Repository: knative-sandbox/net-kourier
Pull request #959 (2022-12-08 01:40:52)

Determine internal-encryption via KIngress 
This patch changes controller to determine the internal-encryption via
KIngress's port number and service's port name.

The configuration is prefilled by the "default" values so it creates an
unexpected envoy config when users set non-default value in
`config-network` such as `internal-encryption`.


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/959#" title="Author self-approved">nak3</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign coryrc for approval by writing `/assign @coryrc` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[test/OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/test/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["coryrc"]} -->
knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/959#" title="Author self-approved">nak3</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign dprotaso for approval by writing `/assign @dprotaso` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["dprotaso"]} -->
nak3: /retest
nak3: /retest
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | d9befd597758b26fed10d0db6b1b42f996d4e3b7 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/unit-tests_net-kourier_main/1600762474498363392) | true | `/test unit-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/unit-tests_net-kourier_main/1600805771577135104) | true | `/test unit-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/unit-tests_net-kourier_main/1600805771577135104) | true | `/test unit-tests`
build-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/build-tests_net-kourier_main/1600805771510026240) | true | `/test build-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/unit-tests_net-kourier_main/1600805771577135104) | true | `/test unit-tests`
build-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/build-tests_net-kourier_main/1600805771510026240) | true | `/test build-tests`
integration-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1600805771635855360) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 37ece93631f39961dd06bc0a905279b76cb54fa0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1600805771635855360) | true | `/test integration-tests`
build-tests_net-kourier_main | 77d1fced9c3ce7ca7904a9cbd2c5404136edd943 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/build-tests_net-kourier_main/1600826798013157376) | true | `/test build-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | cd8c0f5f7bc0284c1e522adb8d5c08db5ea972ab | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1601148766746841088) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 2803604ee498b2a047860fe27e0bc1f559e53254 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1601149759844782080) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 46903d66f1f50631192827fd232034a3846ddd65 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1601153930463547392) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 2497aeb1d25dfc4fb678850adf43b45c975fd81b | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1601164610713423872) | true | `/test integration-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 2497aeb1d25dfc4fb678850adf43b45c975fd81b | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1601164610713423872) | true | `/test integration-tests`
build-tests_net-kourier_main | 43c8a5a1349adbd8b8a164b5f6be43f42311cee3 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/build-tests_net-kourier_main/1601172431744012288) | true | `/test build-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow[bot]: @nak3: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
integration-tests_net-kourier_main | 2497aeb1d25dfc4fb678850adf43b45c975fd81b | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/integration-tests_net-kourier_main/1601164610713423872) | true | `/test integration-tests`
build-tests_net-kourier_main | 8ffb2ae4434b50105a6c40c9e3a035340d56ad54 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/959/build-tests_net-kourier_main/1601175155436949504) | true | `/test build-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
nak3: /cc @skonto @dprotaso 
nak3: @skonto @dprotaso could you please take a look?

Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index f8d5f606..4b7f0a67 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -118,6 +118,20 @@ aliases:
   - nainaz
   - salaboy
   - zroubalik
+  function-runtime-approvers:
+  - lance
+  - lkingland
+  - matejvasek
+  - nainaz
+  - salaboy
+  - zroubalik
+  function-runtime-writers:
+  - lance
+  - lkingland
+  - matejvasek
+  - nainaz
+  - salaboy
+  - zroubalik
   homebrew-kn-plugins-approvers:
   - dsimansk
   - maximilien
@@ -177,11 +191,10 @@ aliases:
   - knative-test-reporter-robot
   - kvmware
   - lance
-  - pmorie
+  - nainaz
   - psschwei
-  - thisisnotapril
+  - salaboy
   - upodroid
-  - vaikas
   - zroubalik
   knative-release-leads:
   - evankanderson
@@ -269,9 +282,8 @@ aliases:
   - csantanapr
   - itsmurugappan
   - lance
-  - pmorie
-  - thisisnotapril
-  - vaikas
+  - nainaz
+  - salaboy
   technical-oversight-committee:
   - dprotaso
   - dsimansk
diff --git a/config/300-controller.yaml b/config/300-controller.yaml
index f3464a7b..ed129602 100644
--- a/config/300-controller.yaml
+++ b/config/300-controller.yaml
@@ -23,6 +23,11 @@ metadata:
     app.kubernetes.io/version: devel
     app.kubernetes.io/name: knative-serving
 spec:
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 100%
   replicas: 1
   selector:
     matchLabels:
diff --git a/config/300-gateway.yaml b/config/300-gateway.yaml
index 60f00de3..969c0b73 100644
--- a/config/300-gateway.yaml
+++ b/config/300-gateway.yaml
@@ -27,7 +27,7 @@ spec:
     type: RollingUpdate
     rollingUpdate:
       maxUnavailable: 0
-      maxSurge: 1
+      maxSurge: 100%
   selector:
     matchLabels:
       app: 3scale-kourier-gateway
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 1ead69fc..6fcf86d1 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -144,9 +144,10 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 				// Match the ingress' port with a port on the Service to find the target.
 				// Also find out if the target supports HTTP2.
 				var (
-					externalPort = int32(80)
-					targetPort   = int32(80)
-					http2        = false
+					externalPort       = int32(80)
+					targetPort         = int32(80)
+					http2              = false
+					internalEncryption = false
 				)
 				for _, port := range service.Spec.Ports {
 					if port.Port == split.ServicePort.IntVal || port.Name == split.ServicePort.StrVal {
@@ -156,6 +157,9 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 					if port.Name == "http2" || port.Name == "h2c" {
 						http2 = true
 					}
+					if port.Port == split.ServicePort.IntVal && port.Name == "https" {
+						internalEncryption = true
+					}
 				}
 
 				// Disable HTTP2 if the annotation is specified.
@@ -192,13 +196,20 @@ func (translator *IngressTranslator) translateIngress(ctx context.Context, ingre
 
 				var transportSocket *envoycorev3.TransportSocket
 
-				// This has to be "OrDefaults" because this path is called before the informers are
+				// This has to be "OrDefaults" because this path could be called before the informers are
 				// running when booting the controller up and prefilling the config before making it
 				// ready.
+				//
+				// TODO:
+				// Drop this configmap check - issues/968
+				// We can determin whether internal-encryption is enabled or disabled via `internalEncryption` only,
+				// but all conformance tests need to be updated to have the port name so check the configmap as well.
+				//
+				// TODO: Or fetch configmap before the loop as per https://github.com/knative-sandbox/net-kourier/pull/959#discussion_r1048441513
 				cfg := config.FromContextOrDefaults(ctx)
 
 				// As Ingress with RewriteHost points to ExternalService(kourier-internal), we don't enable TLS.
-				if cfg.Network.InternalEncryption && httpPath.RewriteHost == "" {
+				if (cfg.Network.InternalEncryption || internalEncryption) && httpPath.RewriteHost == "" {
 					var err error
 					transportSocket, err = translator.createUpstreamTransportSocket(http2)
 					if err != nil {


Test patch:
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index c7510e4c..9feb08fd 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -650,8 +650,7 @@ var (
 	}
 	upstreamTLSConfig = &config.Config{
 		Network: &netconfig.Config{
-			AutoTLS:            false,
-			InternalEncryption: true,
+			AutoTLS: false,
 		},
 		Kourier: pkgconfig.DefaultConfig(),
 	}
@@ -848,6 +847,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "simple",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -889,7 +889,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 					envoy.NewCluster(
 						"servicens/servicename",
 						5*time.Second,
-						lbEndpoints,
+						lbHTTPSEndpoints,
 						false,
 						&envoycorev3.TransportSocket{
 							Name:       wellknown.TransportSocketTls,
@@ -907,6 +907,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "http2",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -914,6 +915,10 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				service.Spec.Ports = []corev1.ServicePort{{
 					Name:       "http2",
 					TargetPort: intstr.FromInt(8080),
+				}, {
+					Name:       "https",
+					Port:       443,
+					TargetPort: intstr.FromInt(8443),
 				}}
 			}),
 			eps("servicens", "servicename"),
@@ -953,7 +958,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 					envoy.NewCluster(
 						"servicens/servicename",
 						5*time.Second,
-						lbEndpoints,
+						lbHTTPSEndpoints,
 						true, /* http2 */
 						&envoycorev3.TransportSocket{
 							Name:       wellknown.TransportSocketTls,
@@ -971,7 +976,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "http and https",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
-			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromString("https")
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -983,7 +988,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				}, {
 					Name:       "https",
 					Port:       443,
-					TargetPort: intstr.FromInt(443),
+					TargetPort: intstr.FromInt(8443),
 				}}
 			}),
 			eps("servicens", "servicename"),
@@ -1041,7 +1046,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 		name: "http2 and https",
 		in: ing("simplens", "simplename", func(ing *v1alpha1.Ingress) {
 			ing.Spec.Rules[0].HTTP.Paths[0].RewriteHost = ""
-			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].ServicePort = intstr.FromString("https")
+			ing.Spec.Rules[0].HTTP.Paths[0].Splits[0].IngressBackend.ServicePort = intstr.FromInt(443)
 		}),
 		state: []runtime.Object{
 			ns("simplens"),
@@ -1053,7 +1058,7 @@ func TestIngressTranslatorWithUpstreamTLS(t *testing.T) {
 				}, {
 					Name:       "https",
 					Port:       443,
-					TargetPort: intstr.FromInt(443),
+					TargetPort: intstr.FromInt(8443),
 				}}
 			}),
 			eps("servicens", "servicename"),
@@ -1411,6 +1416,10 @@ func svc(ns, name string, opts ...func(*corev1.Service)) *corev1.Service {
 				Name:       "http",
 				Port:       80,
 				TargetPort: intstr.FromInt(8080),
+			}, {
+				Name:       "https",
+				Port:       443,
+				TargetPort: intstr.FromInt(8443),
 			}},
 		},
 	}
@@ -1502,10 +1511,10 @@ var lbEndpoints = []*endpoint.LbEndpoint{
 }
 
 var lbHTTPSEndpoints = []*endpoint.LbEndpoint{
-	envoy.NewLBEndpoint("2.2.2.2", 443),
-	envoy.NewLBEndpoint("3.3.3.3", 443),
-	envoy.NewLBEndpoint("4.4.4.4", 443),
-	envoy.NewLBEndpoint("5.5.5.5", 443),
+	envoy.NewLBEndpoint("2.2.2.2", 8443),
+	envoy.NewLBEndpoint("3.3.3.3", 8443),
+	envoy.NewLBEndpoint("4.4.4.4", 8443),
+	envoy.NewLBEndpoint("5.5.5.5", 8443),
 }
 
 var lbEndpointHTTP01Challenge = []*endpoint.LbEndpoint{
diff --git a/test/upgrade/probe_test.go b/test/upgrade/probe_test.go
index ea14e499..27bd945e 100644
--- a/test/upgrade/probe_test.go
+++ b/test/upgrade/probe_test.go
@@ -26,14 +26,18 @@ import (
 	"io/ioutil"
 	"net/http"
 	"os"
+	"strings"
 	"syscall"
 	"testing"
 
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"knative.dev/networking/pkg/apis/networking"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
+	"knative.dev/networking/pkg/config"
 	"knative.dev/networking/test"
 	"knative.dev/networking/test/conformance/ingress"
+	"knative.dev/pkg/system"
 )
 
 const probePipe = "/tmp/prober-signal"
@@ -53,7 +57,20 @@ func TestProbe(t *testing.T) {
 	clients := test.Setup(t)
 	ctx := context.Background()
 
-	name, port, _ := ingress.CreateRuntimeService(ctx, t, clients, networking.ServicePortNameHTTP1)
+	portName := networking.ServicePortNameHTTP1
+
+	// Set "https" to the port name when internal-encryption is enabled.
+	// Controller determines the internal-encryption is enabled or not by the port instead of configmap.
+	// ConfigMap does not work during the upgrade test - issues/968.
+	cm, err := clients.KubeClient.CoreV1().ConfigMaps(system.Namespace()).Get(ctx, "config-network", metav1.GetOptions{})
+	if err != nil {
+		t.Fatal("Failed to fetch configmap:", err)
+	}
+	if strings.EqualFold(cm.Data[config.InternalEncryptionKey], "true") {
+		portName = networking.ServicePortNameHTTPS
+	}
+
+	name, port, _ := ingress.CreateRuntimeService(ctx, t, clients, portName)
 	_, client, _ := ingress.CreateIngressReady(ctx, t, clients, v1alpha1.IngressSpec{
 		Rules: []v1alpha1.IngressRule{{
 			Hosts:      []string{name + ".example.com"},