{
 			AutoTLS: false,
 		},
+		Kourier: pkgconfig.DefaultConfig(),
 	}
 	upstreamTLSConfig = &config.Config{
 		Network: &netconfig.Config{
 			AutoTLS:            false,
 			InternalEncryption: true,
 		},
+		Kourier: pkgconfig.DefaultConfig(),
 	}
 )
 
@@ -661,6 +675,7 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 			ing.Spec.HTTPOption = v1alpha1.HTTPOptionRedirected
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			secret,
@@ -730,6 +745,7 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 			ing.Spec.Rules[0].Visibility = v1alpha1.IngressVisibilityClusterLocal
 		}),
 		state: []runtime.Object{
+			ns("testspace"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			secret,
@@ -806,6 +822,9 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 				func(ns, name string) (*corev1.Service, error) {
 					return kubeclient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
 				},
+				func(name string) (*corev1.Namespace, error) {
+					return kubeclient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+				},
 				&pkgtest.FakeTracker{},
 			)
 
@@ -831,6 +850,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
 		}),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("servicens", "servicename"),
 			eps("servicens", "servicename"),
 			caSecret,
@@ -889,6 +909,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
 		}),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("servicens", "servicename", func(service *corev1.Service) {
 				service.Spec.Ports = []corev1.ServicePort{{
 					Name:       "http2",
@@ -953,6 +974,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromString("https")
 		}),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("servicens", "servicename", func(service *corev1.Service) {
 				service.Spec.Ports = []corev1.ServicePort{{
 					Name:       "http",
@@ -1022,6 +1044,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromString("https")
 		}),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("servicens", "servicename", func(service *corev1.Service) {
 				service.Spec.Ports = []corev1.ServicePort{{
 					Name:       "http2",
@@ -1103,6 +1126,9 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				func(ns, name string) (*corev1.Service, error) {
 					return kubeclient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
 				},
+				func(name string) (*corev1.Namespace, error) {
+					return kubeclient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+				},
 				&pkgtest.FakeTracker{},
 			)
 
@@ -1126,6 +1152,7 @@ func TestIngressTranslatorHTTP01Challenge(t *testing.T) {
 		name: "http01-challenge",
 		in:   ingHTTP01Challenge("simplens", "simplename"),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("simplens", "cm-acme-http-solver", func(service *corev1.Service) {
 				service.Spec.Ports = []corev1.ServicePort{{
 					Name:       "http01-challenge",
@@ -1185,6 +1212,9 @@ func TestIngressTranslatorHTTP01Challenge(t *testing.T) {
 
 	t.Run(test.name, func(t *testing.T) {
 		ctx, _ := pkgtest.SetupFakeContext(t)
+		cfg := defaultConfig.DeepCopy()
+		ctx = (&testConfigStore{config: cfg}).ToContext(ctx)
+
 		kubeclient := fake.NewSimpleClientset(test.state...)
 
 		translator := NewIngressTranslator(
@@ -1197,6 +1227,9 @@ func TestIngressTranslatorHTTP01Challenge(t *testing.T) {
 			func(ns, name string) (*corev1.Service, error) {
 				return kubeclient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
 			},
+			func(name string) (*corev1.Namespace, error) {
+				return kubeclient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+			},
 			&pkgtest.FakeTracker{},
 		)
 
@@ -1224,6 +1257,7 @@ func TestIngressTranslatorDomainMappingDisableHTTP2(t *testing.T) {
 			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromInt(80)
 		}),
 		state: []runtime.Object{
+			ns("simplens"),
 			svc("servicens", "servicename", func(service *corev1.Service) {
 				service.Spec.Type = corev1.ServiceTypeExternalName
 				service.Spec.ExternalName = "kourier-internal.kourier-system.svc.cluster.local"
@@ -1301,6 +1335,9 @@ func TestIngressTranslatorDomainMappingDisableHTTP2(t *testing.T) {
 			func(ns, name string) (*corev1.Service, error) {
 				return kubeclient.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
 			},
+			func(name string) (*corev1.Namespace, error) {
+				return kubeclient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+			},
 			&pkgtest.FakeTracker{},
 		)
 
@@ -1413,6 +1450,16 @@ func eps(ns, name string, opts ...func(endpoint *corev1.Endpoints)) *corev1.Endp
 	return serviceEndpoint
 }
 
+func ns(name string) *corev1.Namespace {
+	ns := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+	}
+
+	return ns
+}
+
 func ingHTTP01Challenge(ns, name string, opts ...func(*v1alpha1.Ingress)) *v1alpha1.Ingress {
 	ingress := &v1alpha1.Ingress{
 		ObjectMeta: metav1.ObjectMeta{