Repository: knative/serving
Pull request #9267 (2020-09-02 14:02:28)

[master] Update net-certmanager nightly
<!--[master] Update net-certmanager nightly-->
<!---->
Produced via:
  `curl https://storage.googleapis.com/knative-nightly/net-certmanager/latest/$x > /workspace/source/./third_party/cert-manager-0.12.0/$x`
/assign tcnghia ZhiminXiang
/cc tcnghia ZhiminXiang


knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/9267#" title="Author self-approved">mattmoor</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)~~ [mattmoor]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/9267#" title="Author self-approved">mattmoor</a>*, *<a href="https://github.com/knative/serving/pull/9267#pullrequestreview-480863296" title="LGTM">tcnghia</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)~~ [mattmoor,tcnghia]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.github/workflows/knative-go-build.yaml b/.github/workflows/knative-go-build.yaml
index 81b9b0084..5dd0fe7bb 100644
--- a/.github/workflows/knative-go-build.yaml
+++ b/.github/workflows/knative-go-build.yaml
@@ -12,6 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This file is automagically synced here from github.com/knative-sandbox/.github
+# repo by knobots: https://github.com/mattmoor/knobots and will be overwritten.
+
 name: Build
 
 on:
@@ -41,6 +44,8 @@ jobs:
 
       - name: Check out code
         uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
 
       - name: Vet
         run: go vet ./...
diff --git a/.github/workflows/knative-lint.yaml b/.github/workflows/knative-lint.yaml
new file mode 100644
index 000000000..46d1bfd88
--- /dev/null
+++ b/.github/workflows/knative-lint.yaml
@@ -0,0 +1,34 @@
+# Copyright 2020 The Knative Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Lint
+
+on:
+  push:
+    branches: [ 'master', 'release-*' ]
+  pull_request:
+    branches: [ 'master', 'release-*' ]
+
+jobs:
+  golangci:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v1
+        with:
+          version: v1.30
+          args: --timeout 5m --disable errcheck --enable unconvert,prealloc --build-tags="e2e performance probe preupgrade postupgrade postdowngrade istio" --skip-files ".pb.go$"
+          only-new-issues: true
diff --git a/.github/workflows/knative-stale.yaml b/.github/workflows/knative-stale.yaml
index 795eadf33..3c13bf9a3 100644
--- a/.github/workflows/knative-stale.yaml
+++ b/.github/workflows/knative-stale.yaml
@@ -1,7 +1,24 @@
+# Copyright 2020 The Knative Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This file is automagically synced here from github.com/knative-sandbox/.github
+# repo by knobots: https://github.com/mattmoor/knobots and will be overwritten.
+
 name: 'Close stale'
 on:
   schedule:
-  - cron: '0 1 * * *' # Everyday at 1AM
+  - cron: '0 1 * * *'
 
 jobs:
   stale:
diff --git a/.github/workflows/knative-style.yaml b/.github/workflows/knative-style.yaml
index e6dca76c3..fa14cdb4f 100644
--- a/.github/workflows/knative-style.yaml
+++ b/.github/workflows/knative-style.yaml
@@ -12,6 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This file is automagically synced here from github.com/knative-sandbox/.github
+# repo by knobots: https://github.com/mattmoor/knobots and will be overwritten.
+
 name: Code Style
 
 on:
@@ -36,6 +39,8 @@ jobs:
 
       - name: Check out code
         uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
 
       # TODO: add prettier step
       # TODO: add goimports step
diff --git a/.github/workflows/knative-verify.yaml b/.github/workflows/knative-verify.yaml
index 6128969f3..5d87b8a22 100644
--- a/.github/workflows/knative-verify.yaml
+++ b/.github/workflows/knative-verify.yaml
@@ -12,6 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This file is automagically synced here from github.com/knative-sandbox/.github
+# repo by knobots: https://github.com/mattmoor/knobots and will be overwritten.
+
 name: Verify
 
 on:
@@ -50,6 +53,7 @@ jobs:
     - name: Check out code onto GOPATH
       uses: actions/checkout@v2
       with:
+        fetch-depth: 1
         path: ./src/knative.dev/${{ github.event.repository.name }}
 
     - name: Update Codegen
diff --git a/config/core/configmaps/defaults.yaml b/config/core/configmaps/defaults.yaml
index 6b3d63234..456bbec28 100644
--- a/config/core/configmaps/defaults.yaml
+++ b/config/core/configmaps/defaults.yaml
@@ -20,7 +20,7 @@ metadata:
   labels:
     serving.knative.dev/release: devel
   annotations:
-    knative.dev/example-checksum: "b44360b5"
+    knative.dev/example-checksum: "d19e4f27"
 data:
   _example: |
     ################################
@@ -55,11 +55,15 @@ data:
     # revision-cpu-request contains the cpu allocation to assign
     # to revisions by default.  If omitted, no value is specified
     # and the system default is used.
+    # Below is an example of setting revision-cpu-request.
+    # By default, it is not set by Knative.
     revision-cpu-request: "400m"  # 0.4 of a CPU (aka 400 milli-CPU)
 
     # revision-memory-request contains the memory allocation to assign
     # to revisions by default.  If omitted, no value is specified
     # and the system default is used.
+    # Below is an example of setting revision-memory-request.
+    # By default, it is not set by Knative.
     revision-memory-request: "100M"  # 100 megabytes of memory
 
     # revision-ephemeral-storage-request contains the ephemeral storage
@@ -70,11 +74,15 @@ data:
     # revision-cpu-limit contains the cpu allocation to limit
     # revisions to by default.  If omitted, no value is specified
     # and the system default is used.
+    # Below is an example of setting revision-cpu-limit.
+    # By default, it is not set by Knative.
     revision-cpu-limit: "1000m"  # 1 CPU (aka 1000 milli-CPU)
 
     # revision-memory-limit contains the memory allocation to limit
     # revisions to by default.  If omitted, no value is specified
     # and the system default is used.
+    # Below is an example of setting revision-memory-limit.
+    # By default, it is not set by Knative.
     revision-memory-limit: "200M"  # 200 megabytes of memory
 
     # revision-ephemeral-storage-limit contains the ephemeral storage
diff --git a/go.mod b/go.mod
index 388eafb4b..e88f2a4d8 100644
--- a/go.mod
+++ b/go.mod
@@ -32,8 +32,8 @@ require (
 	k8s.io/code-generator v0.18.6
 	k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29
 	knative.dev/caching v0.0.0-20200831164016-8993b9e0e6f6
-	knative.dev/networking v0.0.0-20200901153316-80398434dcd4
-	knative.dev/pkg v0.0.0-20200901172015-edd1b5e0bebf
+	knative.dev/networking v0.0.0-20200902135616-75b2030c6657
+	knative.dev/pkg v0.0.0-20200901225315-2ee0e988033c
 	knative.dev/test-infra v0.0.0-20200831235415-fac473dda98b
 )
 
diff --git a/go.sum b/go.sum
index 68ae9b4ad..3ff5a9a6d 100644
--- a/go.sum
+++ b/go.sum
@@ -1801,8 +1801,8 @@ knative.dev/caching v0.0.0-20200831164016-8993b9e0e6f6 h1:tS93pEA8jCt8onqnXE3LoE
 knative.dev/caching v0.0.0-20200831164016-8993b9e0e6f6/go.mod h1:5V2/0AagUm0RX4CsCDOY9FwLRnnF2c5IaaA+kqXbqAc=
 knative.dev/eventing-contrib v0.6.1-0.20190723221543-5ce18048c08b/go.mod h1:SnXZgSGgMSMLNFTwTnpaOH7hXDzTFtw0J8OmHflNx3g=
 knative.dev/eventing-contrib v0.11.2/go.mod h1:SnXZgSGgMSMLNFTwTnpaOH7hXDzTFtw0J8OmHflNx3g=
-knative.dev/networking v0.0.0-20200901153316-80398434dcd4 h1:hdZOOdXg94MiBVZWJdgjO/JKoiC8kIdoMI9ChHv/sQc=
-knative.dev/networking v0.0.0-20200901153316-80398434dcd4/go.mod h1:9ZMxo5uevxp5T+e7djbo+jH4KXK6Lja9rPS0u86+GHw=
+knative.dev/networking v0.0.0-20200902135616-75b2030c6657 h1:PTXPxZ36xKKt17oBmJxZ7X0YD6DYPwWCmDeuklSuwbU=
+knative.dev/networking v0.0.0-20200902135616-75b2030c6657/go.mod h1:9ZMxo5uevxp5T+e7djbo+jH4KXK6Lja9rPS0u86+GHw=
 knative.dev/pkg v0.0.0-20191101194912-56c2594e4f11/go.mod h1:pgODObA1dTyhNoFxPZTTjNWfx6F0aKsKzn+vaT9XO/Q=
 knative.dev/pkg v0.0.0-20191111150521-6d806b998379/go.mod h1:pgODObA1dTyhNoFxPZTTjNWfx6F0aKsKzn+vaT9XO/Q=
 knative.dev/pkg v0.0.0-20200207155214-fef852970f43/go.mod h1:pgODObA1dTyhNoFxPZTTjNWfx6F0aKsKzn+vaT9XO/Q=
@@ -1813,8 +1813,8 @@ knative.dev/pkg v0.0.0-20200528142800-1c6815d7e4c9/go.mod h1:QgNZTxnwpB/oSpNcfnL
 knative.dev/pkg v0.0.0-20200711004937-22502028e31a/go.mod h1:AqAJV6rYi8IGikDjJ/9ZQd9qKdkXVlesVnVjwx62YB8=
 knative.dev/pkg v0.0.0-20200831094608-e9da10bc8a18 h1:BJTbbN0/J0BY76tzHE6/oko4lw6GEeahMrZUfigySyc=
 knative.dev/pkg v0.0.0-20200831094608-e9da10bc8a18/go.mod h1:vOVUMtkIWK+hq1+KwlLYBSYVjz5SNIP1vMj3/5SNGZw=
-knative.dev/pkg v0.0.0-20200901172015-edd1b5e0bebf h1:4sLAMPCGqJVocPMIGNwrh1NYsTbmefvWudnOKl5UZLo=
-knative.dev/pkg v0.0.0-20200901172015-edd1b5e0bebf/go.mod h1:q+4+Cm768P6vsAvsD9J+cZ1hoy4aHyHSfRTvaFyPd3g=
+knative.dev/pkg v0.0.0-20200901225315-2ee0e988033c h1:UHXZjWBNozXgKsLP9fvOBsjHQSFC0MOxTpIiA+5YHV4=
+knative.dev/pkg v0.0.0-20200901225315-2ee0e988033c/go.mod h1:q+4+Cm768P6vsAvsD9J+cZ1hoy4aHyHSfRTvaFyPd3g=
 knative.dev/test-infra v0.0.0-20200407185800-1b88cb3b45a5/go.mod h1:xcdUkMJrLlBswIZqL5zCuBFOC22WIPMQoVX1L35i0vQ=
 knative.dev/test-infra v0.0.0-20200505052144-5ea2f705bb55/go.mod h1:WqF1Azka+FxPZ20keR2zCNtiQA1MP9ZB4BH4HuI+SIU=
 knative.dev/test-infra v0.0.0-20200513011557-d03429a76034/go.mod h1:aMif0KXL4g19YCYwsy4Ocjjz5xgPlseYV+B95Oo4JGE=
diff --git a/pkg/activator/net/throttler.go b/pkg/activator/net/throttler.go
index 48e159490..5acb46842 100644
--- a/pkg/activator/net/throttler.go
+++ b/pkg/activator/net/throttler.go
@@ -280,7 +280,7 @@ func (rt *revisionThrottler) updateCapacity(backendCount int) {
 			rt.resetTrackers()
 			assigned = assignSlice(rt.podTrackers, ai, ac, rt.containerConcurrency)
 		}
-		rt.logger.Debugf("Trackers %d/%d:  %v", ai, ac, rt.assignedTrackers)
+		rt.logger.Debugf("Trackers %d/%d: assignment: %v", ai, ac, assigned)
 		// The actual write out of the assigned trackers has to be under lock.
 		rt.mux.Lock()
 		defer rt.mux.Unlock()
diff --git a/pkg/apis/serving/v1alpha1/route_validation.go b/pkg/apis/serving/v1alpha1/route_validation.go
index 90206bdad..50a0ae4b8 100644
--- a/pkg/apis/serving/v1alpha1/route_validation.go
+++ b/pkg/apis/serving/v1alpha1/route_validation.go
@@ -19,15 +19,18 @@ package v1alpha1
 import (
 	"context"
 	"fmt"
+	"strconv"
 
 	"k8s.io/apimachinery/pkg/api/equality"
+	"knative.dev/networking/pkg/apis/networking"
 	"knative.dev/pkg/apis"
 	"knative.dev/serving/pkg/apis/serving"
 )
 
 func (r *Route) Validate(ctx context.Context) *apis.FieldError {
-	errs := serving.ValidateObjectMetadata(ctx, r.GetObjectMeta()).ViaField("metadata")
-	errs = errs.Also(r.Spec.Validate(apis.WithinSpec(ctx)).ViaField("spec"))
+	errs := serving.ValidateObjectMetadata(ctx, r.GetObjectMeta()).ViaField("metadata").
+		Also(r.Spec.Validate(apis.WithinSpec(ctx)).ViaField("spec")).
+		Also(validateAnnotations(r.GetAnnotations()))
 
 	if apis.IsInUpdate(ctx) {
 		original := apis.GetBaseline(ctx).(*Route)
@@ -105,3 +108,17 @@ func (rs *RouteSpec) Validate(ctx context.Context) *apis.FieldError {
 	}
 	return errs
 }
+
+// TODO: this should be moved to knative/networking as part of
+// https://github.com/knative/networking/issues/123
+func validateAnnotations(annotations map[string]string) *apis.FieldError {
+	disableAutoTLS := annotations[networking.DisableAutoTLSAnnotationKey]
+
+	if disableAutoTLS != "" {
+		if _, err := strconv.ParseBool(disableAutoTLS); err != nil {
+			return apis.ErrInvalidValue(disableAutoTLS, networking.DisableAutoTLSAnnotationKey)
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/autoscaler/config/config.go b/pkg/autoscaler/config/config.go
index 27902535f..a78a62ed2 100644
--- a/pkg/autoscaler/config/config.go
+++ b/pkg/autoscaler/config/config.go
@@ -82,9 +82,24 @@ type Config struct {
 	PanicWindowPercentage    float64
 	PanicThresholdPercentage float64
 
-	ScaleToZeroGracePeriod        time.Duration
+	// ScaleToZeroGracePeriod is the time we will wait for networking to
+	// propagate before scaling down. We may wait less than this if it is safe to
+	// do so, for example if the Activator has already been in the path for
+	// longer than the window.
+	ScaleToZeroGracePeriod time.Duration
+
+	// ScaleToZeroPodRetentionPeriod is the minimum amount of time we will wait
+	// before scaling down the last pod.
 	ScaleToZeroPodRetentionPeriod time.Duration
 
+	// ScaleDownDelay is the amount of time that must pass at reduced concurrency
+	// before a scale-down decision is applied. This can be useful for keeping
+	// scaled-up revisions "warm" for a certain period before scaling down. This
+	// applies to all scale-down decisions, not just the very last pod.
+	// It is independent of ScaleToZeroPodRetentionPeriod, which can be used to
+	// add an additional delay to the very last pod, if required.
+	ScaleDownDelay time.Duration
+
 	PodAutoscalerClass string
 }
 
@@ -105,6 +120,7 @@ func defaultConfig() *Config {
 		StableWindow:                  60 * time.Second,
 		ScaleToZeroGracePeriod:        30 * time.Second,
 		ScaleToZeroPodRetentionPeriod: 0 * time.Second,
+		ScaleDownDelay:                0 * time.Second,
 		PodAutoscalerClass:            autoscaling.KPA,
 		AllowZeroInitialScale:         false,
 		InitialScale:                  1,
@@ -136,6 +152,7 @@ func NewConfigFromMap(data map[string]string) (*Config, error) {
 		cm.AsInt32("max-scale", &lc.MaxScale),
 
 		cm.AsDuration("stable-window", &lc.StableWindow),
+		cm.AsDuration("scale-down-delay", &lc.ScaleDownDelay),
 		cm.AsDuration("scale-to-zero-grace-period", &lc.ScaleToZeroGracePeriod),
 		cm.AsDuration("scale-to-zero-pod-retention-period", &lc.ScaleToZeroPodRetentionPeriod),
 	); err != nil {
@@ -155,7 +172,15 @@ func NewConfigFromMap(data map[string]string) (*Config, error) {
 
 func validate(lc *Config) (*Config, error) {
 	if lc.ScaleToZeroGracePeriod < autoscaling.WindowMin {
-		return nil, fmt.Errorf("scale-to-zero-grace-period must be at least %v, got %v", autoscaling.WindowMin, lc.ScaleToZeroGracePeriod)
+		return nil, fmt.Errorf("scale-to-zero-grace-period must be at least %v, was: %v", autoscaling.WindowMin, lc.ScaleToZeroGracePeriod)
+	}
+
+	if lc.ScaleDownDelay < 0 {
+		return nil, fmt.Errorf("scale-down-delay cannot be negative, was: %v", lc.ScaleDownDelay)
+	}
+
+	if lc.ScaleDownDelay.Round(time.Second) != lc.ScaleDownDelay {
+		return nil, fmt.Errorf("scale-down-delay = %v, must be specified with at most second precision", lc.ScaleDownDelay)
 	}
 
 	if lc.ScaleToZeroPodRetentionPeriod < 0 {
@@ -163,7 +188,7 @@ func validate(lc *Config) (*Config, error) {
 	}
 
 	if lc.TargetBurstCapacity < 0 && lc.TargetBurstCapacity != -1 {
-		return nil, fmt.Errorf("target-burst-capacity must be either non-negative or -1 (for unlimited), got %f", lc.TargetBurstCapacity)
+		return nil, fmt.Errorf("target-burst-capacity must be either non-negative or -1 (for unlimited), was: %f", lc.TargetBurstCapacity)
 	}
 
 	if lc.ContainerConcurrencyTargetFraction <= 0 || lc.ContainerConcurrencyTargetFraction > 1 {
@@ -175,7 +200,7 @@ func validate(lc *Config) (*Config, error) {
 	}
 
 	if lc.RPSTargetDefault < autoscaling.TargetMin {
-		return nil, fmt.Errorf("requests-per-second-target-default must be at least %v, got %v", autoscaling.TargetMin, lc.RPSTargetDefault)
+		return nil, fmt.Errorf("requests-per-second-target-default must be at least %v, was: %v", autoscaling.TargetMin, lc.RPSTargetDefault)
 	}
 
 	if lc.ActivatorCapacity < 1 {
diff --git a/pkg/reconciler/route/route.go b/pkg/reconciler/route/route.go
index e7dd4c7ae..d19a8113d 100644
--- a/pkg/reconciler/route/route.go
+++ b/pkg/reconciler/route/route.go
@@ -19,6 +19,7 @@ package route
 import (
 	"context"
 	"sort"
+	"strconv"
 	"strings"
 
 	corev1 "k8s.io/api/core/v1"
@@ -180,10 +181,11 @@ func (c *Reconciler) reconcileIngressResources(ctx context.Context, r *v1.Route,
 
 func (c *Reconciler) tls(ctx context.Context, host string, r *v1.Route, traffic *traffic.Config) ([]netv1alpha1.IngressTLS, []netv1alpha1.HTTP01Challenge, error) {
 	tls := []netv1alpha1.IngressTLS{}
-	if !config.FromContext(ctx).Network.AutoTLS {
+	if !autoTLSEnabled(ctx, r) {
 		r.Status.MarkTLSNotEnabled(v1.AutoTLSNotEnabledMessage)
 		return tls, nil, nil
 	}
+
 	domainToTagMap, err := domains.GetAllDomainsAndTags(ctx, r, getTrafficNames(traffic.Targets), traffic.Visibility)
 	if err != nil {
 		return nil, nil, err
@@ -415,6 +417,25 @@ func setTargetsScheme(rs *v1.RouteStatus, dnsNames []string, scheme string) {
 	}
 }
 
+func autoTLSEnabled(ctx context.Context, r *v1.Route) bool {
+	if !config.FromContext(ctx).Network.AutoTLS {
+		return false
+	}
+
+	logger := logging.FromContext(ctx)
+	annotationValue := r.Annotations[networking.DisableAutoTLSAnnotationKey]
+
+	disabledByAnnotation, err := strconv.ParseBool(annotationValue)
+	if err != nil {
+		// validation should've caught an invalid value here.
+		// if we have one anyways, assume not disabled and log a warning.
+		logger.Warnf("Invalid annotation value for %q. Value: %q",
+			networking.DisableAutoTLSAnnotationKey, annotationValue)
+	}
+
+	return !disabledByAnnotation
+}
+
 func findMatchingWildcardCert(ctx context.Context, domains []string, certs []*netv1alpha1.Certificate) *netv1alpha1.Certificate {
 	for _, cert := range certs {
 		if wildcardCertMatches(ctx, domains, cert) {
diff --git a/pkg/reconciler/route/traffic/traffic.go b/pkg/reconciler/route/traffic/traffic.go
index 9f695f6fa..ea0c1b6df 100644
--- a/pkg/reconciler/route/traffic/traffic.go
+++ b/pkg/reconciler/route/traffic/traffic.go
@@ -32,10 +32,8 @@ import (
 	"knative.dev/serving/pkg/reconciler/route/resources/labels"
 )
 
-const (
-	// DefaultTarget is the unnamed default target for the traffic.
-	DefaultTarget = ""
-)
+// DefaultTarget is the unnamed default target for the traffic.
+const DefaultTarget = ""
 
 // A RevisionTarget adds the Active/Inactive state and the transport protocol of a
 // Revision to a flattened TrafficTarget.
@@ -69,7 +67,7 @@ type Config struct {
 	Configurations map[string]*v1.Configuration
 	Revisions      map[string]*v1.Revision
 
-	// MissingTargets are references to Configuration's or Revision's
+	// MissingTargets are references to Configurations or Revisions
 	// that are missing
 	MissingTargets []corev1.ObjectReference
 }
@@ -81,7 +79,7 @@ type Config struct {
 // In the case that some target is missing, an error of type TargetError will be returned.
 func BuildTrafficConfiguration(configLister listers.ConfigurationLister, revLister listers.RevisionLister,
 	r *v1.Route) (*Config, error) {
-	builder := newBuilder(configLister, revLister, r.Namespace, len(r.Spec.Traffic))
+	builder := newBuilder(configLister, revLister, r, len(r.Spec.Traffic))
 	err := builder.applySpecTraffic(r.Spec.Traffic)
 	if err != nil {
 		return nil, err
@@ -90,9 +88,9 @@ func BuildTrafficConfiguration(configLister listers.ConfigurationLister, revList
 }
 
 // GetRevisionTrafficTargets returns a list of TrafficTarget flattened to the RevisionName, and having ConfigurationName cleared out.
-func (t *Config) GetRevisionTrafficTargets(ctx context.Context, r *v1.Route) ([]v1.TrafficTarget, error) {
-	results := make([]v1.TrafficTarget, len(t.revisionTargets))
-	for i, tt := range t.revisionTargets {
+func (cfg *Config) GetRevisionTrafficTargets(ctx context.Context, r *v1.Route) ([]v1.TrafficTarget, error) {
+	results := make([]v1.TrafficTarget, len(cfg.revisionTargets))
+	for i, tt := range cfg.revisionTargets {
 		var pp *int64
 		if tt.Percent != nil {
 			pp = ptr.Int64(*tt.Percent)
@@ -114,7 +112,7 @@ func (t *Config) GetRevisionTrafficTargets(ctx context.Context, r *v1.Route) ([]
 				return nil, err
 			}
 
-			labels.SetVisibility(meta, t.Visibility[tt.Tag] == netv1alpha1.IngressVisibilityClusterLocal)
+			labels.SetVisibility(meta, cfg.Visibility[tt.Tag] == netv1alpha1.IngressVisibilityClusterLocal)
 
 			// HTTP is currently the only supported scheme.
 			fullDomain, err := domains.DomainNameFromTemplate(ctx, *meta, hostname)
@@ -128,9 +126,9 @@ func (t *Config) GetRevisionTrafficTargets(ctx context.Context, r *v1.Route) ([]
 }
 
 type configBuilder struct {
-	configLister listers.ConfigurationLister
-	revLister    listers.RevisionLister
-	namespace    string
+	configLister listers.ConfigurationNamespaceLister
+	revLister    listers.RevisionNamespaceLister
+	route        *v1.Route
 
 	// targets is a grouping of traffic targets serving the same origin.
 	targets map[string]RevisionTargets
@@ -153,11 +151,11 @@ type configBuilder struct {
 
 func newBuilder(
 	configLister listers.ConfigurationLister, revLister listers.RevisionLister,
-	namespace string, trafficSize int) *configBuilder {
+	r *v1.Route, trafficSize int) *configBuilder {
 	return &configBuilder{
-		configLister:    configLister,
-		revLister:       revLister,
-		namespace:       namespace,
+		configLister:    configLister.Configurations(r.Namespace),
+		revLister:       revLister.Revisions(r.Namespace),
+		route:           r,
 		targets:         make(map[string]RevisionTargets),
 		revisionTargets: make(RevisionTargets, 0, trafficSize),
 
@@ -166,9 +164,9 @@ func newBuilder(
 	}
 }
 
-func (t *configBuilder) applySpecTraffic(traffic []v1.TrafficTarget) error {
+func (cb *configBuilder) applySpecTraffic(traffic []v1.TrafficTarget) error {
 	for _, tt := range traffic {
-		if err := t.addTrafficTarget(&tt); err != nil {
+		if err := cb.addTrafficTarget(&tt); err != nil {
 			// Other non-traffic target errors shouldn't be ignored.
 			return err
 		}
@@ -176,63 +174,67 @@ func (t *configBuilder) applySpecTraffic(traffic []v1.TrafficTarget) error {
 	return nil
 }
 
-func (t *configBuilder) getConfiguration(name string) (*v1.Configuration, error) {
-	if _, ok := t.configurations[name]; !ok {
-		config, err := t.configLister.Configurations(t.namespace).Get(name)
+func (cb *configBuilder) getConfiguration(name string) (*v1.Configuration, error) {
+	config, ok := cb.configurations[name]
+	if !ok {
+		var err error
+		config, err = cb.configLister.Get(name)
 		if errors.IsNotFound(err) {
 			return nil, errMissingConfiguration(name)
 		} else if err != nil {
 			return nil, err
 		}
-		t.configurations[name] = config
+		cb.configurations[name] = config
 	}
-	return t.configurations[name], nil
+	return config, nil
 }
 
-func (t *configBuilder) getRevision(name string) (*v1.Revision, error) {
-	if _, ok := t.revisions[name]; !ok {
-		rev, err := t.revLister.Revisions(t.namespace).Get(name)
+func (cb *configBuilder) getRevision(name string) (*v1.Revision, error) {
+	rev, ok := cb.revisions[name]
+	if !ok {
+		var err error
+		rev, err = cb.revLister.Get(name)
 		if errors.IsNotFound(err) {
 			return nil, errMissingRevision(name)
 		} else if err != nil {
 			return nil, err
 		}
-		t.revisions[name] = rev
+		cb.revisions[name] = rev
 	}
-	return t.revisions[name], nil
+	return rev, nil
 }
 
 // deferTargetError will record a TargetError.  A TargetError with
 // IsFailure()=true will always overwrite a previous TargetError.
-func (t *configBuilder) deferTargetError(err TargetError) {
-	if t.deferredTargetErr == nil || err.IsFailure() {
-		t.deferredTargetErr = err
+func (cb *configBuilder) deferTargetError(err TargetError) {
+	if cb.deferredTargetErr == nil || err.IsFailure() {
+		cb.deferredTargetErr = err
 	}
 }
 
-func (t *configBuilder) addTrafficTarget(tt *v1.TrafficTarget) error {
+func (cb *configBuilder) addTrafficTarget(tt *v1.TrafficTarget) error {
 	var err error
 	if tt.RevisionName != "" {
-		err = t.addRevisionTarget(tt)
+		err = cb.addRevisionTarget(tt)
 	} else if tt.ConfigurationName != "" {
-		err = t.addConfigurationTarget(tt)
+		err = cb.addConfigurationTarget(tt)
 	}
 	if err, ok := err.(*missingTargetError); err != nil && ok {
 		apiVersion, kind := v1.SchemeGroupVersion.
 			WithKind(err.kind).
 			ToAPIVersionAndKind()
 
-		t.missingTargets = append(t.missingTargets, corev1.ObjectReference{
+		cb.missingTargets = append(cb.missingTargets, corev1.ObjectReference{
 			APIVersion: apiVersion,
 			Kind:       kind,
 			Name:       err.name,
-			Namespace:  t.namespace,
+			Namespace:  cb.route.Namespace,
 		})
 	}
 	if err, ok := err.(TargetError); err != nil && ok {
 		// Defer target errors, as we still want to compile a list of
 		// all referred targets, including missing ones.
-		t.deferTargetError(err)
+		cb.deferTargetError(err)
 		return nil
 	}
 	return err
@@ -240,15 +242,15 @@ func (t *configBuilder) addTrafficTarget(tt *v1.TrafficTarget) error {
 
 // addConfigurationTarget flattens a traffic target to the Revision level, by looking up for the LatestReadyRevisionName
 // on the referred Configuration.  It adds both to the lists of directly referred targets.
-func (t *configBuilder) addConfigurationTarget(tt *v1.TrafficTarget) error {
-	config, err := t.getConfiguration(tt.ConfigurationName)
+func (cb *configBuilder) addConfigurationTarget(tt *v1.TrafficTarget) error {
+	config, err := cb.getConfiguration(tt.ConfigurationName)
 	if err != nil {
 		return err
 	}
 	if config.Status.LatestReadyRevisionName == "" {
 		return errUnreadyConfiguration(config)
 	}
-	rev, err := t.getRevision(config.Status.LatestReadyRevisionName)
+	rev, err := cb.getRevision(config.Status.LatestReadyRevisionName)
 	if err != nil {
 		return err
 	}
@@ -260,12 +262,12 @@ func (t *configBuilder) addConfigurationTarget(tt *v1.TrafficTarget) error {
 		ServiceName:   rev.Status.ServiceName,
 	}
 	target.TrafficTarget.RevisionName = rev.Name
-	t.addFlattenedTarget(target)
+	cb.addFlattenedTarget(target)
 	return nil
 }
 
-func (t *configBuilder) addRevisionTarget(tt *v1.TrafficTarget) error {
-	rev, err := t.getRevision(tt.RevisionName)
+func (cb *configBuilder) addRevisionTarget(tt *v1.TrafficTarget) error {
+	rev, err := cb.getRevision(tt.RevisionName)
 	if err != nil {
 		return err
 	}
@@ -281,21 +283,43 @@ func (t *configBuilder) addRevisionTarget(tt *v1.TrafficTarget) error {
 	}
 	if configName, ok := rev.Labels[serving.ConfigurationLabelKey]; ok {
 		target.TrafficTarget.ConfigurationName = configName
-		if _, err := t.getConfiguration(configName); err != nil {
+		if _, err := cb.getConfiguration(configName); err != nil {
 			return err
 		}
 	}
-	t.addFlattenedTarget(target)
+	cb.addFlattenedTarget(target)
 	return nil
 }
 
-func (t *configBuilder) addFlattenedTarget(target RevisionTarget) {
+func (cb *configBuilder) addFlattenedTarget(target RevisionTarget) {
 	name := target.TrafficTarget.Tag
-	t.revisionTargets = append(t.revisionTargets, target)
-	t.targets[DefaultTarget] = append(t.targets[DefaultTarget], target)
+	cb.revisionTargets = append(cb.revisionTargets, target)
+	cb.targets[DefaultTarget] = append(cb.targets[DefaultTarget], target)
 	if name != "" {
-		t.targets[name] = append(t.targets[name], target)
+		cb.targets[name] = append(cb.targets[name], target)
+	}
+}
+
+func (cfg *configBuilder) build() (*Config, error) {
+	if cfg.deferredTargetErr != nil {
+		cfg.targets = nil
+		cfg.revisionTargets = nil
+	}
+	return &Config{
+		Targets:         consolidateAll(cfg.targets),
+		revisionTargets: cfg.revisionTargets,
+		Configurations:  cfg.configurations,
+		Revisions:       cfg.revisions,
+		MissingTargets:  cfg.missingTargets,
+	}, cfg.deferredTargetErr
+}
+
+func consolidateAll(targets map[string]RevisionTargets) map[string]RevisionTargets {
+	consolidated := make(map[string]RevisionTargets, len(targets))
+	for name, tts := range targets {
+		consolidated[name] = consolidate(tts)
 	}
+	return consolidated
 }
 
 func consolidate(targets RevisionTargets) RevisionTargets {
@@ -307,17 +331,17 @@ func consolidate(targets RevisionTargets) RevisionTargets {
 		if !ok {
 			byName[name] = tt
 			names = append(names, name)
-		} else {
-			if tt.TrafficTarget.Percent != nil {
-				current := int64(0)
-				if cur.TrafficTarget.Percent != nil {
-					current += *cur.TrafficTarget.Percent
-				}
-				current += *tt.TrafficTarget.Percent
-				cur.TrafficTarget.Percent = ptr.Int64(current)
+			continue
+		}
+		if tt.TrafficTarget.Percent != nil {
+			current := int64(0)
+			if cur.TrafficTarget.Percent != nil {
+				current += *cur.TrafficTarget.Percent
 			}
-			byName[name] = cur
+			current += *tt.TrafficTarget.Percent
+			cur.TrafficTarget.Percent = ptr.Int64(current)
 		}
+		byName[name] = cur
 	}
 	consolidated := make([]RevisionTarget, len(names))
 	for i, name := range names {
@@ -328,25 +352,3 @@ func consolidate(targets RevisionTargets) RevisionTargets {
 	}
 	return consolidated
 }
-
-func consolidateAll(targets map[string]RevisionTargets) map[string]RevisionTargets {
-	consolidated := make(map[string]RevisionTargets)
-	for name, tts := range targets {
-		consolidated[name] = consolidate(tts)
-	}
-	return consolidated
-}
-
-func (t *configBuilder) build() (*Config, error) {
-	if t.deferredTargetErr != nil {
-		t.targets = nil
-		t.revisionTargets = nil
-	}
-	return &Config{
-		Targets:         consolidateAll(t.targets),
-		revisionTargets: t.revisionTargets,
-		Configurations:  t.configurations,
-		Revisions:       t.revisions,
-		MissingTargets:  t.missingTargets,
-	}, t.deferredTargetErr
-}
diff --git a/third_party/cert-manager-0.12.0/net-certmanager.yaml b/third_party/cert-manager-0.12.0/net-certmanager.yaml
index 288ec241a..f08205129 100644
--- a/third_party/cert-manager-0.12.0/net-certmanager.yaml
+++ b/third_party/cert-manager-0.12.0/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
 webhooks:
 - admissionReviewVersions:
   - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,7 +168,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20200901-f33fbfc"
+        serving.knative.dev/release: "v20200902-f33fbfc"
     spec:
       serviceAccountName: controller
       containers:
@@ -208,7 +208,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -245,7 +245,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
 spec:
   selector:
     matchLabels:
@@ -258,7 +258,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20200901-f33fbfc"
+        serving.knative.dev/release: "v20200902-f33fbfc"
     spec:
       serviceAccountName: controller
       containers:
@@ -319,7 +319,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20200901-f33fbfc"
+    serving.knative.dev/release: "v20200902-f33fbfc"
 spec:
   ports:
   - # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/net-istio.yaml b/third_party/net-istio.yaml
index eb56c2f86..ab15e8f1b 100644
--- a/third_party/net-istio.yaml
+++ b/third_party/net-istio.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -48,7 +48,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -85,7 +85,7 @@ metadata:
   name: cluster-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -104,7 +104,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -123,7 +123,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -181,7 +181,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 webhooks:
 - admissionReviewVersions:
@@ -217,7 +217,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 webhooks:
 - admissionReviewVersions:
@@ -255,7 +255,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -279,7 +279,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -349,7 +349,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -365,14 +365,14 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20200901-7ef0bc2"
+        serving.knative.dev/release: "v20200902-7ef0bc2"
     spec:
       serviceAccountName: controller
       containers:
       - name: networking-istio
         # This is the Go import path for the binary that is containerized
         # and substituted here.
-        image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:2a358a6d975af98abf2dc4005b24884e9a7ddb9ad20744c2982ac070a2827705
+        image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:664a334c15ac6278fb983f5571ca6906f5f6ff20fff39668e3e766118b4d87d6
         resources:
           requests:
             cpu: 30m
@@ -424,7 +424,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -438,14 +438,14 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20200901-7ef0bc2"
+        serving.knative.dev/release: "v20200902-7ef0bc2"
     spec:
       serviceAccountName: controller
       containers:
       - name: webhook
         # This is the Go import path for the binary that is containerized
         # and substituted here.
-        image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:9be3454ec441bf05b97e2e29e539e88cb688c68d1d12847f5255c3f0da7b6f13
+        image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:103f34e24622f571d837b896db3e292750a7e86a0d647112f8fda1978f8952c4
         resources:
           requests:
             cpu: 20m
@@ -499,7 +499,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20200901-7ef0bc2"
+    serving.knative.dev/release: "v20200902-7ef0bc2"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
index 4e3b40362..6d86f4043 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_defaults.go
@@ -65,4 +65,6 @@ func (p *HTTPIngressPath) SetDefaults(ctx context.Context) {
 	if len(p.Splits) == 1 && p.Splits[0].Percent == 0 {
 		p.Splits[0].Percent = 100
 	}
+	// Deprecated, do not use.
+	p.DeprecatedRetries = nil
 }
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_types.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_types.go
index 586820cc6..0e65ed815 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_types.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_types.go
@@ -245,11 +245,10 @@ type HTTPIngressPath struct {
 	// +optional
 	Timeout *metav1.Duration `json:"timeout,omitempty"`
 
-	// Retry policy for HTTP requests.
-	//
-	// NOTE: This differs from K8s Ingress which doesn't allow retry settings.
+	// DeprecatedRetries is DEPRECATED.
+	// Retry in Kingress is not used anymore. See https://github.com/knative/serving/issues/6549
 	// +optional
-	Retries *HTTPRetry `json:"retries,omitempty"`
+	DeprecatedRetries *HTTPRetry `json:"retries,omitempty"`
 }
 
 // IngressBackendSplit describes all endpoints for a given service and port.
@@ -285,7 +284,7 @@ type IngressBackend struct {
 	ServicePort intstr.IntOrString `json:"servicePort"`
 }
 
-// HTTPRetry describes the retry policy to use when a HTTP request fails.
+// HTTPRetry is DEPRECATED. Retry is not used in KIngress.
 type HTTPRetry struct {
 	// Number of retries for a given request.
 	Attempts int `json:"attempts"`
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
index ecdefa398..b32b84e18 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/ingress_validation.go
@@ -108,9 +108,6 @@ func (h HTTPIngressPath) Validate(ctx context.Context) *apis.FieldError {
 		}
 	}
 
-	if h.Retries != nil {
-		all = all.Also(h.Retries.Validate(ctx).ViaField("retries"))
-	}
 	return all
 }
 
@@ -153,15 +150,6 @@ func (b IngressBackend) Validate(ctx context.Context) *apis.FieldError {
 	return all
 }
 
-// Validate inspects and validates HTTPRetry object.
-func (r *HTTPRetry) Validate(ctx context.Context) *apis.FieldError {
-	// Attempts must be greater than 0.
-	if r.Attempts < 0 {
-		return apis.ErrInvalidValue(r.Attempts, "attempts")
-	}
-	return nil
-}
-
 // Validate inspects and validates IngressTLS object.
 func (t *IngressTLS) Validate(ctx context.Context) *apis.FieldError {
 	// Provided TLS setting must not be empty.
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/zz_generated.deepcopy.go b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/zz_generated.deepcopy.go
index 4d33fafd8..fe63a28f4 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/zz_generated.deepcopy.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/v1alpha1/zz_generated.deepcopy.go
@@ -291,8 +291,8 @@ func (in *HTTPIngressPath) DeepCopyInto(out *HTTPIngressPath) {
 		*out = new(v1.Duration)
 		**out = **in
 	}
-	if in.Retries != nil {
-		in, out := &in.Retries, &out.Retries
+	if in.DeprecatedRetries != nil {
+		in, out := &in.DeprecatedRetries, &out.DeprecatedRetries
 		*out = new(HTTPRetry)
 		(*in).DeepCopyInto(*out)
 	}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index addc5b08e..659b9b568 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1061,7 +1061,7 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/networking v0.0.0-20200901153316-80398434dcd4
+# knative.dev/networking v0.0.0-20200902135616-75b2030c6657
 ## explicit
 knative.dev/networking/pkg
 knative.dev/networking/pkg/apis/networking
@@ -1088,7 +1088,7 @@ knative.dev/networking/pkg/client/injection/informers/networking/v1alpha1/server
 knative.dev/networking/pkg/client/injection/reconciler/networking/v1alpha1/serverlessservice
 knative.dev/networking/pkg/client/listers/networking/v1alpha1
 knative.dev/networking/pkg/ingress
-# knative.dev/pkg v0.0.0-20200901172015-edd1b5e0bebf
+# knative.dev/pkg v0.0.0-20200901225315-2ee0e988033c
 ## explicit
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/.github/workflows/knative-go-test.yaml b/.github/workflows/knative-go-test.yaml
index 53985abd7..52813f4a7 100644
--- a/.github/workflows/knative-go-test.yaml
+++ b/.github/workflows/knative-go-test.yaml
@@ -12,6 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This file is automagically synced here from github.com/knative-sandbox/.github
+# repo by knobots: https://github.com/mattmoor/knobots and will be overwritten.
+
 name: Test
 
 on:
@@ -41,6 +44,8 @@ jobs:
 
       - name: Check out code
         uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
 
       - name: Test
         run: go test -race ./...
diff --git a/pkg/activator/net/throttler_test.go b/pkg/activator/net/throttler_test.go
index 1ea032592..00557e31d 100644
--- a/pkg/activator/net/throttler_test.go
+++ b/pkg/activator/net/throttler_test.go
@@ -25,6 +25,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/davecgh/go-spew/spew"
 	"github.com/google/go-cmp/cmp"
 	"golang.org/x/sync/errgroup"
 	corev1 "k8s.io/api/core/v1"
@@ -333,7 +334,7 @@ func TestThrottlerSuccesses(t *testing.T) {
 		// Double updates exercise additional paths.
 		initUpdates: []revisionDestsUpdate{{
 			Rev:   types.NamespacedName{Namespace: testNamespace, Name: testRevision},
-			Dests: sets.NewString("128.0.0.2:1234"),
+			Dests: sets.NewString("128.0.0.2:1234", "128.0.0.32:1212"),
 		}, {
 			Rev:   types.NamespacedName{Namespace: testNamespace, Name: testRevision},
 			Dests: sets.NewString("128.0.0.1:1234"),
@@ -371,10 +372,21 @@ func TestThrottlerSuccesses(t *testing.T) {
 		revision: revision(types.NamespacedName{Namespace: testNamespace, Name: testRevision}, networking.ProtocolHTTP1, 3),
 		initUpdates: []revisionDestsUpdate{{
 			Rev:   types.NamespacedName{Namespace: testNamespace, Name: testRevision},
-			Dests: sets.NewString("128.0.0.1:1234", "128.0.0.2:1234"),
+			Dests: sets.NewString("128.0.0.1:1234", "128.0.0.2:1234", "128.0.0.2:4236", "128.0.0.2:1233", "128.0.0.2:1230"),
 		}},
 		requests:  3,
 		wantDests: sets.NewString("128.0.0.1:1234"),
+	}, {
+		name: "roundrobin test",
+		revision: revision(types.NamespacedName{Namespace: testNamespace, Name: testRevision},
+			networking.ProtocolHTTP1, 5 /*cc >3*/),
+		initUpdates: []revisionDestsUpdate{{
+			Rev:   types.NamespacedName{Namespace: testNamespace, Name: testRevision},
+			Dests: sets.NewString("128.0.0.1:1234", "128.0.0.2:1234", "211.212.213.214"),
+		}},
+		requests: 3,
+		// All three IP addresses should be used if cc>3.
+		wantDests: sets.NewString("128.0.0.1:1234", "128.0.0.2:1234", "211.212.213.214"),
 	}, {
 		name:     "multiple ClusterIP requests",
 		revision: revisionCC1(types.NamespacedName{Namespace: testNamespace, Name: testRevision}, networking.ProtocolHTTP1),
@@ -421,10 +433,6 @@ func TestThrottlerSuccesses(t *testing.T) {
 				waitInformers()
 			}()
 
-			for _, update := range tc.initUpdates {
-				updateCh <- update
-			}
-
 			publicEp := &corev1.Endpoints{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      testRevision,
@@ -448,16 +456,26 @@ func TestThrottlerSuccesses(t *testing.T) {
 				t.Fatal("RevisionThrottler can't be found:", err)
 			}
 
+			for _, update := range tc.initUpdates {
+				updateCh <- update
+			}
+
 			// Make sure our informer event has fired.
 			// We send multiple updates in some tests, so make sure the capacity is exact.
 			wantCapacity := 1
 			cc := tc.revision.Spec.ContainerConcurrency
-			if cc != nil && *cc != 0 {
-				dests := tc.initUpdates[len(tc.initUpdates)-1].Dests.Len()
+			dests := tc.initUpdates[len(tc.initUpdates)-1].Dests.Len()
+			if *cc != 0 {
 				wantCapacity = dests * int(*cc)
 			}
 			if err := wait.PollImmediate(10*time.Millisecond, 3*time.Second, func() (bool, error) {
-				return rt.activatorIndex.Load() != -1 && rt.breaker.Capacity() == wantCapacity, nil
+				if *cc != 0 {
+					return rt.activatorIndex.Load() != -1 && rt.breaker.Capacity() == wantCapacity, nil
+				}
+				// If CC=0 then verify number of backends, rather the capacity of breaker.
+				rt.mux.RLock()
+				defer rt.mux.RUnlock()
+				return rt.activatorIndex.Load() != -1 && dests == len(rt.assignedTrackers), nil
 			}); err != nil {
 				t.Fatal("Timed out waiting for the capacity to be updated")
 			}
@@ -481,8 +499,12 @@ func TestThrottlerSuccesses(t *testing.T) {
 				gotDests.Insert(result.dest)
 			}
 
-			if got, want := gotDests, tc.wantDests; !got.Equal(want) {
+			if got, want := gotDests.List(), tc.wantDests.List(); !cmp.Equal(want, got) {
 				t.Errorf("Dests = %v, want: %v, diff: %s", got, want, cmp.Diff(want, got))
+				rt.mux.RLock()
+				defer rt.mux.RUnlock()
+				t.Log("podTrackers:\n", spew.Sdump(rt.podTrackers))
+				t.Log("assignedTrackers:\n", spew.Sdump(rt.assignedTrackers))
 			}
 		})
 	}
diff --git a/pkg/apis/serving/v1alpha1/route_validation_test.go b/pkg/apis/serving/v1alpha1/route_validation_test.go
index e1418f6b2..c09d6e4ae 100644
--- a/pkg/apis/serving/v1alpha1/route_validation_test.go
+++ b/pkg/apis/serving/v1alpha1/route_validation_test.go
@@ -74,6 +74,25 @@ func TestRouteValidation(t *testing.T) {
 			},
 		},
 		want: nil,
+	}, {
+		name: "valid annotation",
+		r: &Route{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "valid",
+				Annotations: map[string]string{
+					"networking.knative.dev/disableAutoTLS": "true",
+				},
+			},
+			Spec: RouteSpec{
+				Traffic: []TrafficTarget{{
+					TrafficTarget: v1.TrafficTarget{
+						RevisionName: "foo",
+						Percent:      ptr.Int64(100),
+					},
+				}},
+			},
+		},
+		want: nil,
 	}, {
 		name: "invalid traffic entry",
 		r: &Route{
@@ -155,6 +174,27 @@ func TestRouteValidation(t *testing.T) {
 		want: &apis.FieldError{
 			Message: "not a DNS 1035 label: [must be no more than 63 characters]",
 			Paths:   []string{"metadata.name"},
+		}}, {
+		name: "invalid annotation",
+		r: &Route{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "valid",
+				Annotations: map[string]string{
+					"networking.knative.dev/disableAutoTLS": "foo",
+				},
+			},
+			Spec: RouteSpec{
+				Traffic: []TrafficTarget{{
+					TrafficTarget: v1.TrafficTarget{
+						RevisionName: "foo",
+						Percent:      ptr.Int64(100),
+					},
+				}},
+			},
+		},
+		want: &apis.FieldError{
+			Message: "invalid value: foo",
+			Paths:   []string{"networking.knative.dev/disableAutoTLS"},
 		},
 	}}
 
diff --git a/pkg/autoscaler/config/config_test.go b/pkg/autoscaler/config/config_test.go
index f283e0206..e830c6fd1 100644
--- a/pkg/autoscaler/config/config_test.go
+++ b/pkg/autoscaler/config/config_test.go
@@ -55,6 +55,7 @@ func TestNewConfig(t *testing.T) {
 			"container-concurrency-target-default":    "10.5",
 			"requests-per-second-target-default":      "10.11",
 			"target-burst-capacity":                   "12345",
+			"scale-down-delay":                        "15m",
 			"stable-window":                           "5m",
 			"tick-interval":                           "2s",
 			"panic-window-percentage":                 "10",
@@ -71,6 +72,7 @@ func TestNewConfig(t *testing.T) {
 			c.RPSTargetDefault = 10.11
 			c.MaxScaleDownRate = 3
 			c.MaxScaleUpRate = 1.01
+			c.ScaleDownDelay = 15 * time.Minute
 			c.StableWindow = 5 * time.Minute
 			c.ActivatorCapacity = 905
 			c.PodAutoscalerClass = "some.class"
@@ -154,6 +156,12 @@ func TestNewConfig(t *testing.T) {
 			"max-scale-up-rate": "not a float",
 		},
 		wantErr: true,
+	}, {
+		name: "invalid scale-down-delay",
+		input: map[string]string{
+			"scale-down-delay": "-1m23s",
+		},
+		wantErr: true,
 	}, {
 		name: "invalid pod retention period",
 		input: map[string]string{
@@ -226,6 +234,12 @@ func TestNewConfig(t *testing.T) {
 			"stable-window": "61984ms",
 		},
 		wantErr: true,
+	}, {
+		name: "scale-down-delay not seconds",
+		input: map[string]string{
+			"scale-down-delay": "61984ms",
+		},
+		wantErr: true,
 	}, {
 		name: "activator-capacity invalid",
 		input: map[string]string{
diff --git a/pkg/autoscaler/statforwarder/forwarder_test.go b/pkg/autoscaler/statforwarder/forwarder_test.go
index ebd256737..d2a007f54 100644
--- a/pkg/autoscaler/statforwarder/forwarder_test.go
+++ b/pkg/autoscaler/statforwarder/forwarder_test.go
@@ -22,7 +22,6 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/zap"
 	coordinationv1 "k8s.io/api/coordination/v1"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -38,9 +37,9 @@ import (
 	fakeserviceinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/service/fake"
 	"knative.dev/pkg/controller"
 	"knative.dev/pkg/hash"
+	"knative.dev/pkg/logging"
 	rtesting "knative.dev/pkg/reconciler/testing"
 	"knative.dev/pkg/system"
-	_ "knative.dev/pkg/system/testing"
 	asmetrics "knative.dev/serving/pkg/autoscaler/metrics"
 )
 
@@ -68,33 +67,32 @@ var (
 )
 
 func TestForwarderReconcile(t *testing.T) {
-	t.Parallel()
-	ctx, cancel, _ := rtesting.SetupFakeContextWithCancel(t)
+	ctx, cancel, informers := rtesting.SetupFakeContextWithCancel(t)
+	logger := logging.FromContext(ctx)
 	kubeClient := fakekubeclient.Get(ctx)
 	endpoints := fakeendpointsinformer.Get(ctx)
 	service := fakeserviceinformer.Get(ctx)
 	lease := fakeleaseinformer.Get(ctx)
 
-	waitInformers, err := controller.RunInformers(
-		ctx.Done(), endpoints.Informer(), service.Informer(), lease.Informer())
+	waitInformers, err := controller.RunInformers(ctx.Done(), informers...)
 	if err != nil {
 		t.Fatal("Failed to start informers:", err)
 	}
 
-	t.Cleanup(func() {
+	defer func() {
 		cancel()
 		waitInformers()
-	})
+	}()
 
-	New(ctx, zap.NewNop().Sugar(), kubeClient, testIP1, testBs, noOp)
-	New(ctx, zap.NewNop().Sugar(), kubeClient, testIP2, testBs, noOp)
+	New(ctx, logger, kubeClient, testIP1, testBs, noOp)
+	New(ctx, logger, kubeClient, testIP2, testBs, noOp)
 
 	kubeClient.CoordinationV1().Leases(testNs).Create(testLease)
 	lease.Informer().GetIndexer().Add(testLease)
 
 	var lastErr error
 	// Wait for the resources to be created.
-	if err := wait.PollImmediate(100*time.Millisecond, 2*time.Second, func() (bool, error) {
+	if err := wait.PollImmediate(10*time.Millisecond, 2*time.Second, func() (bool, error) {
 		_, err := service.Lister().Services(testNs).Get(bucket1)
 		lastErr = err
 		return err == nil, nil
@@ -114,7 +112,7 @@ func TestForwarderReconcile(t *testing.T) {
 	}
 
 	// Check the endpoints got updated.
-	if err := wait.PollImmediate(100*time.Millisecond, 2*time.Second, func() (bool, error) {
+	if err := wait.PollImmediate(10*time.Millisecond, 2*time.Second, func() (bool, error) {
 		got, err := endpoints.Lister().Endpoints(testNs).Get(bucket1)
 		if err != nil {
 			lastErr = err
@@ -135,10 +133,11 @@ func TestForwarderReconcile(t *testing.T) {
 	l := testLease.DeepCopy()
 	l.Spec.HolderIdentity = &testIP2
 	kubeClient.CoordinationV1().Leases(testNs).Update(l)
+	lease.Informer().GetIndexer().Add(l)
 
 	// Check the endpoints got updated.
 	wantSubsets[0].Addresses[0].IP = testIP2
-	if err := wait.PollImmediate(100*time.Millisecond, 2*time.Second, func() (bool, error) {
+	if err := wait.PollImmediate(10*time.Millisecond, 2*time.Second, func() (bool, error) {
 		// Check the endpoints get updated.
 		got, err := endpoints.Lister().Endpoints(testNs).Get(bucket1)
 		if err != nil {
@@ -158,25 +157,22 @@ func TestForwarderReconcile(t *testing.T) {
 }
 
 func TestForwarderRetryOnSvcCreationFailure(t *testing.T) {
-	t.Parallel()
-	ctx, cancel, _ := rtesting.SetupFakeContextWithCancel(t)
+	ctx, cancel, informers := rtesting.SetupFakeContextWithCancel(t)
+	logger := logging.FromContext(ctx)
 	kubeClient := fakekubeclient.Get(ctx)
-	endpoints := fakeendpointsinformer.Get(ctx)
-	service := fakeserviceinformer.Get(ctx)
 	lease := fakeleaseinformer.Get(ctx)
 
-	waitInformers, err := controller.RunInformers(
-		ctx.Done(), endpoints.Informer(), service.Informer(), lease.Informer())
+	waitInformers, err := controller.RunInformers(ctx.Done(), informers...)
 	if err != nil {
 		t.Fatal("Failed to start informers:", err)
 	}
 
-	t.Cleanup(func() {
+	defer func() {
 		cancel()
 		waitInformers()
-	})
+	}()
 
-	New(ctx, zap.NewNop().Sugar(), kubeClient, testIP1, testBs, noOp)
+	New(ctx, logger, kubeClient, testIP1, testBs, noOp)
 
 	svcCreation := 0
 	retried := make(chan struct{})
@@ -185,6 +181,7 @@ func TestForwarderRetryOnSvcCreationFailure(t *testing.T) {
 			svcCreation++
 			if svcCreation == 2 {
 				retried <- struct{}{}
+				return true, nil, nil
 			}
 			return true, nil, errors.New("Failed to create")
 		},
@@ -201,25 +198,22 @@ func TestForwarderRetryOnSvcCreationFailure(t *testing.T) {
 }
 
 func TestForwarderRetryOnEndpointsCreationFailure(t *testing.T) {
-	t.Parallel()
-	ctx, cancel, _ := rtesting.SetupFakeContextWithCancel(t)
+	ctx, cancel, informers := rtesting.SetupFakeContextWithCancel(t)
+	logger := logging.FromContext(ctx)
 	kubeClient := fakekubeclient.Get(ctx)
-	endpoints := fakeendpointsinformer.Get(ctx)
-	service := fakeserviceinformer.Get(ctx)
 	lease := fakeleaseinformer.Get(ctx)
 
-	waitInformers, err := controller.RunInformers(
-		ctx.Done(), endpoints.Informer(), service.Informer(), lease.Informer())
+	waitInformers, err := controller.RunInformers(ctx.Done(), informers...)
 	if err != nil {
 		t.Fatal("Failed to start informers:", err)
 	}
 
-	t.Cleanup(func() {
+	defer func() {
 		cancel()
 		waitInformers()
-	})
+	}()
 
-	New(ctx, zap.NewNop().Sugar(), kubeClient, testIP1, testBs, noOp)
+	New(ctx, logger, kubeClient, testIP1, testBs, noOp)
 
 	endpointsCreation := 0
 	retried := make(chan struct{})
@@ -228,6 +222,7 @@ func TestForwarderRetryOnEndpointsCreationFailure(t *testing.T) {
 			endpointsCreation++
 			if endpointsCreation == 2 {
 				retried <- struct{}{}
+				return true, nil, nil
 			}
 			return true, nil, errors.New("Failed to create")
 		},
@@ -244,25 +239,23 @@ func TestForwarderRetryOnEndpointsCreationFailure(t *testing.T) {
 }
 
 func TestForwarderRetryOnEndpointsUpdateFailure(t *testing.T) {
-	t.Parallel()
-	ctx, cancel, _ := rtesting.SetupFakeContextWithCancel(t)
+	ctx, cancel, informers := rtesting.SetupFakeContextWithCancel(t)
+	logger := logging.FromContext(ctx)
 	kubeClient := fakekubeclient.Get(ctx)
 	endpoints := fakeendpointsinformer.Get(ctx)
-	service := fakeserviceinformer.Get(ctx)
 	lease := fakeleaseinformer.Get(ctx)
 
-	waitInformers, err := controller.RunInformers(
-		ctx.Done(), endpoints.Informer(), service.Informer(), lease.Informer())
+	waitInformers, err := controller.RunInformers(ctx.Done(), informers...)
 	if err != nil {
 		t.Fatal("Failed to start informers:", err)
 	}
 
-	t.Cleanup(func() {
+	defer func() {
 		cancel()
 		waitInformers()
-	})
+	}()
 
-	New(ctx, zap.NewNop().Sugar(), kubeClient, testIP1, testBs, noOp)
+	New(ctx, logger, kubeClient, testIP1, testBs, noOp)
 
 	endpointsUpdate := 0
 	retried := make(chan struct{})
@@ -271,6 +264,7 @@ func TestForwarderRetryOnEndpointsUpdateFailure(t *testing.T) {
 			endpointsUpdate++
 			if endpointsUpdate == 2 {
 				retried <- struct{}{}
+				return true, nil, nil
 			}
 			return true, nil, errors.New("Failed to update")
 		},
@@ -295,26 +289,22 @@ func TestForwarderRetryOnEndpointsUpdateFailure(t *testing.T) {
 }
 
 func TestForwarderSkipReconciling(t *testing.T) {
-	t.Parallel()
-	ns := system.Namespace()
-	ctx, cancel, _ := rtesting.SetupFakeContextWithCancel(t)
+	ctx, cancel, informers := rtesting.SetupFakeContextWithCancel(t)
+	logger := logging.FromContext(ctx)
 	kubeClient := fakekubeclient.Get(ctx)
-	endpoints := fakeendpointsinformer.Get(ctx)
-	service := fakeserviceinformer.Get(ctx)
 	lease := fakeleaseinformer.Get(ctx)
 
-	waitInformers, err := controller.RunInformers(
-		ctx.Done(), endpoints.Informer(), service.Informer(), lease.Informer())
+	waitInformers, err := controller.RunInformers(ctx.Done(), informers...)
 	if err != nil {
 		t.Fatal("Failed to start informers:", err)
 	}
 
-	t.Cleanup(func() {
+	defer func() {
 		cancel()
 		waitInformers()
-	})
+	}()
 
-	New(ctx, zap.NewNop().Sugar(), kubeClient, testIP1, testBs, noOp)
+	New(ctx, logger, kubeClient, testIP1, testBs, noOp)
 
 	svcCreated := make(chan struct{})
 	kubeClient.PrependReactor("create", "services",
@@ -338,7 +328,7 @@ func TestForwarderSkipReconciling(t *testing.T) {
 		holder      string
 	}{{
 		description: "not autoscaler bucket lease",
-		namespace:   ns,
+		namespace:   testNs,
 		name:        bucket2,
 		holder:      testIP1,
 	}, {
@@ -348,11 +338,11 @@ func TestForwarderSkipReconciling(t *testing.T) {
 		holder:      testIP1,
 	}, {
 		description: "without holder",
-		namespace:   ns,
+		namespace:   testNs,
 		name:        bucket1,
 	}, {
 		description: "not the holder",
-		namespace:   ns,
+		namespace:   testNs,
 		name:        bucket1,
 		holder:      testIP2,
 	}}
@@ -369,47 +359,44 @@ func TestForwarderSkipReconciling(t *testing.T) {
 					HolderIdentity: &tc.holder,
 				}
 			}
-			kubeClient.CoordinationV1().Leases(ns).Create(l)
+			kubeClient.CoordinationV1().Leases(testNs).Create(l)
 			lease.Informer().GetIndexer().Add(l)
 
 			select {
 			case <-svcCreated:
 				t.Error("Got Service created, want no actions")
-			case <-time.After(time.Second):
+			case <-time.After(50 * time.Millisecond):
 			}
 			select {
 			case <-endpointsCreated:
 				t.Error("Got Endpoints created, want no actions")
-			case <-time.After(time.Second):
+			case <-time.After(50 * time.Millisecond):
 			}
 		})
 	}
 }
 
 func TestProcess(t *testing.T) {
-	t.Parallel()
-	ctx, cancel, _ := rtesting.SetupFakeContextWithCancel(t)
+	ctx, cancel, informers := rtesting.SetupFakeContextWithCancel(t)
+	logger := logging.FromContext(ctx)
 	kubeClient := fakekubeclient.Get(ctx)
-	endpoints := fakeendpointsinformer.Get(ctx)
-	service := fakeserviceinformer.Get(ctx)
 	lease := fakeleaseinformer.Get(ctx)
 
-	waitInformers, err := controller.RunInformers(
-		ctx.Done(), endpoints.Informer(), service.Informer(), lease.Informer())
+	waitInformers, err := controller.RunInformers(ctx.Done(), informers...)
 	if err != nil {
 		t.Fatal("Failed to start informers:", err)
 	}
 
-	t.Cleanup(func() {
+	defer func() {
 		cancel()
 		waitInformers()
-	})
+	}()
 
 	acceptCount := 0
 	accept := func(sm asmetrics.StatMessage) {
 		acceptCount++
 	}
-	f := New(ctx, zap.NewNop().Sugar(), kubeClient, testIP1, hash.NewBucketSet(sets.NewString(bucket1, bucket2)), accept)
+	f := New(ctx, logger, kubeClient, testIP1, hash.NewBucketSet(sets.NewString(bucket1, bucket2)), accept)
 
 	stat1 := asmetrics.StatMessage{
 		Key: types.NamespacedName{
@@ -429,6 +416,7 @@ func TestProcess(t *testing.T) {
 
 	kubeClient.CoordinationV1().Leases(testNs).Create(testLease)
 	lease.Informer().GetIndexer().Add(testLease)
+
 	anotherLease := &coordinationv1.Lease{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      bucket2,
@@ -442,7 +430,7 @@ func TestProcess(t *testing.T) {
 	lease.Informer().GetIndexer().Add(anotherLease)
 
 	// Wait for the forwarder to become the leader for bucket1.
-	if err := wait.PollImmediate(100*time.Millisecond, 2*time.Second, func() (bool, error) {
+	if err := wait.PollImmediate(10*time.Millisecond, 2*time.Second, func() (bool, error) {
 		p1 := f.getProcessor(bucket1)
 		p2 := f.getProcessor(bucket2)
 		return p1 != nil && p2 != nil && p1.holder == testIP1 && p2.holder == testIP2 && p1.conn == nil && p2.conn != nil, nil
diff --git a/pkg/reconciler/route/route_test.go b/pkg/reconciler/route/route_test.go
index 00b2d7d5a..2cf00ff3b 100644
--- a/pkg/reconciler/route/route_test.go
+++ b/pkg/reconciler/route/route_test.go
@@ -46,6 +46,7 @@ import (
 	"k8s.io/client-go/tools/record"
 
 	network "knative.dev/networking/pkg"
+	"knative.dev/networking/pkg/apis/networking"
 	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
@@ -1621,3 +1622,59 @@ func TestRouteDomain(t *testing.T) {
 		})
 	}
 }
+
+func TestAutoTLSEnabled(t *testing.T) {
+	tests := []struct {
+		name                  string
+		configAutoTLSEnabled  bool
+		tlsDisabledAnnotation string
+		wantAutoTLSEnabled    bool
+	}{{
+		name:                 "AutoTLS enabled by config, not disabled by annotation",
+		configAutoTLSEnabled: true,
+		wantAutoTLSEnabled:   true,
+	}, {
+		name:                  "AutoTLS enabled by config, disabled by annotation",
+		configAutoTLSEnabled:  true,
+		tlsDisabledAnnotation: "true",
+		wantAutoTLSEnabled:    false,
+	}, {
+		name:                 "AutoTLS disabled by config, not disabled by annotation",
+		configAutoTLSEnabled: false,
+		wantAutoTLSEnabled:   false,
+	}, {
+		name:                  "AutoTLS disabled by config, disabled by annotation",
+		configAutoTLSEnabled:  false,
+		tlsDisabledAnnotation: "true",
+		wantAutoTLSEnabled:    false,
+	}, {
+		name:                  "AutoTLS enabled by config, invalid annotation",
+		configAutoTLSEnabled:  true,
+		tlsDisabledAnnotation: "foo",
+		wantAutoTLSEnabled:    true,
+	}, {
+		name:                  "AutoTLS disabled by config, invalid annotation",
+		configAutoTLSEnabled:  false,
+		tlsDisabledAnnotation: "foo",
+		wantAutoTLSEnabled:    false,
+	}}
+
+	r := Route("test-ns", "test-route")
+	r.Annotations = map[string]string{}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := config.ToContext(context.Background(), &config.Config{
+				Network: &network.Config{
+					AutoTLS: test.configAutoTLSEnabled,
+				},
+			})
+
+			r.Annotations[networking.DisableAutoTLSAnnotationKey] = test.tlsDisabledAnnotation
+
+			if got := autoTLSEnabled(ctx, r); got != test.wantAutoTLSEnabled {
+				t.Errorf("autoTLSEnabled = %t, want %t", got, test.wantAutoTLSEnabled)
+			}
+		})
+	}
+}
diff --git a/test/upgrade/service_postupgrade_test.go b/test/upgrade/service_postupgrade_test.go
index 5cdb81029..21137fbc1 100644
--- a/test/upgrade/service_postupgrade_test.go
+++ b/test/upgrade/service_postupgrade_test.go
@@ -54,6 +54,25 @@ func TestServicePostUpgrade(t *testing.T) {
 	updateService(serviceName, t)
 }
 
+/*
+TODO(6984): uncomment those.
+func configHasGeneration(clients *test.Clients, serviceName string, generation int) (bool, error) {
+	configObj, err := clients.ServingClient.Configs.Get(serviceName, metav1.GetOptions{})
+	if err != nil {
+		return false, err
+	}
+	return configObj.Generation == int64(generation), nil
+}
+
+func routeHasGeneration(clients *test.Clients, serviceName string, generation int) (bool, error) {
+	routeObj, err := clients.ServingClient.Routes.Get(serviceName, metav1.GetOptions{})
+	if err != nil {
+		return false, err
+	}
+	return routeObj.Generation == int64(generation), nil
+}
+*/
+
 func TestServicePostUpgradeFromScaleToZero(t *testing.T) {
 	t.Parallel()
 	updateService(scaleToZeroServiceName, t)
@@ -79,22 +98,6 @@ func TestBYORevisionPostUpgrade(t *testing.T) {
 	}
 }
 
-func configHasGeneration(clients *test.Clients, serviceName string, generation int) (bool, error) {
-	configObj, err := clients.ServingClient.Configs.Get(serviceName, metav1.GetOptions{})
-	if err != nil {
-		return false, err
-	}
-	return configObj.Generation == int64(generation), nil
-}
-
-func routeHasGeneration(clients *test.Clients, serviceName string, generation int) (bool, error) {
-	routeObj, err := clients.ServingClient.Routes.Get(serviceName, metav1.GetOptions{})
-	if err != nil {
-		return false, err
-	}
-	return routeObj.Generation == int64(generation), nil
-}
-
 func updateService(serviceName string, t *testing.T) {
 	t.Helper()
 	clients := e2e.Setup(t)
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index f5d03123c..a68796fa3 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -35,7 +35,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: contour
-    serving.knative.dev/release: "v20200901-a95fcd90"
+    serving.knative.dev/release: "v20200902-a95fcd90"
 data:
   _example: |
     ################################
diff --git a/vendor/knative.dev/pkg/reconciler/testing/table.go b/vendor/knative.dev/pkg/reconciler/testing/table.go
index 193861596..aa5a92d16 100644
--- a/vendor/knative.dev/pkg/reconciler/testing/table.go
+++ b/vendor/knative.dev/pkg/reconciler/testing/table.go
@@ -29,6 +29,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
 	clientgotesting "k8s.io/client-go/testing"
 	"k8s.io/client-go/tools/cache"
 
@@ -285,44 +286,31 @@ func (r *TableRow) Test(t *testing.T, factory Factory) {
 		t.Errorf("Unexpected subresource updates occurred %#v", unexpected)
 	}
 
-	for i, want := range r.WantDeletes {
-		if i >= len(actions.Deletes) {
-			t.Errorf("Missing delete: %#v", want)
-			continue
-		}
-		got := actions.Deletes[i]
-		if got.GetName() != want.GetName() {
-			t.Errorf("Unexpected delete[%d]: %#v", i, got)
-		}
-		if !r.SkipNamespaceValidation && got.GetNamespace() != expectedNamespace {
-			t.Errorf("Unexpected delete[%d]: %#v", i, got)
+	// Build a set of unique strings that represent type-name{-namespace}.
+	// Adding type will help catch the bugs where several similarly named
+	// resources are deleted (and some should or should not).
+	gotDeletes := make(sets.String, len(actions.Deletes))
+	for _, w := range actions.Deletes {
+		n := w.GetResource().Resource + "~~" + w.GetName()
+		if !r.SkipNamespaceValidation {
+			n += "~~" + w.GetNamespace()
 		}
+		gotDeletes.Insert(n)
 	}
-	if got, want := len(actions.Deletes), len(r.WantDeletes); got > want {
-		for _, extra := range actions.Deletes[want:] {
-			t.Errorf("Extra delete: %s/%s", extra.GetNamespace(), extra.GetName())
+	wantDeletes := make(sets.String, len(actions.Deletes))
+	for _, w := range r.WantDeletes {
+		n := w.GetResource().Resource + "~~" + w.GetName()
+		if !r.SkipNamespaceValidation {
+			n += "~~" + w.GetNamespace()
 		}
+		wantDeletes.Insert(n)
 	}
-
-	for i, want := range r.WantDeleteCollections {
-		if i >= len(actions.DeleteCollections) {
-			t.Errorf("Missing delete-collection: %#v", want)
-			continue
-		}
-		got := actions.DeleteCollections[i]
-		if got, want := got.GetListRestrictions().Labels, want.GetListRestrictions().Labels; (got != nil) != (want != nil) || got.String() != want.String() {
-			t.Errorf("Unexpected delete-collection[%d].Labels = %v, wanted %v", i, got, want)
-		}
-		if got, want := got.GetListRestrictions().Fields, want.GetListRestrictions().Fields; (got != nil) != (want != nil) || got.String() != want.String() {
-			t.Errorf("Unexpected delete-collection[%d].Fields = %v, wanted %v", i, got, want)
+	if !gotDeletes.Equal(wantDeletes) {
+		if extra := gotDeletes.Difference(wantDeletes); len(extra) > 0 {
+			t.Errorf("Extra or unexpected deletes: %v", extra.UnsortedList())
 		}
-		if !r.SkipNamespaceValidation && got.GetNamespace() != expectedNamespace {
-			t.Errorf("Unexpected delete-collection[%d]: %#v, wanted %s", i, got, expectedNamespace)
-		}
-	}
-	if got, want := len(actions.DeleteCollections), len(r.WantDeleteCollections); got > want {
-		for _, extra := range actions.DeleteCollections[want:] {
-			t.Errorf("Extra delete-collection: %#v", extra)
+		if missing := wantDeletes.Difference(gotDeletes); len(missing) > 0 {
+			t.Errorf("Missing deletes: %v", missing.UnsortedList())
 		}
 	}
 
diff --git a/vendor/knative.dev/pkg/test/request.go b/vendor/knative.dev/pkg/test/request.go
index 127d4371d..86cbb677d 100644
--- a/vendor/knative.dev/pkg/test/request.go
+++ b/vendor/knative.dev/pkg/test/request.go
@@ -87,28 +87,31 @@ func IsStatusOK(resp *spoof.Response) (bool, error) {
 
 // MatchesAllBodies checks that the *first* response body matches the "expected" body, otherwise failing.
 func MatchesAllBodies(all ...string) spoof.ResponseChecker {
-
 	var m sync.Mutex
+	// This helps with two things:
+	// 1. we can use Equal on sets
+	// 2. it will collapse the duplicates
+	want := sets.NewString(all...)
 	seen := make(sets.String, len(all))
 
 	return func(resp *spoof.Response) (bool, error) {
-		for _, expected := range all {
-			if !strings.Contains(string(resp.Body), expected) {
+		bs := string(resp.Body)
+		for expected := range want {
+			if !strings.Contains(bs, expected) {
 				// See if the next one matches.
 				continue
 			}
 
-			// Protect our set
 			m.Lock()
 			defer m.Unlock()
 			seen.Insert(expected)
 
 			// Stop once we've seen them all.
-			return seen.HasAll(all...), nil
+			return want.Equal(seen), nil
 		}
 
 		// Returning (true, err) causes SpoofingClient.Poll to fail.
-		return true, fmt.Errorf("body = %s, want one of: %s", string(resp.Body), all)
+		return true, fmt.Errorf("body = %s, want one of: %s", bs, all)
 	}
 }
 
@@ -128,12 +131,8 @@ func MatchesBody(expected string) spoof.ResponseChecker {
 // TODO(#1178): Delete me. We don't want to need this; we should be waiting for an appropriate Status instead.
 func EventuallyMatchesBody(expected string) spoof.ResponseChecker {
 	return func(resp *spoof.Response) (bool, error) {
-		if !strings.Contains(string(resp.Body), expected) {
-			// Returning (false, nil) causes SpoofingClient.Poll to retry.
-			return false, nil
-		}
-
-		return true, nil
+		// Returning (false, nil) causes SpoofingClient.Poll to retry.
+		return strings.Contains(string(resp.Body), expected), nil
 	}
 }