Repository: knative-sandbox/net-kourier
Pull request #970 (2022-12-22 02:19:30)

[main] Upgrade to latest dependencies
Cron -knative-prow-robot

/cc knative-sandbox/networking-wg-leads
/assign knative-sandbox/networking-wg-leads

Produced by: knative-sandbox/knobots/actions/update-deps

knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#" title="Author self-approved">knative-automation</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign evankanderson for approval by writing `/assign @evankanderson` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["evankanderson"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/net-kourier/pull/970?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#970](https://codecov.io/gh/knative-sandbox/net-kourier/pull/970?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (2fdecd7) into [main](https://codecov.io/gh/knative-sandbox/net-kourier/commit/37f80c3dacc8838fac28599973b141c6af04b57d?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (37f80c3) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main     #970   +/-   ##
=======================================
  Coverage   80.32%   80.32%           
=======================================
  Files          18       18           
  Lines        1311     1311           
=======================================
  Hits         1053     1053           
  Misses        205      205           
  Partials       53       53           
```



Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)

knative-prow[bot]: @knative-automation: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 2fdecd795ac2ed27704217eba9f98577badcb83e | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/970/integration-tests_net-kourier_main/1605749846512242688) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#" title="Author self-approved">knative-automation</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign psschwei for approval by writing `/assign @psschwei` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["psschwei"]} -->
nak3: /lgtm
/approve
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#" title="Author self-approved">knative-automation</a>*, *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#issuecomment-1386496296" title="Approved">nak3</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign psschwei for approval by writing `/assign @psschwei` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["psschwei"]} -->
knative-prow[bot]: New changes are detected. LGTM label has been removed.
dprotaso: /lgtm
/approve
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#issuecomment-1397415260" title="Approved">dprotaso</a>*, *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#" title="Author self-approved">knative-automation</a>*, *<a href="https://github.com/knative-sandbox/net-kourier/pull/970#issuecomment-1386496296" title="Approved">nak3</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)~~ [dprotaso]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/config/200-bootstrap.yaml b/config/200-bootstrap.yaml
index 890c66b1..1b966595 100644
--- a/config/200-bootstrap.yaml
+++ b/config/200-bootstrap.yaml
@@ -107,7 +107,10 @@ data:
                       port_value: 18000
           type: STRICT_DNS
     admin:
-      access_log_path: "/dev/stdout"
+      access_log:
+      - name: envoy.access_loggers.stdout
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
       address:
         pipe:
           path: /tmp/envoy.admin
diff --git a/go.mod b/go.mod
index 9b742386..6f8a5938 100644
--- a/go.mod
+++ b/go.mod
@@ -20,10 +20,10 @@ require (
 	k8s.io/apimachinery v0.25.4
 	k8s.io/client-go v0.25.4
 	k8s.io/code-generator v0.25.4
-	knative.dev/control-protocol v0.0.0-20221201154116-4472b318e332
-	knative.dev/hack v0.0.0-20221201154717-7233e77996f1
-	knative.dev/networking v0.0.0-20221202133217-891aac251fc2
-	knative.dev/pkg v0.0.0-20221123154742-05b694ec4d3a
+	knative.dev/control-protocol v0.0.0-20230118172000-03dadc6ffcc9
+	knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9
+	knative.dev/networking v0.0.0-20230118220600-e9d3a55facee
+	knative.dev/pkg v0.0.0-20230117181655-247510c00e9d
 )
 
 require (
diff --git a/go.sum b/go.sum
index fcdadb7e..ca46c691 100644
--- a/go.sum
+++ b/go.sum
@@ -910,14 +910,14 @@ k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 h1:MQ8BAZPZlWk3S9K4a9NCkI
 k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
 k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/control-protocol v0.0.0-20221201154116-4472b318e332 h1:P8Gv0OA1dLUaQ1dyeOndKvWBrw+sTfJ3+pt59cr2L0g=
-knative.dev/control-protocol v0.0.0-20221201154116-4472b318e332/go.mod h1:/aDaOrtEBT6zD4fmhoq7Los6rwXAjCpIwJmnh0hq9Uo=
-knative.dev/hack v0.0.0-20221201154717-7233e77996f1 h1:bPrqF9fmlZm972UUHN03lCCWBHgZ44F+orLK0Z+apDk=
-knative.dev/hack v0.0.0-20221201154717-7233e77996f1/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
-knative.dev/networking v0.0.0-20221202133217-891aac251fc2 h1:yH0zKV0jwP/+jx7UcMHqjx5jbr4NZAjh9I1CkKvbCfo=
-knative.dev/networking v0.0.0-20221202133217-891aac251fc2/go.mod h1:E1E3jgjSFt5mxGHeoqkCDgBI/PLmo4wUwZu5j1DHMes=
-knative.dev/pkg v0.0.0-20221123154742-05b694ec4d3a h1:mTDxXL+zRBMz7BcdM3WOgw9FVbmkIN/3cvEj4MeS8zI=
-knative.dev/pkg v0.0.0-20221123154742-05b694ec4d3a/go.mod h1:fckNBPf9bu5/p1RbnOhEauX7r+kfN1zSQupEVtkaYBs=
+knative.dev/control-protocol v0.0.0-20230118172000-03dadc6ffcc9 h1:m9Zr6qKlhDiN6RZY2AwYzGCTcYIszIbAArPc+Pm3tMA=
+knative.dev/control-protocol v0.0.0-20230118172000-03dadc6ffcc9/go.mod h1:qZ6Mq1Y7db/CAutvJutXk6wrLQf5IagWZJqIro1paRE=
+knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9 h1:CDa7s9KspEZqPhk7cN68ZypRLuAvSgr+knoOaXSsrHk=
+knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
+knative.dev/networking v0.0.0-20230118220600-e9d3a55facee h1:8KYvxZFaP/LgOE+zVvcG5SpdEK1b03eETvaCauoeCUs=
+knative.dev/networking v0.0.0-20230118220600-e9d3a55facee/go.mod h1:rn1yRurhkxmSFkpqs/YdG7b9DiYj0VlmLFzBdOQjpOo=
+knative.dev/pkg v0.0.0-20230117181655-247510c00e9d h1:pjKDcvHoMib8nRp56eISRmMj/pFMzJljnzvMvGCIReI=
+knative.dev/pkg v0.0.0-20230117181655-247510c00e9d/go.mod h1:VO/fcEsq43seuONRQxZyftWHjpMabYzRHDtpSEQ/eoQ=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 6fcf86d1..a8e34148 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -316,7 +316,7 @@ func (translator *IngressTranslator) createUpstreamTransportSocket(http2 bool) (
 	if http2 {
 		alpnProtocols = "h2"
 	}
-	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[certificates.SecretCaCertKey], alpnProtocols))
+	tlsAny, err := anypb.New(createUpstreamTLSContext(caSecret.Data[certificates.CaCertName], alpnProtocols))
 	if err != nil {
 		return nil, err
 	}
@@ -342,11 +342,14 @@ func createUpstreamTLSContext(caCertificate []byte, alpnProtocols ...string) *tl
 							InlineBytes: caCertificate,
 						},
 					},
-					MatchSubjectAltNames: []*envoymatcherv3.StringMatcher{{
-						MatchPattern: &envoymatcherv3.StringMatcher_Exact{
-							Exact: certificates.FakeDnsName,
-						}},
-					},
+					MatchTypedSubjectAltNames: []*tls.SubjectAltNameMatcher{{
+						SanType: tls.SubjectAltNameMatcher_DNS,
+						Matcher: &envoymatcherv3.StringMatcher{
+							MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+								Exact: certificates.FakeDnsName,
+							},
+						},
+					}},
 				},
 			},
 		},
@@ -411,8 +414,13 @@ func matchHeadersFromHTTPPath(httpPath v1alpha1.HTTPIngressPath) []*route.Header
 			Name: header,
 		}
 		if matchType.Exact != "" {
-			matchHeader.HeaderMatchSpecifier = &route.HeaderMatcher_ExactMatch{
-				ExactMatch: matchType.Exact,
+
+			matchHeader.HeaderMatchSpecifier = &route.HeaderMatcher_StringMatch{
+				StringMatch: &envoymatcherv3.StringMatcher{
+					MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+						Exact: matchType.Exact,
+					},
+				},
 			}
 		}
 		matchHeaders = append(matchHeaders, matchHeader)
diff --git a/vendor/knative.dev/hack/release.sh b/vendor/knative.dev/hack/release.sh
index 1e5dc7f1..bc8e26b5 100644
--- a/vendor/knative.dev/hack/release.sh
+++ b/vendor/knative.dev/hack/release.sh
@@ -359,6 +359,7 @@ function sign_release() {
       if  [ -n "${ATTEST_IMAGES:-}" ]; then # Temporary Feature Gate
         provenance-generator --clone-log=/logs/clone.json \
           --image-refs=imagerefs.txt --output=attestation.json
+        mkdir -p "${ARTIFACTS}"/attestation && cp attestation.json "${ARTIFACTS}"/attestation
         COSIGN_EXPERIMENTAL=1 cosign attest $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}" \
           --predicate=attestation.json --type=slsaprovenance
       fi
diff --git a/vendor/knative.dev/networking/config/certificate.yaml b/vendor/knative.dev/networking/config/certificate.yaml
index d25186f0..c3bf16f6 100644
--- a/vendor/knative.dev/networking/config/certificate.yaml
+++ b/vendor/knative.dev/networking/config/certificate.yaml
@@ -54,6 +54,9 @@ spec:
                   type: array
                   items:
                     type: string
+                domain:
+                  description: Domain is the top level domain of the values for DNSNames.
+                  type: string
                 secretName:
                   description: SecretName is the name of the secret resource to store the SSL certificate in.
                   type: string
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_types.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_types.go
index 9513c947..af49313d 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_types.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_types.go
@@ -82,6 +82,10 @@ type CertificateSpec struct {
 	// The wildcard format of DNSNames (e.g. *.default.example.com) is supported.
 	DNSNames []string `json:"dnsNames"`
 
+	// Domain is the top level domain of the values for DNSNames.
+	// +optional
+	Domain string `json:"domain,omitempty"`
+
 	// SecretName is the name of the secret resource to store the SSL certificate in.
 	SecretName string `json:"secretName"`
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
index 9fc7dd01..8d953084 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/certificate_validation.go
@@ -18,6 +18,7 @@ package v1alpha1
 
 import (
 	"context"
+	"strings"
 
 	"knative.dev/pkg/apis"
 )
@@ -44,5 +45,21 @@ func (spec *CertificateSpec) Validate(ctx context.Context) (all *apis.FieldError
 	if spec.SecretName == "" {
 		all = all.Also(apis.ErrMissingField("secretName"))
 	}
+
+	if spec.Domain != "" && len(spec.DNSNames) != 0 {
+		suffix := "." + spec.Domain
+		valid := false
+		for _, dnsName := range spec.DNSNames {
+			if strings.HasSuffix(dnsName, suffix) || dnsName == spec.Domain {
+				valid = true
+				break
+			}
+		}
+
+		if !valid {
+			all = all.Also(apis.ErrInvalidValue("domain", "domain must be a suffix of, or match exactly, at least one entry in dnsNames"))
+		}
+	}
+
 	return all
 }
diff --git a/vendor/knative.dev/pkg/kmeta/names.go b/vendor/knative.dev/pkg/kmeta/names.go
index eeaa57ae..963b121d 100644
--- a/vendor/knative.dev/pkg/kmeta/names.go
+++ b/vendor/knative.dev/pkg/kmeta/names.go
@@ -19,7 +19,7 @@ package kmeta
 import (
 	"crypto/md5" //nolint:gosec // No strong cryptography needed.
 	"fmt"
-	"strings"
+	"regexp"
 )
 
 // The longest name supported by the K8s is 63.
@@ -30,6 +30,8 @@ const (
 	head    = longest - md5Len // How much to truncate to fit the hash.
 )
 
+var isAlphanumeric = regexp.MustCompile(`^[a-zA-Z0-9]*$`)
+
 // ChildName generates a name for the resource based upon the parent resource and suffix.
 // If the concatenated name is longer than K8s permits the name is hashed and truncated to permit
 // construction of the resource, but still keeps it unique.
@@ -55,12 +57,19 @@ func ChildName(parent, suffix string) string {
 			if d := longest - len(ret); d > 0 {
 				ret += suffix[:d]
 			}
-			// If due to trimming above we're terminating the string with a `-`,
-			// remove it.
-			return strings.TrimRight(ret, "-")
+			return makeValidName(ret)
 		}
 		//nolint:gosec // No strong cryptography needed.
 		n = fmt.Sprintf("%s%x", parent[:head-len(suffix)], md5.Sum([]byte(parent)))
 	}
 	return n + suffix
 }
+
+// If due to trimming above we're terminating the string with a non-alphanumeric
+// character, remove it.
+func makeValidName(n string) string {
+	for i := len(n) - 1; !isAlphanumeric.MatchString(string(n[i])); i-- {
+		n = n[:len(n)-1]
+	}
+	return n
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index db47e227..7f7e86f1 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -962,13 +962,13 @@ k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/strings/slices
 k8s.io/utils/trace
-# knative.dev/control-protocol v0.0.0-20221201154116-4472b318e332
+# knative.dev/control-protocol v0.0.0-20230118172000-03dadc6ffcc9
 ## explicit; go 1.18
 knative.dev/control-protocol/pkg/certificates
-# knative.dev/hack v0.0.0-20221201154717-7233e77996f1
+# knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9
 ## explicit; go 1.18
 knative.dev/hack
-# knative.dev/networking v0.0.0-20221202133217-891aac251fc2
+# knative.dev/networking v0.0.0-20230118220600-e9d3a55facee
 ## explicit; go 1.18
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -1008,7 +1008,7 @@ knative.dev/networking/test/test_images/runtime/handlers
 knative.dev/networking/test/test_images/timeout
 knative.dev/networking/test/test_images/wsserver
 knative.dev/networking/test/types
-# knative.dev/pkg v0.0.0-20221123154742-05b694ec4d3a
+# knative.dev/pkg v0.0.0-20230117181655-247510c00e9d
 ## explicit; go 1.18
 knative.dev/pkg/apis
 knative.dev/pkg/apis/duck


Test patch:
diff --git a/pkg/generator/caches_test.go b/pkg/generator/caches_test.go
index 28834bf0..259bc472 100644
--- a/pkg/generator/caches_test.go
+++ b/pkg/generator/caches_test.go
@@ -268,7 +268,7 @@ func TestTLSListenerWithInternalCertSecret(t *testing.T) {
 			Name: "test-ca",
 		},
 		Data: map[string][]byte{
-			certificates.SecretCaCertKey: cert,
+			certificates.CaCertName: cert,
 		},
 	}
 
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index 9feb08fd..8a3d7d55 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -70,9 +70,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
-							},
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								}},
 						}},
 						"/test",
 						[]*route.WeightedCluster_ClusterWeight{
@@ -130,8 +133,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -199,8 +206,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -221,8 +232,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test"),
@@ -286,8 +301,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -371,8 +390,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -444,8 +467,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/",
@@ -499,8 +526,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -555,8 +586,12 @@ func TestIngressTranslator(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -688,8 +723,12 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -758,8 +797,12 @@ func TestIngressTranslatorWithHTTPOptionDisabled(t *testing.T) {
 						"(testspace/testname).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -864,8 +907,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -933,8 +980,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1003,8 +1054,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1073,8 +1128,12 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1284,8 +1343,12 @@ func TestIngressTranslatorDomainMappingDisableHTTP2(t *testing.T) {
 						"(simplens/simplename).Rules[0].Paths[/test]",
 						[]*route.HeaderMatcher{{
 							Name: "testheader",
-							HeaderMatchSpecifier: &route.HeaderMatcher_ExactMatch{
-								ExactMatch: "foo",
+							HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
+								StringMatch: &envoymatcherv3.StringMatcher{
+									MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+										Exact: "foo",
+									},
+								},
 							},
 						}},
 						"/test",
@@ -1540,7 +1603,7 @@ var (
 			Name:      netconfig.ServingInternalCertName,
 		},
 		Data: map[string][]byte{
-			certificates.SecretCaCertKey: cert,
+			certificates.CaCertName: cert,
 		},
 	}
 )
@@ -1563,11 +1626,14 @@ func typedConfig(http2 bool) *envoycorev3.TransportSocket_TypedConfig {
 							InlineBytes: cert,
 						},
 					},
-					MatchSubjectAltNames: []*envoymatcherv3.StringMatcher{{
-						MatchPattern: &envoymatcherv3.StringMatcher_Exact{
-							Exact: certificates.FakeDnsName,
-						}},
-					},
+					MatchTypedSubjectAltNames: []*auth.SubjectAltNameMatcher{{
+						SanType: auth.SubjectAltNameMatcher_DNS,
+						Matcher: &envoymatcherv3.StringMatcher{
+							MatchPattern: &envoymatcherv3.StringMatcher_Exact{
+								Exact: certificates.FakeDnsName,
+							},
+						},
+					}},
 				},
 			},
 		},
diff --git a/test/generate-upstream-cert.sh b/test/generate-upstream-cert.sh
index 7542ffa0..8ab979ee 100755
--- a/test/generate-upstream-cert.sh
+++ b/test/generate-upstream-cert.sh
@@ -32,8 +32,11 @@ openssl req -out "${out_dir}"/tls.csr -newkey rsa:2048 -nodes -keyout "${out_dir
 openssl x509 -req -extfile <(printf "subjectAltName=DNS:$san") -days 365 -in "${out_dir}"/tls.csr -CA "${out_dir}"/root.crt -CAkey "${out_dir}"/root.key -CAcreateserial -out "${out_dir}"/tls.crt
 
 # Create secret
+# TODO: drop ca-cert.pem after v1.9 released. It is used for upgrade e2e test since previous version uses the old file name.
 kubectl create -n ${SERVING_SYSTEM_NAMESPACE} secret generic knative-serving-certs \
-    --from-file=ca-cert.pem="${out_dir}"/root.crt --dry-run=client -o yaml |  \
+    --from-file=ca.crt="${out_dir}"/root.crt \
+    --from-file=ca-cert.pem="${out_dir}"/root.crt \
+    --dry-run=client -o yaml |  \
     sed  '/^metadata:/a\ \ labels: {"networking.internal.knative.dev/certificate-uid":"test-id"}' | kubectl apply -f -
 
 kubectl create -n ${TEST_NAMESPACE} secret tls server-certs \
diff --git a/vendor/knative.dev/hack/presubmit-tests.sh b/vendor/knative.dev/hack/presubmit-tests.sh
index fd2a2c06..1f6f1825 100644
--- a/vendor/knative.dev/hack/presubmit-tests.sh
+++ b/vendor/knative.dev/hack/presubmit-tests.sh
@@ -289,6 +289,10 @@ function main() {
       echo ">> maven version"
       mvn --version
     fi
+    if command -v cosign > /dev/null; then
+      echo ">> cosign version"
+      cosign version
+    fi
     echo ">> prow-tests image version"
     [[ -f /commit_hash ]] && echo "Prow test image was built from $(cat /commit_hash) commit which is viewable at https://github.com/knative/test-infra/tree/$(cat /commit_hash) " || echo "unknown"
   fi
diff --git a/vendor/knative.dev/pkg/test/logstream/interface.go b/vendor/knative.dev/pkg/test/logstream/interface.go
index 33bc0233..a1b39aab 100644
--- a/vendor/knative.dev/pkg/test/logstream/interface.go
+++ b/vendor/knative.dev/pkg/test/logstream/interface.go
@@ -18,6 +18,7 @@ package logstream
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"strings"
 	"sync"
@@ -29,9 +30,11 @@ import (
 	logstreamv2 "knative.dev/pkg/test/logstream/v2"
 )
 
-// Canceler is the type of a function returned when a logstream is started to be
-// deferred so that the logstream can be stopped when the test is complete.
-type Canceler = logstreamv2.Canceler
+type (
+	// Canceler is the type of function returned when a logstream is started to be
+	// deferred so that the logstream can be stopped when the test is complete.
+	Canceler = logstreamv2.Canceler
+)
 
 type ti interface {
 	Name() string
@@ -41,35 +44,39 @@ type ti interface {
 }
 
 // Start begins streaming the logs from system components with a `key:` matching
-// `test.ObjectNameForTest(t)` to `t.Log`.  It returns a Canceler, which must
+// `test.ObjectNameForTest(t)` to `t.Log`. It returns a Canceler, which must
 // be called before the test completes.
 func Start(t ti) Canceler {
 	// Do this lazily to make import ordering less important.
 	once.Do(func() {
 		if ns := os.Getenv(system.NamespaceEnvKey); ns != "" {
-			config, err := test.Flags.GetRESTConfig()
-			if err != nil {
-				t.Error("Error loading client config", "error", err)
-				return
-			}
-
-			kc, err := kubernetes.NewForConfig(config)
-			if err != nil {
-				t.Error("Error creating kubernetes client", "error", err)
-				return
-			}
-
+			var err error
 			// handle case when ns contains a csv list
 			namespaces := strings.Split(ns, ",")
-			stream = &shim{logstreamv2.FromNamespaces(context.Background(), kc, namespaces)}
-
+			if sysStream, err = initStream(namespaces); err != nil {
+				t.Error("Error initializing logstream", "error", err)
+			}
 		} else {
-			// Otherwise set up a null stream.
-			stream = &null{}
+			// Otherwise, set up a null stream.
+			sysStream = &null{}
 		}
 	})
 
-	return stream.Start(t)
+	return sysStream.Start(t)
+}
+
+func initStream(namespaces []string) (streamer, error) {
+	config, err := test.Flags.GetRESTConfig()
+	if err != nil {
+		return &null{}, fmt.Errorf("error loading client config: %w", err)
+	}
+
+	kc, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return &null{}, fmt.Errorf("error creating kubernetes client: %w", err)
+	}
+
+	return &shim{logstreamv2.FromNamespaces(context.Background(), kc, namespaces)}, nil
 }
 
 type streamer interface {
@@ -77,8 +84,8 @@ type streamer interface {
 }
 
 var (
-	stream streamer
-	once   sync.Once
+	sysStream streamer
+	once      sync.Once
 )
 
 type shim struct {
diff --git a/vendor/knative.dev/pkg/test/logstream/v2/stream.go b/vendor/knative.dev/pkg/test/logstream/v2/stream.go
index b244fe8b..1a37a54d 100644
--- a/vendor/knative.dev/pkg/test/logstream/v2/stream.go
+++ b/vendor/knative.dev/pkg/test/logstream/v2/stream.go
@@ -20,6 +20,7 @@ import (
 	"bufio"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"reflect"
 	"strings"
@@ -34,36 +35,70 @@ import (
 	"knative.dev/pkg/ptr"
 )
 
-func FromNamespaces(ctx context.Context, c kubernetes.Interface, namespaces []string) Source {
-	return &namespaceSource{
-		ctx:        ctx,
-		kc:         c,
-		namespaces: namespaces,
-		keys:       make(map[string]Callback, 1),
+// New creates a new log source. The source namespaces must be configured through
+// log source options.
+func New(ctx context.Context, c kubernetes.Interface, opts ...func(*logSource)) Source {
+	s := &logSource{
+		ctx:         ctx,
+		kc:          c,
+		keys:        make(map[string]Callback, 1),
+		filterLines: true, // Filtering log lines by the watched resource name is enabled by default.
 	}
+	for _, opt := range opts {
+		opt(s)
+	}
+	return s
 }
 
-func FromNamespace(ctx context.Context, c kubernetes.Interface, namespace string) Source {
-	return &namespaceSource{
-		ctx:        ctx,
-		kc:         c,
-		namespaces: []string{namespace},
-		keys:       make(map[string]Callback, 1),
+// WithNamespaces configures namespaces for log stream.
+func WithNamespaces(namespaces ...string) func(*logSource) {
+	return func(s *logSource) {
+		s.namespaces = namespaces
 	}
 }
 
-type namespaceSource struct {
+// WithLineFiltering configures whether log lines will be filtered by
+// the resource name.
+func WithLineFiltering(enabled bool) func(*logSource) {
+	return func(s *logSource) {
+		s.filterLines = enabled
+	}
+}
+
+// WithPodPrefixes specifies which Pods will be included in the
+// log stream through the provided prefixes. If no prefixes are
+// configured then logs from all Pods in the configured namespaces will
+// be streamed.
+func WithPodPrefixes(podPrefixes ...string) func(*logSource) {
+	return func(s *logSource) {
+		s.podPrefixes = podPrefixes
+	}
+}
+
+func FromNamespaces(ctx context.Context, c kubernetes.Interface, namespaces []string, opts ...func(*logSource)) Source {
+	sOpts := []func(*logSource){WithNamespaces(namespaces...)}
+	sOpts = append(sOpts, opts...)
+	return New(ctx, c, sOpts...)
+}
+
+func FromNamespace(ctx context.Context, c kubernetes.Interface, namespace string, opts ...func(*logSource)) Source {
+	return FromNamespaces(ctx, c, []string{namespace}, opts...)
+}
+
+type logSource struct {
 	namespaces []string
 	kc         kubernetes.Interface
 	ctx        context.Context
 
-	m        sync.RWMutex
-	once     sync.Once
-	keys     map[string]Callback
-	watchErr error
+	m           sync.RWMutex
+	once        sync.Once
+	keys        map[string]Callback
+	filterLines bool
+	podPrefixes []string
+	watchErr    error
 }
 
-func (s *namespaceSource) StartStream(name string, l Callback) (Canceler, error) {
+func (s *logSource) StartStream(name string, l Callback) (Canceler, error) {
 	s.once.Do(func() { s.watchErr = s.watchPods() })
 	if s.watchErr != nil {
 		return nil, fmt.Errorf("failed to watch pods in one of the namespace(s) %q: %w", s.namespaces, s.watchErr)
@@ -82,7 +117,10 @@ func (s *namespaceSource) StartStream(name string, l Callback) (Canceler, error)
 	}, nil
 }
 
-func (s *namespaceSource) watchPods() error {
+func (s *logSource) watchPods() error {
+	if len(s.namespaces) == 0 {
+		return errors.New("namespaces for logstream not configured")
+	}
 	for _, ns := range s.namespaces {
 		wi, err := s.kc.CoreV1().Pods(ns).Watch(s.ctx, metav1.ListOptions{})
 		if err != nil {
@@ -113,7 +151,7 @@ func (s *namespaceSource) watchPods() error {
 					case watch.Deleted:
 						watchedPods.Delete(p.Name)
 					case watch.Added, watch.Modified:
-						if !watchedPods.Has(p.Name) && isPodReady(p) {
+						if !watchedPods.Has(p.Name) && isPodReady(p) && s.matchesPodPrefix(p.Name) {
 							watchedPods.Insert(p.Name)
 							s.startForPod(p)
 						}
@@ -127,7 +165,20 @@ func (s *namespaceSource) watchPods() error {
 	return nil
 }
 
-func (s *namespaceSource) startForPod(pod *corev1.Pod) {
+func (s *logSource) matchesPodPrefix(name string) bool {
+	if len(s.podPrefixes) == 0 {
+		// Pod prefixes are not configured => always match.
+		return true
+	}
+	for _, p := range s.podPrefixes {
+		if strings.Contains(name, p) {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *logSource) startForPod(pod *corev1.Pod) {
 	// Grab data from all containers in the pods.  We need this in case
 	// an envoy sidecar is injected for mesh installs.  This should be
 	// equivalent to --all-containers.
@@ -136,7 +187,7 @@ func (s *namespaceSource) startForPod(pod *corev1.Pod) {
 		psn, pn, cn := pod.Namespace, pod.Name, container.Name
 
 		handleLine := s.handleLine
-		if wellKnownContainers.Has(cn) {
+		if wellKnownContainers.Has(cn) || !s.filterLines {
 			// Specialcase logs from chaosduck, queueproxy etc.
 			// - ChaosDuck logs enable easy
 			//   monitoring of killed pods throughout all tests.
@@ -196,7 +247,7 @@ const (
 // are captured without filtering.
 var wellKnownContainers = sets.NewString(ChaosDuck, QueueProxy)
 
-func (s *namespaceSource) handleLine(l []byte, pod string, _ string) {
+func (s *logSource) handleLine(l []byte, pod string, _ string) {
 	// This holds the standard structure of our logs.
 	var line struct {
 		Level      string    `json:"severity"`
@@ -258,7 +309,7 @@ func (s *namespaceSource) handleLine(l []byte, pod string, _ string) {
 
 // handleGenericLine prints the given logline to all active tests as it cannot be parsed
 // and/or doesn't contain any correlation data (like the chaosduck for example).
-func (s *namespaceSource) handleGenericLine(l []byte, pod string, cn string) {
+func (s *logSource) handleGenericLine(l []byte, pod string, cn string) {
 	s.m.RLock()
 	defer s.m.RUnlock()