Repository: knative/serving
Pull request #10309 (2020-12-08 11:22:15)

[Automated] Update net-istio nightly
Produced via:
```shell
for x in net-istio.yaml; do
  curl https://storage.googleapis.com/knative-nightly/net-istio/latest/$x > ${GITHUB_WORKSPACE}/./third_party/istio-latest/$x
done
```
/assign @knative/networking-wg-leads
/cc @knative/networking-wg-leads

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10309#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **markusthoemmes** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @markusthoemmes` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["markusthoemmes"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=h1) Report
> Merging [#10309](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=desc) (dafc794) into [master](https://codecov.io/gh/knative/serving/commit/afb967008effa639c3b6fb43394a5d5cca46d13f?el=desc) (afb9670) will **increase** coverage by `0.04%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/10309/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui)](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master   #10309      +/-   ##
==========================================
+ Coverage   88.20%   88.24%   +0.04%     
==========================================
  Files         184      184              
  Lines        8654     8654              
==========================================
+ Hits         7633     7637       +4     
+ Misses        786      784       -2     
+ Partials      235      233       -2     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/autoscaling/kpa/scaler.go](https://codecov.io/gh/knative/serving/pull/10309/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcva3BhL3NjYWxlci5nbw==) | `90.00% <0.00%> (+1.42%)` | :arrow_up: |
| [pkg/reconciler/configuration/configuration.go](https://codecov.io/gh/knative/serving/pull/10309/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvY29uZmlndXJhdGlvbi9jb25maWd1cmF0aW9uLmdv) | `88.28% <0.00%> (+1.56%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=footer). Last update [afb9670...8edec5b](https://codecov.io/gh/knative/serving/pull/10309?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

vagababov: /lgtm
/approve
knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10309#" title="Author self-approved">knative-automation</a>*, *<a href="https://github.com/knative/serving/pull/10309#issuecomment-740784604" title="Approved">vagababov</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)~~ [vagababov]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/pkg/reconciler/route/reconcile_resources.go b/pkg/reconciler/route/reconcile_resources.go
index 14a91c791..e84c373b5 100644
--- a/pkg/reconciler/route/reconcile_resources.go
+++ b/pkg/reconciler/route/reconcile_resources.go
@@ -21,7 +21,9 @@ import (
 	"encoding/json"
 	"fmt"
 
+	"github.com/google/go-cmp/cmp"
 	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
 	"golang.org/x/sync/errgroup"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -77,9 +79,19 @@ func (c *Reconciler) reconcileIngress(
 		// And recompute the rollout state.
 		effectiveRO := curRO.Step(prevRO, int(c.clock.Now().UnixNano()))
 
+		// Comparing and diffing isn't cheap so do it only if we're going
+		// to actually log the message.
+		// Those are well known types, cmp won't panic.
+		logger := logging.FromContext(ctx).Desugar()
+		if logger.Core().Enabled(zapcore.DebugLevel) && !cmp.Equal(prevRO, effectiveRO) {
+			logger.Debug("Rollout diff:(-was,+now)",
+				zap.String("diff", cmp.Diff(prevRO, effectiveRO)))
+		}
+
 		// Now check if the ingress status changed from not ready to ready.
 		rtView := r.Status.GetCondition(v1.RouteConditionIngressReady)
 		if ingress.IsReady() && !rtView.IsTrue() {
+			logger.Debug("Observing Ingress not-ready to ready switch condition for rollout")
 			effectiveRO.ObserveReady(int(c.clock.Now().UnixNano()))
 		}
 
@@ -92,13 +104,14 @@ func (c *Reconciler) reconcileIngress(
 		if !equality.Semantic.DeepEqual(ingress.Spec, desired.Spec) ||
 			!equality.Semantic.DeepEqual(ingress.Annotations, desired.Annotations) ||
 			!equality.Semantic.DeepEqual(ingress.Labels, desired.Labels) {
+
 			// It is notable that one reason for differences here may be defaulting.
 			// When that is the case, the Update will end up being a nop because the
 			// webhook will bring them into alignment and no new reconciliation will occur.
 			// Also, compare annotation and label in case ingress.Class or parent route's labels
 			// is updated.
 
-			// Don't modify the informers copy
+			// Don't modify the informers copy.
 			origin := ingress.DeepCopy()
 			origin.Spec = desired.Spec
 			origin.Annotations = desired.Annotations
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index fc587484f..c9ac44c38 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -196,7 +196,7 @@ func (cur *Rollout) Step(prev *Rollout, nowTS int) *Rollout {
 				j++
 			case ccfgs[i].ConfigurationName < pcfgs[j].ConfigurationName:
 				// A new config, has been added. No action for rollout though.
-				// Keep it if it will receive traffic.
+				// Keep it for future rollout actions.
 				if ccfgs[i].Percent != 0 {
 					ret = append(ret, *ccfgs[i])
 				}
@@ -323,27 +323,37 @@ func stepConfig(goal, prev *ConfigurationRollout, nowTS int) *ConfigurationRollo
 	// If it matches the last revision of the previous rollout state (or there were no revisions)
 	// then no new rollout has begun for this configuration.
 	if len(prev.Revisions) == 0 || goal.Revisions[0].RevisionName == prev.Revisions[pc-1].RevisionName {
-		if len(prev.Revisions) > 0 {
+		// So if |prev.revisions| == 0 => then there was no rollout —
+		// nothing is required to step.
+		// If |prev.revisions| == 1 and it matches current revision then
+		// we're done.
+		// Thus we need to perform work only if there is more than one
+		// revision in the previous state.
+		if len(prev.Revisions) > 1 {
 			ret.Revisions = prev.Revisions
 
-			// TODO(vagababov): here would go the logic to compute new percentages for the rollout,
-			// i.e step function, so return value will change, depending on that.
-			// Copy the duration info from the previous when no new revision
+			// Copy various rollout stats from the previous when no new revision
 			// has been created.
+			ret.StartTime = prev.StartTime
 			ret.Deadline = prev.Deadline
 			ret.NextStepTime = prev.NextStepTime
 			ret.StepDuration = prev.StepDuration
-			ret.StartTime = prev.StartTime
 			ret.StepSize = prev.StepSize
-			// adjustPercentage above would've already accounted if target for the
-			// whole Configuration changed up or down. So here we should just redistribute
-			// the existing values.
-			stepRevisions(ret, nowTS)
+			// We might end up here before `ObserveReady` is called.
+			// In that case don't step individual revisions just yet.
+			if ret.StepSize > 0 {
+				// adjustPercentage above would've already accounted if target for the
+				// whole Configuration changed up or down. So here we should just redistribute
+				// the existing values.
+				stepRevisions(ret, nowTS)
+			}
 		}
 		return ret
 	}
 
-	// Otherwise we start a rollout, which means we need to stamp the starttime.
+	// Otherwise we start a rollout, which means we need to stamp the starttime,
+	// the rest of the fields will remain unset and `ObserveReady` will
+	// compute them when the ingress becomes ready.
 	ret.StartTime = nowTS
 
 	// Go backwards and find first revision with traffic assignment > 0.


Test patch:
diff --git a/pkg/reconciler/route/traffic/rollout_test.go b/pkg/reconciler/route/traffic/rollout_test.go
index a5124af1c..8927d5143 100644
--- a/pkg/reconciler/route/traffic/rollout_test.go
+++ b/pkg/reconciler/route/traffic/rollout_test.go
@@ -31,7 +31,7 @@ import (
 )
 
 func TestStep(t *testing.T) {
-	now := int(time.Now().UnixNano())
+	const now = 2020
 	tests := []struct {
 		name            string
 		prev, cur, want *Rollout
@@ -78,7 +78,7 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     2006, // <- Those should be ignored.
+				Deadline:     2006, // <- Those should be kept.
 				NextStepTime: 2009,
 				StepDuration: 2020,
 				StartTime:    2004,
@@ -93,11 +93,6 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     1982, // <- Those should be copied.
-				NextStepTime: 1984,
-				StepDuration: 1988,
-				StartTime:    1955,
-				StepSize:     15,
 			}},
 		},
 		want: &Rollout{
@@ -108,11 +103,107 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     1982,
-				NextStepTime: 1984,
-				StepDuration: 1988,
-				StartTime:    1955,
-				StepSize:     15,
+			}},
+		},
+	}, {
+		name: "simplest, step",
+		cur: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "let-it-bleed",
+					Percent:      100,
+				}},
+				NextStepTime: 2009,
+				StepDuration: 2020,
+				StartTime:    2004,
+				StepSize:     14,
+			}},
+		},
+		prev: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				NextStepTime:      2019,
+				StepDuration:      5,
+				StartTime:         2004,
+				StepSize:          3,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      95,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      5,
+				}},
+			}},
+		},
+		want: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      92, // -3
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      8, // +3
+				}},
+				NextStepTime: 2020 + 5, // now + duration.
+				StepDuration: 5,
+				StartTime:    2004,
+				StepSize:     3,
+			}},
+		},
+	}, {
+		name: "simplest, step, when stepsize=0",
+		cur: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "let-it-bleed",
+					Percent:      100,
+				}},
+				Deadline:     2006,
+				NextStepTime: 2009,
+				StepDuration: 2020,
+				StartTime:    2004,
+				StepSize:     14,
+			}},
+		},
+		prev: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				NextStepTime:      2019, // <- Those should be reset and/or updated.
+				StartTime:         2004,
+				StepDuration:      5,
+				StepSize:          0,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      95,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      5,
+				}},
+			}},
+		},
+		want: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      95,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      5,
+				}},
+				NextStepTime: 2019,
+				StartTime:    2004,
+				StepDuration: 5,
+				StepSize:     0,
 			}},
 		},
 	}, {
@@ -200,6 +291,7 @@ func TestStep(t *testing.T) {
 				Deadline:     1982, // <- Those should be thrown out.
 				NextStepTime: 1984,
 				StepDuration: 1988,
+				StepSize:     11,
 			}},
 		},
 		want: &Rollout{
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index d06f9e82a..4e51baf1c 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 webhooks:
   - admissionReviewVersions:
       - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,14 +168,14 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20201204-b873d22"
+        serving.knative.dev/release: "v20201208-3a1ba61"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-certmanager
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:93f7cbfadf6d7fefb3e2d6502f86fb386971c4b8c64a4882712a3df02bec2c54
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:b9d86275283f61cec2a2c8d0433b3389f59742a45a47de7f2456caad4cea418b
           resources:
             requests:
               cpu: 30m
@@ -213,7 +213,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -250,7 +250,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 spec:
   selector:
     matchLabels:
@@ -263,14 +263,14 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20201204-b873d22"
+        serving.knative.dev/release: "v20201208-3a1ba61"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:bbec7adb7a92e7f599c889d1143d39269b987170859a4f0f9e08826e784b20d0
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:255ac94c18a903babea3161e7faf506f5113fab96cd42c564811fd1ae7be1fa3
           resources:
             requests:
               cpu: 20m
@@ -329,7 +329,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 spec:
   ports:
     # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 2396be2f8..5412614a3 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 97df6abf586ce7b3c9d933e23d12ce6481f55c71
+# Generated when HEAD was e87b1c73e380aa7798c73cd0a38ec32734af353a
 #
 # Copyright 2019 The Knative Authors
 #
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -126,7 +126,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -141,7 +141,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -170,7 +170,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -206,7 +206,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -244,7 +244,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -268,7 +268,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -338,7 +338,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -354,14 +354,14 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20201207-97df6abf"
+        serving.knative.dev/release: "v20201208-e87b1c73"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-istio
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:0480d98296fe54e24915df0855fcf691988436adf12e6d51af2155e7bdf0982b
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:39fde178bac6f7994fe76871fae2c294bce5971627d3874be85176b421749233
           resources:
             requests:
               cpu: 30m
@@ -418,7 +418,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -432,14 +432,14 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20201207-97df6abf"
+        serving.knative.dev/release: "v20201208-e87b1c73"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:13d12f8438d78574fbbbcd6a9771915e1058e94adc30b48a1fc69010b26be277
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:38dd61407135120cb3a452914e566e19bdc2fd90499ed1a9f32b824efa605710
           resources:
             requests:
               cpu: 20m
@@ -493,7 +493,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index 19f1171ce..866d513c8 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -18,7 +18,7 @@ metadata:
   name: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -42,7 +42,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -51,7 +51,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 rules:
   - apiGroups: [""]
     resources: ["events"]
@@ -78,7 +78,7 @@ metadata:
   name: 3scale-kourier
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -110,7 +110,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   replicas: 1
   selector:
@@ -122,7 +122,7 @@ spec:
         app: 3scale-kourier-control
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:4c64e406888f8530439d3dbe7fbe038f8b5d1c6cb1fa9495fa2e65f4fc099028
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:54167f3d5b79c5401c59e0747563940b9cf5d31f357bf8ed242d3955a2cd0b4a
           name: kourier-control
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -158,7 +158,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   ports:
     - name: grpc-xds
@@ -191,7 +191,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   selector:
     matchLabels:
@@ -257,7 +257,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   ports:
     - name: http2
@@ -279,7 +279,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   ports:
     - name: http2
@@ -297,7 +297,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 data:
   envoy-bootstrap.yaml: |
     dynamic_resources: