Repository: knative/serving
Pull request #12419 (2021-12-10 11:44:51)

Directly use signals.NewContext rather than cancelling context on signal
Since the signals package already provides a context that is cancelled on a
signal we don't need to duplicate this behaviour via context.WithCancel.

/hold out of an abundance of caution given release is soon


knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/12419#" title="Author self-approved">julz</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[cmd/activator/OWNERS](https://github.com/knative/serving/blob/main/cmd/activator/OWNERS)~~ [julz]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
> Merging [#12419](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (26e5346) into [main](https://codecov.io/gh/knative/serving/commit/d4368953eb3cff68f05ebd4bd8c0bf01196d6bdd?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (d436895) will **decrease** coverage by `0.04%`.
> The diff coverage is `0.00%`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/12419/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)

```diff
@@            Coverage Diff             @@
##             main   #12419      +/-   ##
==========================================
- Coverage   87.43%   87.39%   -0.05%     
==========================================
  Files         195      195              
  Lines        9655     9644      -11     
==========================================
- Hits         8442     8428      -14     
- Misses        930      931       +1     
- Partials      283      285       +2     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | Coverage Δ | |
|---|---|---|
| [cmd/activator/main.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-Y21kL2FjdGl2YXRvci9tYWluLmdv) | `0.00% <0.00%> (ø)` | |
| [pkg/autoscaler/scaling/multiscaler.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2F1dG9zY2FsZXIvc2NhbGluZy9tdWx0aXNjYWxlci5nbw==) | `87.27% <0.00%> (-1.82%)` | :arrow_down: |
| [pkg/reconciler/configuration/configuration.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvY29uZmlndXJhdGlvbi9jb25maWd1cmF0aW9uLmdv) | `84.61% <0.00%> (-1.54%)` | :arrow_down: |
| [pkg/apis/config/defaults.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2FwaXMvY29uZmlnL2RlZmF1bHRzLmdv) | `87.01% <0.00%> (-0.83%)` | :arrow_down: |
| [pkg/apis/serving/metadata\_validation.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2FwaXMvc2VydmluZy9tZXRhZGF0YV92YWxpZGF0aW9uLmdv) | `95.91% <0.00%> (-0.24%)` | :arrow_down: |
| [pkg/apis/serving/v1/route\_validation.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2FwaXMvc2VydmluZy92MS9yb3V0ZV92YWxpZGF0aW9uLmdv) | `97.72% <0.00%> (-0.13%)` | :arrow_down: |
| [pkg/apis/serving/v1/service\_validation.go](https://codecov.io/gh/knative/serving/pull/12419/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2FwaXMvc2VydmluZy92MS9zZXJ2aWNlX3ZhbGlkYXRpb24uZ28=) | `100.00% <0.00%> (ø)` | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Last update [a794e1f...26e5346](https://codecov.io/gh/knative/serving/pull/12419?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).


Patch:
diff --git a/cmd/activator/main.go b/cmd/activator/main.go
index 260530787..1ae3c9c64 100644
--- a/cmd/activator/main.go
+++ b/cmd/activator/main.go
@@ -207,7 +207,7 @@ func main() {
 	ah = network.NewProbeHandler(ah)
 
 	// Set up our health check based on the health of stat sink and environmental factors.
-	sigCtx, sigCancel := context.WithCancel(context.Background())
+	sigCtx := signals.NewContext()
 	hc := newHealthCheck(sigCtx, logger, statSink)
 	ah = &activatorhandler.HealthHandler{HealthCheck: hc, NextHandler: ah, Logger: logger}
 
@@ -241,14 +241,10 @@ func main() {
 		}(name, server)
 	}
 
-	sigCh := signals.SetupSignalHandler()
-
 	// Wait for the signal to drain.
 	select {
-	case <-sigCh:
+	case <-sigCtx.Done():
 		logger.Info("Received SIGTERM")
-		// Send a signal to let readiness probes start failing.
-		sigCancel()
 	case err := <-errCh:
 		logger.Errorw("Failed to run HTTP server", zap.Error(err))
 	}
diff --git a/cmd/queue/main.go b/cmd/queue/main.go
index ed4206b34..05cb7b699 100644
--- a/cmd/queue/main.go
+++ b/cmd/queue/main.go
@@ -69,6 +69,7 @@ type config struct {
 	QueueServingPort         string `split_words:"true" required:"true"`
 	UserPort                 string `split_words:"true" required:"true"`
 	RevisionTimeoutSeconds   int    `split_words:"true" required:"true"`
+	MaxDurationSeconds       int    `split_words:"true"` // optional
 	ServingReadinessProbe    string `split_words:"true"` // optional
 	EnableProfiling          bool   `split_words:"true"` // optional
 	EnableHTTP2AutoDetection bool   `split_words:"true"` // optional
@@ -245,6 +246,8 @@ func buildServer(ctx context.Context, env config, probeContainer func() bool, st
 	// hardcoded to always disable idle timeout for now, will expose this later
 	var idleTimeout time.Duration
 
+	maxDurationTimeout := time.Duration(env.MaxDurationSeconds) * time.Second
+
 	// Create queue handler chain.
 	// Note: innermost handlers are specified first, ie. the last handler in the chain will be executed first.
 	var composedHandler http.Handler = httpProxy
@@ -264,7 +267,7 @@ func buildServer(ctx context.Context, env config, probeContainer func() bool, st
 	}
 	composedHandler = queue.ProxyHandler(breaker, stats, tracingEnabled, composedHandler)
 	composedHandler = queue.ForwardedShimHandler(composedHandler)
-	composedHandler = handler.NewTimeoutHandler(composedHandler, "request timeout", firstByteTimeout, idleTimeout)
+	composedHandler = handler.NewTimeoutHandler(composedHandler, "request timeout", firstByteTimeout, idleTimeout, maxDurationTimeout)
 
 	if metricsSupported {
 		composedHandler = requestMetricsHandler(logger, composedHandler, env)
diff --git a/config/core/300-resources/configuration.yaml b/config/core/300-resources/configuration.yaml
index f474d5609..5db6034f3 100644
--- a/config/core/300-resources/configuration.yaml
+++ b/config/core/300-resources/configuration.yaml
@@ -474,6 +474,10 @@ spec:
                               name:
                                 description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
                                 type: string
+                        maxDurationSeconds:
+                          description: MaxDurationSeconds is the maximum duration in seconds a request will be allowed to stay open.
+                          type: integer
+                          format: int64
                         serviceAccountName:
                           description: 'ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/'
                           type: string
diff --git a/config/core/300-resources/revision.yaml b/config/core/300-resources/revision.yaml
index 3a078c17b..e65620f0c 100644
--- a/config/core/300-resources/revision.yaml
+++ b/config/core/300-resources/revision.yaml
@@ -453,6 +453,10 @@ spec:
                       name:
                         description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
                         type: string
+                maxDurationSeconds:
+                  description: MaxDurationSeconds is the maximum duration in seconds a request will be allowed to stay open.
+                  type: integer
+                  format: int64
                 serviceAccountName:
                   description: 'ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/'
                   type: string
diff --git a/config/core/300-resources/service.yaml b/config/core/300-resources/service.yaml
index dcde15422..036191849 100644
--- a/config/core/300-resources/service.yaml
+++ b/config/core/300-resources/service.yaml
@@ -478,6 +478,10 @@ spec:
                               name:
                                 description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
                                 type: string
+                        maxDurationSeconds:
+                          description: MaxDurationSeconds is the maximum duration in seconds a request will be allowed to stay open.
+                          type: integer
+                          format: int64
                         serviceAccountName:
                           description: 'ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/'
                           type: string
diff --git a/docs/serving-api.md b/docs/serving-api.md
index 5f04ac02b..3337486c9 100644
--- a/docs/serving-api.md
+++ b/docs/serving-api.md
@@ -920,6 +920,19 @@ layer will wait for a request delivered to a container to begin replying
 (send network traffic). If unspecified, a system default will be provided.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>maxDurationSeconds</code><br/>
+<em>
+int64
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>MaxDurationSeconds is the maximum duration in seconds a request will be allowed
+to stay open.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
@@ -1382,6 +1395,19 @@ layer will wait for a request delivered to a container to begin replying
 (send network traffic). If unspecified, a system default will be provided.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>maxDurationSeconds</code><br/>
+<em>
+int64
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>MaxDurationSeconds is the maximum duration in seconds a request will be allowed
+to stay open.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="serving.knative.dev/v1.RevisionStatus">RevisionStatus
@@ -1582,6 +1608,19 @@ layer will wait for a request delivered to a container to begin replying
 (send network traffic). If unspecified, a system default will be provided.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>maxDurationSeconds</code><br/>
+<em>
+int64
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>MaxDurationSeconds is the maximum duration in seconds a request will be allowed
+to stay open.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
diff --git a/go.mod b/go.mod
index deb119a12..c5d54f1ca 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,13 @@ go 1.16
 
 require (
 	github.com/ahmetb/gen-crd-api-reference-docs v0.3.1-0.20210609063737-0067dc6dcea2
+	github.com/c2h5oh/datasize v0.0.0-20200112174442-28bbd4740fee // indirect
 	github.com/davecgh/go-spew v1.1.1
+	github.com/dgryski/go-gk v0.0.0-20200319235926-a69029f61654 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.19.5 // indirect
+	github.com/go-openapi/spec v0.19.6 // indirect
+	github.com/go-openapi/swag v0.19.15 // indirect
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/go-cmp v0.5.6
 	github.com/google/go-containerregistry v0.7.1-0.20211118220127-abdc633f8305
@@ -12,9 +18,13 @@ require (
 	github.com/google/gofuzz v1.2.0
 	github.com/gorilla/websocket v1.4.2
 	github.com/hashicorp/golang-lru v0.5.4
+	github.com/influxdata/tdigest v0.0.1 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/miekg/dns v1.1.29 // indirect
 	github.com/prometheus/client_golang v1.11.0
 	github.com/prometheus/client_model v0.2.0
+	github.com/tsenart/go-tsz v0.0.0-20180814235614-0bd30b3df1c3 // indirect
 	github.com/tsenart/vegeta/v12 v12.8.4
 	go.opencensus.io v0.23.0
 	go.uber.org/atomic v1.9.0
@@ -32,9 +42,9 @@ require (
 	k8s.io/client-go v0.21.4
 	k8s.io/code-generator v0.21.4
 	k8s.io/kube-openapi v0.0.0-20210305001622-591a79e4bda7
-	knative.dev/caching v0.0.0-20211203062336-50189aafddf2
+	knative.dev/caching v0.0.0-20211206133228-c29dc56d8f03
 	knative.dev/hack v0.0.0-20211203062838-e11ac125e707
-	knative.dev/networking v0.0.0-20211203062838-d65e1ba909fe
+	knative.dev/networking v0.0.0-20211209101835-8ef631418fc0
 	knative.dev/pkg v0.0.0-20211206113427-18589ac7627e
 	sigs.k8s.io/yaml v1.3.0
 )
diff --git a/go.sum b/go.sum
index f24002ea3..ac5f65e5b 100644
--- a/go.sum
+++ b/go.sum
@@ -513,7 +513,6 @@ github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/licenseclassifier v0.0.0-20200708223521-3d09a0ea2f39/go.mod h1:qsqn2hxC+vURpyBRygGUuinTO42MFRLcsmQ/P8v94+M=
 github.com/google/mako v0.0.0-20190821191249-122f8dcef9e3/go.mod h1:YzLcVlL+NqWnmUEPuhS1LxDDwGO9WNbVlEXaF4IH35g=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -600,7 +599,6 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
@@ -838,7 +836,7 @@ github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqn
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rs/dnscache v0.0.0-20210201191234-295bba877686/go.mod h1:qe5TWALJ8/a1Lqznoc5BDHpYX/8HU60Hm2AwRmqzxqA=
+github.com/rs/dnscache v0.0.0-20211102005908-e0241e321417/go.mod h1:qe5TWALJ8/a1Lqznoc5BDHpYX/8HU60Hm2AwRmqzxqA=
 github.com/rubiojr/go-vhd v0.0.0-20200706105327-02e210299021/go.mod h1:DM5xW0nvfNNm2uytzsvhI3OnX8uzaRAg8UX/CnDqbto=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -848,8 +846,6 @@ github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiB
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
@@ -913,8 +909,6 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1
 github.com/tsenart/go-tsz v0.0.0-20180814232043-cdeb9e1e981e/go.mod h1:SWZznP1z5Ki7hDT2ioqiFKEse8K9tU2OUvaRI0NeGQo=
 github.com/tsenart/go-tsz v0.0.0-20180814235614-0bd30b3df1c3 h1:pcQGQzTwCg//7FgVywqge1sW9Yf8VMsMdG58MI5kd8s=
 github.com/tsenart/go-tsz v0.0.0-20180814235614-0bd30b3df1c3/go.mod h1:SWZznP1z5Ki7hDT2ioqiFKEse8K9tU2OUvaRI0NeGQo=
-github.com/tsenart/vegeta v12.7.1-0.20190725001342-b5f4fca92137+incompatible h1:ErZrHhRveAoznVW80gbrxz+qxJNydpA2fcQxTPHkZbU=
-github.com/tsenart/vegeta v12.7.1-0.20190725001342-b5f4fca92137+incompatible/go.mod h1:Smz/ZWfhKRcyDDChZkG3CyTHdj87lHzio/HOCkbndXM=
 github.com/tsenart/vegeta/v12 v12.8.4 h1:UQ7tG7WkDorKj0wjx78Z4/vsMBP8RJQMGJqRVrkvngg=
 github.com/tsenart/vegeta/v12 v12.8.4/go.mod h1:ZiJtwLn/9M4fTPdMY7bdbIeyNeFVE8/AHbWFqCsUuho=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
@@ -950,7 +944,6 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
@@ -1104,10 +1097,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210917221730-978cfadd31cf/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211101193420-4a448f8816b3/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211205041911-012df41ee64c h1:7SfqwP5fxEtl/P02w5IhKc86ziJ+A25yFrkVgoy2FT8=
 golang.org/x/net v0.0.0-20211205041911-012df41ee64c/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -1129,7 +1120,6 @@ golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211028175245-ba495a64dcb5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 h1:RerP+noqYHUQ8CMRcPlC2nvTa4dcBIjegkuWdcUDuqg=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1237,12 +1227,10 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210917161153-d61c044b1678/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881 h1:TyHqChC80pFkXWraUUf6RuB5IqFdQieMLwwCJokV2pc=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1332,7 +1320,6 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo=
 golang.org/x/tools v0.1.8 h1:P1HhGGuLW4aAclzjtmJdf0mJOjVUZUzOTqkAkWL+l6w=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1379,7 +1366,6 @@ google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqiv
 google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
 google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
 google.golang.org/api v0.58.0/go.mod h1:cAbP2FsxoGVNwtgNAmmn3y5G1TWAiVYRmg4yku3lv+E=
-google.golang.org/api v0.60.0/go.mod h1:d7rl65NZAkEQ90JFzqBjcRq1TVeG5ZoGV3sSpEnnVb4=
 google.golang.org/api v0.61.0 h1:TXXKS1slM3b2bZNJwD5DV/Tp6/M2cLzLOLh9PjDhrw8=
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -1453,7 +1439,6 @@ google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEc
 google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211016002631-37fc39342514/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211021150943-2b146023228c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12 h1:DN5b3HU13J4sMd/QjDx34U6afpaexKTDdop+26pdjdk=
 google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
@@ -1604,7 +1589,6 @@ k8s.io/csi-translation-lib v0.21.0/go.mod h1:edq+UMpgqEx3roTuGF/03uIuSOsI986jtu6
 k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20201203183100-97869a43a9d9/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo v0.0.0-20201214224949-b6c5ce23f027/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo v0.0.0-20210915205010-39e73c8a59cd/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo v0.0.0-20211129171323-c02415ce4185 h1:TT1WdmqqXareKxZ/oNXEUSwKlLiHzPMyB0t8BaFeBYI=
 k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/klog v0.2.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
@@ -1623,14 +1607,13 @@ k8s.io/legacy-cloud-providers v0.21.0 h1:iWf5xaX9yvYT5mkz8UB96UtISQ5IkrWeuMPMhRp
 k8s.io/legacy-cloud-providers v0.21.0/go.mod h1:bNxo7gDg+PGkBmT/MFZswLTWdSWK9kAlS1s8DJca5q4=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920 h1:CbnUZsM497iRC5QMVkHwyl8s2tB3g7yaSHkYPkpgelw=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/caching v0.0.0-20211203062336-50189aafddf2 h1:j85yqFhpq5iA1iOt4B9c9LtryKMlKMKXVZe9kWtSAlg=
-knative.dev/caching v0.0.0-20211203062336-50189aafddf2/go.mod h1:/HIs+aQnqTopt22ezLsFNi2pp1EkR8gCGiJEdotFOkw=
+knative.dev/caching v0.0.0-20211206133228-c29dc56d8f03 h1:9GfnO6TEWZ3iJk0u/+uAmBWU535RC4j5ulRYT0WijY0=
+knative.dev/caching v0.0.0-20211206133228-c29dc56d8f03/go.mod h1:xki+LBTL1riXSoU2dKznqUfgOlQ2eO/F1WF+GMXxH0k=
 knative.dev/hack v0.0.0-20211122162614-813559cefdda/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
 knative.dev/hack v0.0.0-20211203062838-e11ac125e707 h1:Nx3HBoTHjYzXT9xxh5j6A8pMapNqyDLqjl784YxWPDQ=
 knative.dev/hack v0.0.0-20211203062838-e11ac125e707/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20211203062838-d65e1ba909fe h1:2mR3XjRjq5TzR1tW2hb5hnuwrEGlH6QoHgTD7hx/IS0=
-knative.dev/networking v0.0.0-20211203062838-d65e1ba909fe/go.mod h1:ZvA2FO5wExIGXTpH+egSwEK/SIaQVm6i7ErvFWsJMaU=
-knative.dev/pkg v0.0.0-20211129195804-438776b3c87c/go.mod h1:AKPae1Cmj+k0GWXWnF2tKY7q5qPa1mTD7oCP4OeMvEM=
+knative.dev/networking v0.0.0-20211209101835-8ef631418fc0 h1:pGD0rfuuRamc85jiGJRz8xti6e0JKHQt3aoR4LEKTwU=
+knative.dev/networking v0.0.0-20211209101835-8ef631418fc0/go.mod h1:+ozCw7PVf//G9+HOW04hfWnU8UJE5fmWAQkb+ieMaXY=
 knative.dev/pkg v0.0.0-20211206113427-18589ac7627e h1:8hK7g4jz56ZtF3iQLsvrvR/hHnP5ZWLSxLnyYMbfxwY=
 knative.dev/pkg v0.0.0-20211206113427-18589ac7627e/go.mod h1:E6B4RTjZyxe55a0kxOlnEHEl71zuG7gghnqYvNBKwBw=
 pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
diff --git a/pkg/apis/serving/v1/revision_types.go b/pkg/apis/serving/v1/revision_types.go
index 959d5e97a..f54273119 100644
--- a/pkg/apis/serving/v1/revision_types.go
+++ b/pkg/apis/serving/v1/revision_types.go
@@ -88,6 +88,11 @@ type RevisionSpec struct {
 	// (send network traffic). If unspecified, a system default will be provided.
 	// +optional
 	TimeoutSeconds *int64 `json:"timeoutSeconds,omitempty"`
+
+	// MaxDurationSeconds is the maximum duration in seconds a request will be allowed
+	// to stay open.
+	// +optional
+	MaxDurationSeconds *int64 `json:"maxDurationSeconds,omitempty"`
 }
 
 const (
diff --git a/pkg/apis/serving/v1/zz_generated.deepcopy.go b/pkg/apis/serving/v1/zz_generated.deepcopy.go
index d249e4ff4..230f6f984 100644
--- a/pkg/apis/serving/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/serving/v1/zz_generated.deepcopy.go
@@ -230,6 +230,11 @@ func (in *RevisionSpec) DeepCopyInto(out *RevisionSpec) {
 		*out = new(int64)
 		**out = **in
 	}
+	if in.MaxDurationSeconds != nil {
+		in, out := &in.MaxDurationSeconds, &out.MaxDurationSeconds
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
diff --git a/pkg/http/handler/timeout.go b/pkg/http/handler/timeout.go
index 9917ec01d..e971c02de 100644
--- a/pkg/http/handler/timeout.go
+++ b/pkg/http/handler/timeout.go
@@ -30,11 +30,12 @@ import (
 )
 
 type timeoutHandler struct {
-	handler          http.Handler
-	firstByteTimeout time.Duration
-	idleTimeout      time.Duration
-	body             string
-	clock            clock.Clock
+	handler            http.Handler
+	firstByteTimeout   time.Duration
+	idleTimeout        time.Duration
+	maxDurationTimeout time.Duration
+	body               string
+	clock              clock.Clock
 }
 
 // NewTimeoutHandler returns a Handler that runs `h` with the
@@ -53,13 +54,14 @@ type timeoutHandler struct {
 // https://golang.org/pkg/net/http/#Handler.
 //
 // The implementation is largely inspired by http.TimeoutHandler.
-func NewTimeoutHandler(h http.Handler, msg string, firstByteTimeout time.Duration, idleTimeout time.Duration) http.Handler {
+func NewTimeoutHandler(h http.Handler, msg string, firstByteTimeout time.Duration, idleTimeout time.Duration, maxDurationTimeout time.Duration) http.Handler {
 	return &timeoutHandler{
-		handler:          h,
-		body:             msg,
-		firstByteTimeout: firstByteTimeout,
-		idleTimeout:      idleTimeout,
-		clock:            clock.RealClock{},
+		handler:            h,
+		body:               msg,
+		firstByteTimeout:   firstByteTimeout,
+		idleTimeout:        idleTimeout,
+		maxDurationTimeout: maxDurationTimeout,
+		clock:              clock.RealClock{},
 	}
 }
 
@@ -90,6 +92,20 @@ func (h *timeoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// the panic from h.handler.ServeHTTP if h.handler.ServeHTTP panics.
 	done := make(chan interface{})
 	tw := &timeoutWriter{w: w, clock: h.clock}
+
+	var maxDurationTimeout clock.Timer
+	var maxDurationTimeoutDrained bool
+	if h.maxDurationTimeout > 0 {
+		maxDurationTimeout = getTimer(h.clock, h.maxDurationTimeout)
+		defer func() {
+			putTimer(maxDurationTimeout, maxDurationTimeoutDrained)
+		}()
+	}
+	var maxDurationTimeoutCh <-chan time.Time
+	if maxDurationTimeout != nil {
+		maxDurationTimeoutCh = maxDurationTimeout.C()
+	}
+
 	go func() {
 		defer func() {
 			defer close(done)
@@ -97,6 +113,7 @@ func (h *timeoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				done <- p
 			}
 		}()
+
 		h.handler.ServeHTTP(tw, r.WithContext(ctx))
 	}()
 
@@ -119,6 +136,12 @@ func (h *timeoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 			idleTimeout.Reset(timeToNextTimeout)
+		case <-maxDurationTimeoutCh:
+			timedOut := tw.maxDurationTimeoutAndWriteError(h.body)
+			if timedOut {
+				maxDurationTimeoutDrained = true
+				return
+			}
 		}
 	}
 }
@@ -222,6 +245,13 @@ func (tw *timeoutWriter) tryIdleTimeoutAndWriteError(curTime time.Time, idleTime
 	return false, idleTimeout - timeSinceLastWrite
 }
 
+func (tw *timeoutWriter) maxDurationTimeoutAndWriteError(msg string) bool {
+	tw.mu.Lock()
+	defer tw.mu.Unlock()
+	tw.timeoutAndWriteError(msg)
+	return true
+}
+
 func (tw *timeoutWriter) timeoutAndWriteError(msg string) {
 	tw.w.WriteHeader(http.StatusGatewayTimeout)
 	io.WriteString(tw.w, msg)
diff --git a/pkg/reconciler/revision/resources/queue.go b/pkg/reconciler/revision/resources/queue.go
index 752203eb7..df40d6367 100644
--- a/pkg/reconciler/revision/resources/queue.go
+++ b/pkg/reconciler/revision/resources/queue.go
@@ -193,7 +193,10 @@ func makeQueueContainer(rev *v1.Revision, cfg *config.Config) (*corev1.Container
 	if rev.Spec.TimeoutSeconds != nil {
 		ts = *rev.Spec.TimeoutSeconds
 	}
-
+	maxDurationTS := int64(0)
+	if rev.Spec.MaxDurationSeconds != nil {
+		maxDurationTS = *rev.Spec.MaxDurationSeconds
+	}
 	ports := queueNonServingPorts
 	if cfg.Observability.EnableProfiling {
 		ports = append(ports, profilingPort)
@@ -275,6 +278,9 @@ func makeQueueContainer(rev *v1.Revision, cfg *config.Config) (*corev1.Container
 		}, {
 			Name:  "REVISION_TIMEOUT_SECONDS",
 			Value: strconv.Itoa(int(ts)),
+		}, {
+			Name:  "MAX_DURATION_SECONDS",
+			Value: strconv.Itoa(int(maxDurationTS)),
 		}, {
 			Name: "SERVING_POD",
 			ValueFrom: &corev1.EnvVarSource{
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 2d988f78b..1c1d99420 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -79,6 +79,7 @@ github.com/blang/semver/v4
 # github.com/blendle/zapdriver v1.3.1
 github.com/blendle/zapdriver
 # github.com/c2h5oh/datasize v0.0.0-20200112174442-28bbd4740fee
+## explicit
 github.com/c2h5oh/datasize
 # github.com/census-instrumentation/opencensus-proto v0.3.0
 github.com/census-instrumentation/opencensus-proto/gen-go/agent/common/v1
@@ -95,6 +96,8 @@ github.com/containerd/stargz-snapshotter/estargz/errorutil
 # github.com/davecgh/go-spew v1.1.1
 ## explicit
 github.com/davecgh/go-spew/spew
+# github.com/dgryski/go-gk v0.0.0-20200319235926-a69029f61654
+## explicit
 # github.com/docker/cli v20.10.11+incompatible
 github.com/docker/cli/cli/config
 github.com/docker/cli/cli/config/configfile
@@ -124,12 +127,16 @@ github.com/go-logfmt/logfmt
 # github.com/go-logr/logr v0.4.0
 github.com/go-logr/logr
 # github.com/go-openapi/jsonpointer v0.19.5
+## explicit
 github.com/go-openapi/jsonpointer
 # github.com/go-openapi/jsonreference v0.19.5
+## explicit
 github.com/go-openapi/jsonreference
 # github.com/go-openapi/spec v0.19.6
+## explicit
 github.com/go-openapi/spec
 # github.com/go-openapi/swag v0.19.15
+## explicit
 github.com/go-openapi/swag
 # github.com/gobuffalo/flect v0.2.4
 github.com/gobuffalo/flect
@@ -211,6 +218,7 @@ github.com/hashicorp/golang-lru/simplelru
 # github.com/imdario/mergo v0.3.12
 github.com/imdario/mergo
 # github.com/influxdata/tdigest v0.0.1
+## explicit
 github.com/influxdata/tdigest
 # github.com/jmespath/go-jmespath v0.4.0
 github.com/jmespath/go-jmespath
@@ -229,12 +237,15 @@ github.com/klauspost/compress/internal/snapref
 github.com/klauspost/compress/zstd
 github.com/klauspost/compress/zstd/internal/xxhash
 # github.com/mailru/easyjson v0.7.7
+## explicit
 github.com/mailru/easyjson
 github.com/mailru/easyjson/buffer
 github.com/mailru/easyjson/jlexer
 github.com/mailru/easyjson/jwriter
 # github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369
 github.com/matttproud/golang_protobuf_extensions/pbutil
+# github.com/miekg/dns v1.1.29
+## explicit
 # github.com/mitchellh/go-homedir v1.1.0
 github.com/mitchellh/go-homedir
 # github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
@@ -282,6 +293,7 @@ github.com/sirupsen/logrus
 # github.com/spf13/pflag v1.0.5
 github.com/spf13/pflag
 # github.com/tsenart/go-tsz v0.0.0-20180814235614-0bd30b3df1c3
+## explicit
 github.com/tsenart/go-tsz
 github.com/tsenart/go-tsz/testdata
 # github.com/tsenart/vegeta/v12 v12.8.4
@@ -979,7 +991,7 @@ k8s.io/utils/buffer
 k8s.io/utils/integer
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20211203062336-50189aafddf2
+# knative.dev/caching v0.0.0-20211206133228-c29dc56d8f03
 ## explicit
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -1004,7 +1016,7 @@ knative.dev/caching/pkg/client/listers/caching/v1alpha1
 ## explicit
 knative.dev/hack
 knative.dev/hack/shell
-# knative.dev/networking v0.0.0-20211203062838-d65e1ba909fe
+# knative.dev/networking v0.0.0-20211209101835-8ef631418fc0
 ## explicit
 knative.dev/networking/config
 knative.dev/networking/pkg


Test patch:
diff --git a/pkg/http/handler/timeout_test.go b/pkg/http/handler/timeout_test.go
index b7eccd10f..061134b59 100644
--- a/pkg/http/handler/timeout_test.go
+++ b/pkg/http/handler/timeout_test.go
@@ -78,15 +78,16 @@ func TestTimeoutWriterErrorsWriteAfterTimeout(t *testing.T) {
 }
 
 type timeoutHandlerTestScenario struct {
-	name             string
-	firstByteTimeout time.Duration
-	idleTimeout      time.Duration
-	handler          func(clock *clock.FakeClock, mux *sync.Mutex, writeErrors chan error) http.Handler
-	timeoutMessage   string
-	wantStatus       int
-	wantBody         string
-	wantWriteError   bool
-	wantPanic        bool
+	name               string
+	firstByteTimeout   time.Duration
+	idleTimeout        time.Duration
+	maxDurationTimeout time.Duration
+	handler            func(clock *clock.FakeClock, mux *sync.Mutex, writeErrors chan error) http.Handler
+	timeoutMessage     string
+	wantStatus         int
+	wantBody           string
+	wantWriteError     bool
+	wantPanic          bool
 }
 
 // This has to be global as the timer cache would otherwise return timers from another clock.
@@ -102,11 +103,12 @@ func testTimeoutScenario(t *testing.T, scenarios []timeoutHandlerTestScenario) {
 			rr := httptest.NewRecorder()
 
 			handler := &timeoutHandler{
-				handler:          scenario.handler(fakeClock, &reqMux, writeErrors),
-				body:             scenario.timeoutMessage,
-				firstByteTimeout: scenario.firstByteTimeout,
-				idleTimeout:      scenario.idleTimeout,
-				clock:            fakeClock,
+				handler:            scenario.handler(fakeClock, &reqMux, writeErrors),
+				body:               scenario.timeoutMessage,
+				firstByteTimeout:   scenario.firstByteTimeout,
+				idleTimeout:        scenario.idleTimeout,
+				maxDurationTimeout: scenario.maxDurationTimeout,
+				clock:              fakeClock,
 			}
 
 			defer func() {
@@ -320,6 +322,82 @@ func TestIdleTimeoutHandler(t *testing.T) {
 		wantPanic:  true,
 	}}
 
+	// Max duration is 0, thus disabled
+	testTimeoutScenario(t, scenarios)
+
+	// If max duration is set high enough it should not affect any idle timeout test
+	for i := range scenarios {
+		scenarios[i].maxDurationTimeout = 5 * longIdleTimeout
+	}
+	testTimeoutScenario(t, scenarios)
+}
+
+func TestMaxDurationTimeoutHandler(t *testing.T) {
+	const (
+		noTimeout        = 0 * time.Millisecond
+		immediateTimeout = 1 * time.Millisecond
+		shortTimeout     = 100 * time.Millisecond
+		longTimeout      = 1 * time.Minute
+	)
+
+	scenarios := []timeoutHandlerTestScenario{{
+		name:               "all good",
+		firstByteTimeout:   shortTimeout,
+		idleTimeout:        shortTimeout,
+		maxDurationTimeout: longTimeout,
+		handler: func(*clock.FakeClock, *sync.Mutex, chan error) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Write([]byte("hi"))
+			})
+		},
+		wantStatus: http.StatusOK,
+		wantBody:   "hi",
+	}, {
+		name:               "max duration timeout with writes",
+		firstByteTimeout:   shortTimeout,
+		idleTimeout:        shortTimeout,
+		maxDurationTimeout: longTimeout,
+		handler: func(c *clock.FakeClock, mux *sync.Mutex, _ chan error) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				c.Step(longTimeout)
+				mux.Lock()
+				defer mux.Unlock()
+				w.Write([]byte("hi"))
+			})
+		},
+		wantStatus: http.StatusGatewayTimeout,
+	}, {
+		name:               "propagate panic, max duration too short",
+		idleTimeout:        longTimeout,
+		firstByteTimeout:   longTimeout,
+		maxDurationTimeout: immediateTimeout,
+		handler: func(*clock.FakeClock, *sync.Mutex, chan error) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				panic(http.ErrAbortHandler)
+			})
+		},
+		wantStatus: http.StatusGatewayTimeout,
+		wantBody:   "request timeout",
+		wantPanic:  true,
+	}, {
+		name:               "timeout before panic, max duration too short",
+		idleTimeout:        shortTimeout,
+		firstByteTimeout:   shortTimeout,
+		maxDurationTimeout: immediateTimeout,
+		handler: func(c *clock.FakeClock, mux *sync.Mutex, _ chan error) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				c.Step(immediateTimeout)
+				mux.Lock()
+				defer mux.Unlock()
+				panic(http.ErrAbortHandler)
+			})
+		},
+		timeoutMessage: "request timeout",
+		wantStatus:     http.StatusGatewayTimeout,
+		wantBody:       "request timeout",
+		wantPanic:      false,
+	}}
+
 	testTimeoutScenario(t, scenarios)
 
 }
@@ -332,7 +410,7 @@ func BenchmarkTimeoutHandler(b *testing.B) {
 			w.Write(write)
 		}
 	})
-	handler := NewTimeoutHandler(baseHandler, "test", 10*time.Minute, 10*time.Minute)
+	handler := NewTimeoutHandler(baseHandler, "test", 10*time.Minute, 10*time.Minute, 10*time.Minute)
 	req := httptest.NewRequest(http.MethodPost, "http://example.com", nil)
 
 	b.Run("sequential", func(b *testing.B) {
diff --git a/pkg/reconciler/revision/resources/deploy_test.go b/pkg/reconciler/revision/resources/deploy_test.go
index e57ff658c..cdedeee66 100644
--- a/pkg/reconciler/revision/resources/deploy_test.go
+++ b/pkg/reconciler/revision/resources/deploy_test.go
@@ -110,6 +110,9 @@ var (
 		}, {
 			Name:  "REVISION_TIMEOUT_SECONDS",
 			Value: "45",
+		}, {
+			Name:  "MAX_DURATION_SECONDS",
+			Value: "100",
 		}, {
 			Name: "SERVING_POD",
 			ValueFrom: &corev1.EnvVarSource{
@@ -264,7 +267,8 @@ func defaultRevision() *v1.Revision {
 			UID: "1234",
 		},
 		Spec: v1.RevisionSpec{
-			TimeoutSeconds: ptr.Int64(45),
+			TimeoutSeconds:     ptr.Int64(45),
+			MaxDurationSeconds: ptr.Int64(100),
 		},
 	}
 }
@@ -416,7 +420,8 @@ func withContainers(containers []corev1.Container) RevisionOption {
 			PodSpec: corev1.PodSpec{
 				Containers: containers,
 			},
-			TimeoutSeconds: ptr.Int64(45),
+			TimeoutSeconds:     ptr.Int64(45),
+			MaxDurationSeconds: ptr.Int64(100),
 		}
 	}
 }
diff --git a/pkg/reconciler/revision/resources/queue_test.go b/pkg/reconciler/revision/resources/queue_test.go
index 20c77326b..fa28d8459 100644
--- a/pkg/reconciler/revision/resources/queue_test.go
+++ b/pkg/reconciler/revision/resources/queue_test.go
@@ -254,6 +254,19 @@ func TestMakeQueueContainer(t *testing.T) {
 				"REVISION_TIMEOUT_SECONDS": "99",
 			})
 		}),
+	}, {
+		name: "custom maxDurationSeconds",
+		rev: revision("bar", "foo",
+			withContainers(containers),
+			func(revision *v1.Revision) {
+				revision.Spec.MaxDurationSeconds = ptr.Int64(99)
+			},
+		),
+		want: queueContainer(func(c *corev1.Container) {
+			c.Env = env(map[string]string{
+				"MAX_DURATION_SECONDS": "99",
+			})
+		}),
 	}, {
 		name: "default resource config",
 		rev: revision("bar", "foo",
@@ -371,6 +384,7 @@ func TestMakeQueueContainer(t *testing.T) {
 				Name:  "SERVING_READINESS_PROBE",
 				Value: probeJSON(test.rev.Spec.GetContainer()),
 			})
+
 			sortEnv(got.Env)
 			sortEnv(test.want.Env)
 			if got, want := *got, test.want; !cmp.Equal(got, want, quantityComparer) {
@@ -678,7 +692,8 @@ func TestTCPProbeGeneration(t *testing.T) {
 			SuccessThreshold: 3,
 		},
 		rev: v1.RevisionSpec{
-			TimeoutSeconds: ptr.Int64(45),
+			TimeoutSeconds:     ptr.Int64(45),
+			MaxDurationSeconds: ptr.Int64(100),
 			PodSpec: corev1.PodSpec{
 				Containers: []corev1.Container{{
 					Name: servingContainerName,
@@ -718,7 +733,8 @@ func TestTCPProbeGeneration(t *testing.T) {
 	}, {
 		name: "tcp defaults",
 		rev: v1.RevisionSpec{
-			TimeoutSeconds: ptr.Int64(45),
+			TimeoutSeconds:     ptr.Int64(45),
+			MaxDurationSeconds: ptr.Int64(100),
 			PodSpec: corev1.PodSpec{
 				Containers: []corev1.Container{{
 					Name: servingContainerName,
@@ -774,7 +790,8 @@ func TestTCPProbeGeneration(t *testing.T) {
 			InitialDelaySeconds: 3,
 		},
 		rev: v1.RevisionSpec{
-			TimeoutSeconds: ptr.Int64(45),
+			TimeoutSeconds:     ptr.Int64(45),
+			MaxDurationSeconds: ptr.Int64(100),
 			PodSpec: corev1.PodSpec{
 				Containers: []corev1.Container{{
 					Name: servingContainerName,
@@ -855,6 +872,7 @@ var defaultEnv = map[string]string{
 	"METRICS_COLLECTOR_ADDRESS":        "",
 	"QUEUE_SERVING_PORT":               "8012",
 	"REVISION_TIMEOUT_SECONDS":         "45",
+	"MAX_DURATION_SECONDS":             "100",
 	"SERVING_CONFIGURATION":            "",
 	"SERVING_ENABLE_PROBE_REQUEST_LOG": "false",
 	"SERVING_ENABLE_REQUEST_LOG":       "false",
diff --git a/pkg/testing/v1/service.go b/pkg/testing/v1/service.go
index 589b90bfb..1f3aae83d 100644
--- a/pkg/testing/v1/service.go
+++ b/pkg/testing/v1/service.go
@@ -182,6 +182,13 @@ func WithRevisionTimeoutSeconds(revisionTimeoutSeconds int64) ServiceOption {
 	}
 }
 
+// WithMaxDurationSeconds sets revision max duration timeout
+func WithMaxDurationSeconds(maxDurationSeconds int64) ServiceOption {
+	return func(service *v1.Service) {
+		service.Spec.Template.Spec.MaxDurationSeconds = ptr.Int64(maxDurationSeconds)
+	}
+}
+
 // WithServiceAccountName sets revision service account name
 func WithServiceAccountName(serviceAccountName string) ServiceOption {
 	return func(service *v1.Service) {
diff --git a/test/conformance/api/v1/revision_timeout_test.go b/test/conformance/api/v1/revision_timeout_test.go
index 911fe8add..15c883d27 100644
--- a/test/conformance/api/v1/revision_timeout_test.go
+++ b/test/conformance/api/v1/revision_timeout_test.go
@@ -37,7 +37,7 @@ import (
 
 // sendRequests send a request to "endpoint", returns error if unexpected response code, nil otherwise.
 func sendRequest(t *testing.T, clients *test.Clients, endpoint *url.URL,
-	initialSleep, sleep time.Duration, expectedResponseCode int) error {
+	initialSleep, sleep time.Duration, expectedResponseCode int, expectedBody string) error {
 	client, err := pkgtest.NewSpoofingClient(context.Background(), clients.KubeClient, t.Logf, endpoint.Hostname(), test.ServingFlags.ResolvableDomain, test.AddRootCAtoTransport(context.Background(), t.Logf, clients, test.ServingFlags.HTTPS))
 	if err != nil {
 		return fmt.Errorf("error creating Spoofing client: %w", err)
@@ -67,40 +67,93 @@ func sendRequest(t *testing.T, clients *test.Clients, endpoint *url.URL,
 	if expectedResponseCode != resp.StatusCode {
 		return fmt.Errorf("response status code = %v, want = %v, response = %v", resp.StatusCode, expectedResponseCode, resp)
 	}
+	if expectedBody != "" {
+		gotBody := string(resp.Body)
+		if expectedBody != gotBody {
+			return fmt.Errorf("response body = %v, want = %v, response = %v", gotBody, expectedBody, resp)
+		}
+	}
+
 	return nil
 }
 
 func TestRevisionTimeout(t *testing.T) {
 	t.Parallel()
 	clients := test.Setup(t)
+	neverExpireMaxDurationSeconds := int64(100)
 
 	testCases := []struct {
-		name           string
-		shouldScaleTo0 bool
-		timeoutSeconds int64
-		initialSleep   time.Duration
-		sleep          time.Duration
-		expectedStatus int
+		name               string
+		timeoutSeconds     int64
+		maxDurationSeconds int64
+		initialSleep       time.Duration
+		sleep              time.Duration
+		expectedStatus     int
+		expectedBody       string
 	}{{
-		name:           "does not exceed timeout seconds",
+		name:           "does not exceed timeout seconds, no max duration timeout set",
 		timeoutSeconds: 10,
 		initialSleep:   2 * time.Second,
 		expectedStatus: http.StatusOK,
 	}, {
-		name:           "exceeds timeout seconds",
+		name:           "exceeds timeout seconds, no max duration timeout set",
 		timeoutSeconds: 10,
 		initialSleep:   12 * time.Second,
 		expectedStatus: http.StatusGatewayTimeout,
+		expectedBody:   "request timeout",
 	}, {
-		name:           "writes first byte before timeout",
+		name:           "writes first byte before timeout, no max duration timeout set",
 		timeoutSeconds: 10,
 		expectedStatus: http.StatusOK,
 		sleep:          15 * time.Second,
 		initialSleep:   0,
+	}, {
+		name:               "does not exceed timeout seconds, long max duration timeout has no effect",
+		timeoutSeconds:     10,
+		maxDurationSeconds: neverExpireMaxDurationSeconds,
+		initialSleep:       2 * time.Second,
+		expectedStatus:     http.StatusOK,
+	}, {
+		name:               "exceeds timeout seconds, long max duration timeout has no effect",
+		timeoutSeconds:     10,
+		maxDurationSeconds: neverExpireMaxDurationSeconds,
+		initialSleep:       12 * time.Second,
+		expectedStatus:     http.StatusGatewayTimeout,
+		expectedBody:       "request timeout",
+	}, {
+		name:               "writes first byte before timeout, long max duration timeout has no effect",
+		timeoutSeconds:     10,
+		maxDurationSeconds: neverExpireMaxDurationSeconds,
+		expectedStatus:     http.StatusOK,
+		sleep:              15 * time.Second,
+		initialSleep:       0,
+	}, {
+		name:               "exceeds max duration timeout",
+		timeoutSeconds:     15,
+		maxDurationSeconds: 10,
+		initialSleep:       12 * time.Second,
+		expectedStatus:     http.StatusGatewayTimeout,
+		expectedBody:       "request timeout",
+	}, {
+		name:               "exceeds multiple timeouts",
+		timeoutSeconds:     10,
+		maxDurationSeconds: 10,
+		initialSleep:       12 * time.Second,
+		expectedStatus:     http.StatusGatewayTimeout,
+		expectedBody:       "request timeout",
+	}, {
+		name:               "writes first byte (HTTP OK), max duration violated, request can still timeout",
+		timeoutSeconds:     10,
+		maxDurationSeconds: 12,
+		expectedStatus:     http.StatusOK,
+		sleep:              15 * time.Second,
+		initialSleep:       0,
+		expectedBody:       "request timeout",
 	}}
 
 	for _, tc := range testCases {
 		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -112,7 +165,7 @@ func TestRevisionTimeout(t *testing.T) {
 			test.EnsureTearDown(t, clients, &names)
 
 			t.Log("Creating a new Service ")
-			resources, err := v1test.CreateServiceReady(t, clients, &names, WithRevisionTimeoutSeconds(tc.timeoutSeconds))
+			resources, err := v1test.CreateServiceReady(t, clients, &names, WithRevisionTimeoutSeconds(tc.timeoutSeconds), WithMaxDurationSeconds(tc.maxDurationSeconds))
 			if err != nil {
 				t.Fatal("Failed to create Service:", err)
 			}
@@ -132,9 +185,9 @@ func TestRevisionTimeout(t *testing.T) {
 				t.Fatalf("Error probing %s: %v", serviceURL, err)
 			}
 
-			if err := sendRequest(t, clients, serviceURL, tc.initialSleep, tc.sleep, tc.expectedStatus); err != nil {
-				t.Errorf("Failed request with initialSleep %v, sleep %v, with revision timeout %ds and expecting status %v: %v",
-					tc.initialSleep, tc.sleep, tc.timeoutSeconds, tc.expectedStatus, err)
+			if err := sendRequest(t, clients, serviceURL, tc.initialSleep, tc.sleep, tc.expectedStatus, tc.expectedBody); err != nil {
+				t.Errorf("Failed request with initialSleep %v, sleep %v, with revision timeout %ds, expecting status %v and body %q: %v",
+					tc.initialSleep, tc.sleep, tc.timeoutSeconds, tc.expectedStatus, tc.expectedBody, err)
 			}
 		})
 	}
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 6bc415009..032766914 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,9 +19,9 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -53,9 +53,9 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
   - admissionReviewVersions:
@@ -95,9 +95,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
 
 ---
@@ -122,9 +122,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -172,9 +172,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -187,16 +187,16 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20211202-5eb19d26"
+        app.kubernetes.io/version: "20211213-ae687ae3"
         app.kubernetes.io/name: knative-serving
-        serving.knative.dev/release: "v20211202-5eb19d26"
+        serving.knative.dev/release: "v20211213-ae687ae3"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:8690f0526bd19f030e7c0521b47acce6d15659bf478bc7c4d893a209111fac8d
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:57683e1ca16b9dde04f9abd08b92d0e7956fe75284186dd71bc8b13481a9ee4c
           resources:
             requests:
               cpu: 30m
@@ -235,9 +235,9 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
   namespace: knative-serving
@@ -275,9 +275,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -291,17 +291,17 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20211202-5eb19d26"
+        app.kubernetes.io/version: "20211213-ae687ae3"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20211202-5eb19d26"
+        serving.knative.dev/release: "v20211213-ae687ae3"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:3755e5e9e5bad95b8abd54e86ed36af69cf931014f7ce794dd7be2b504b559f7
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:a8e5626501fe4aac4333c1d9d8ca6e552daba9e42fb523d1e8030e6542157846
           resources:
             requests:
               cpu: 20m
@@ -361,9 +361,9 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211202-5eb19d26"
+    app.kubernetes.io/version: "20211213-ae687ae3"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211202-5eb19d26"
+    serving.knative.dev/release: "v20211213-ae687ae3"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   ports:
diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index ef5243c9b..a5a1f44bd 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -1904,7 +1904,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -2155,7 +2155,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2244,7 +2244,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2340,7 +2340,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -2619,7 +2619,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -2731,7 +2731,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2820,7 +2820,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2916,7 +2916,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:73012e69f0a306a42dbe92281be679915e5694e8bf93311b2da8e93bd7b5622e
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5f726d901a2852197447b5d0ca43d7d0b3bb0756290fbd7984371ab5a49db853
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 1a892c32a..1d30c1faf 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-d6fc8ba5"
+    app.kubernetes.io/version: "20211212-8481d70a"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,8 +38,8 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-d6fc8ba5"
-    serving.knative.dev/release: "v20211208-d6fc8ba5"
+    app.kubernetes.io/version: "20211212-8481d70a"
+    serving.knative.dev/release: "v20211212-8481d70a"
 data:
   _example: |
     ################################
@@ -105,14 +105,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20211208-d6fc8ba5"
+        app.kubernetes.io/version: "20211212-8481d70a"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:722cea7bde0b56842c8f7ff487b6c4fee620f59a92e67f5298e6ce4ba725ebee
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:a54e68ea1ed6d91ec929076599c4ac2aae778350a051e72469fc072a7fe4a647
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/gateway-api-latest/istio-gateway.yaml b/third_party/gateway-api-latest/istio-gateway.yaml
index 1bc2c7730..4f2f690be 100644
--- a/third_party/gateway-api-latest/istio-gateway.yaml
+++ b/third_party/gateway-api-latest/istio-gateway.yaml
@@ -20,7 +20,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20211208-3a2571ad"
+    serving.knative.dev/release: "v20211213-11839c40"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
diff --git a/third_party/gateway-api-latest/net-gateway-api.yaml b/third_party/gateway-api-latest/net-gateway-api.yaml
index 02db5f854..7d9a221e0 100644
--- a/third_party/gateway-api-latest/net-gateway-api.yaml
+++ b/third_party/gateway-api-latest/net-gateway-api.yaml
@@ -2125,7 +2125,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-gateway-api-admin
   labels:
-    serving.knative.dev/release: "v20211208-3a2571ad"
+    serving.knative.dev/release: "v20211213-11839c40"
 aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
@@ -2137,7 +2137,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-gateway-api-core
   labels:
-    serving.knative.dev/release: "v20211208-3a2571ad"
+    serving.knative.dev/release: "v20211213-11839c40"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["networking.x-k8s.io"]
@@ -2165,7 +2165,7 @@ metadata:
   name: config-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20211208-3a2571ad"
+    serving.knative.dev/release: "v20211213-11839c40"
 data:
   _example: |
     ################################
@@ -2219,9 +2219,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: net-gateway-api
     app.kubernetes.io/component: net-gateway-api
-    app.kubernetes.io/version: "20211208-3a2571ad"
+    app.kubernetes.io/version: "20211213-11839c40"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-3a2571ad"
+    serving.knative.dev/release: "v20211213-11839c40"
 spec:
   replicas: 1
   selector:
@@ -2247,7 +2247,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:10f12c11efe7222eda88bc2a2a596654890983185d4cd83628c38ffd10f824fe
+          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:897dfb8cd58ab9890f11da0bb742ad34d2969703dac5fe2bfcda2267f60a9887
           resources:
             requests:
               cpu: 100m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index f838cb980..28b50f862 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was c24c937a9f7a7454b589848064b104568ca0678f
+# Generated when HEAD was c9e88c57e17f3e7114e2a4384bf5fa46965ff196
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,8 +22,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -55,8 +55,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -95,8 +95,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -117,8 +117,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -153,8 +153,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -220,8 +220,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -239,8 +239,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -258,8 +258,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -292,8 +292,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -311,15 +311,15 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20211208-c24c937a"
-        serving.knative.dev/release: "v20211208-c24c937a"
+        app.kubernetes.io/version: "20211213-c9e88c57"
+        serving.knative.dev/release: "v20211213-c9e88c57"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:bea3971c54aaef393d0eaa8682989da5b030857f35d727e10c74107989b3a7da
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:a1d4211aaa26f3d176458f1c912ab8820d159c378f66c1301889d0606031da12
           resources:
             requests:
               cpu: 30m
@@ -378,8 +378,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -395,15 +395,15 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20211208-c24c937a"
-        serving.knative.dev/release: "v20211208-c24c937a"
+        app.kubernetes.io/version: "20211213-c9e88c57"
+        serving.knative.dev/release: "v20211213-c9e88c57"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:dee4c1be46122e49a6c7817339a166ce5e241c2f1baf745edab24f80573eb438
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:fee5b5a4483dd34c207deb62d15e3ce6172ebbea530d4fd3de7817efdbd3bf9b
           resources:
             requests:
               cpu: 20m
@@ -458,8 +458,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -486,8 +486,8 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -526,8 +526,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -566,8 +566,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211208-c24c937a"
-    serving.knative.dev/release: "v20211208-c24c937a"
+    app.kubernetes.io/version: "20211213-c9e88c57"
+    serving.knative.dev/release: "v20211213-c9e88c57"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index b7c8a9fda..ad85940db 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -20,8 +20,8 @@ metadata:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -46,9 +46,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 data:
   envoy-bootstrap.yaml: |
     dynamic_resources:
@@ -152,9 +152,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 data:
   _example: |
     ################################
@@ -200,9 +200,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -212,9 +212,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 rules:
   - apiGroups: [""]
     resources: ["events"]
@@ -242,9 +242,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -277,9 +277,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 spec:
   replicas: 1
   selector:
@@ -291,7 +291,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:bb309c355836adb9d3f642d851a7a93b5ab28184ef2fa2d4b929346a5a0a7b31
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:d10a5b94d1d9f59156493cc13ec710b4354c43b0aba71d7d57a43bc33024a715
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -331,9 +331,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 spec:
   ports:
     - name: grpc-xds
@@ -367,9 +367,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 spec:
   strategy:
     type: RollingUpdate
@@ -445,9 +445,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 spec:
   ports:
     - name: http2
@@ -470,9 +470,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211208-4e70a89b"
+    app.kubernetes.io/version: "20211213-479e8bf0"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211208-4e70a89b"
+    serving.knative.dev/release: "v20211213-479e8bf0"
 spec:
   ports:
     - name: http2