Repository: knative/serving
Pull request #10280 (2020-12-07 11:21:27)

[Automated] Update net-contour nightly
Produced via:
```shell
for x in net-contour.yaml contour.yaml; do
  curl https://storage.googleapis.com/knative-nightly/net-contour/latest/$x > ${GITHUB_WORKSPACE}/./third_party/contour-latest/$x
done
```
/assign @knative/networking-wg-leads
/cc @knative/networking-wg-leads

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10280#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **nak3** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @nak3` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["nak3"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=h1) Report
> Merging [#10280](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=desc) (bc4e655) into [master](https://codecov.io/gh/knative/serving/commit/5caad90c9b1720419a728887a5e84cae846b47ff?el=desc) (5caad90) will **decrease** coverage by `0.10%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/10280/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui)](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master   #10280      +/-   ##
==========================================
- Coverage   88.24%   88.13%   -0.11%     
==========================================
  Files         184      184              
  Lines        8649     8649              
==========================================
- Hits         7632     7623       -9     
- Misses        783      788       +5     
- Partials      234      238       +4     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/configuration/configuration.go](https://codecov.io/gh/knative/serving/pull/10280/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvY29uZmlndXJhdGlvbi9jb25maWd1cmF0aW9uLmdv) | `84.37% <0.00%> (-2.35%)` | :arrow_down: |
| [pkg/reconciler/autoscaling/kpa/scaler.go](https://codecov.io/gh/knative/serving/pull/10280/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcva3BhL3NjYWxlci5nbw==) | `88.57% <0.00%> (-1.43%)` | :arrow_down: |
| [pkg/autoscaler/statforwarder/forwarder.go](https://codecov.io/gh/knative/serving/pull/10280/diff?src=pr&el=tree#diff-cGtnL2F1dG9zY2FsZXIvc3RhdGZvcndhcmRlci9mb3J3YXJkZXIuZ28=) | `81.38% <0.00%> (-1.07%)` | :arrow_down: |
| [pkg/activator/net/revision\_backends.go](https://codecov.io/gh/knative/serving/pull/10280/diff?src=pr&el=tree#diff-cGtnL2FjdGl2YXRvci9uZXQvcmV2aXNpb25fYmFja2VuZHMuZ28=) | `90.49% <0.00%> (-0.91%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=footer). Last update [5caad90...a3d237a](https://codecov.io/gh/knative/serving/pull/10280?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10280#" title="Author self-approved">knative-automation</a>*, *<a href="https://github.com/knative/serving/pull/10280#pullrequestreview-546345857" title="LGTM">tcnghia</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)~~ [tcnghia]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
knative-prow-robot: @knative-automation: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-upgrade-tests | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1335992260268920832) | `/test pull-knative-serving-upgrade-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
vagababov: /lgtm
/retest
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-upgrade-tests | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1335992260268920832) | `/test pull-knative-serving-upgrade-tests`
pull-knative-serving-istio-stable-no-mesh-tls | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-istio-stable-no-mesh-tls/1335992260331835392) | `/test pull-knative-serving-istio-stable-no-mesh-tls`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-istio-stable-no-mesh-tls | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-istio-stable-no-mesh-tls/1335992260331835392) | `/test pull-knative-serving-istio-stable-no-mesh-tls`
pull-knative-serving-upgrade-tests | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1336000766137077760) | `/test pull-knative-serving-upgrade-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-istio-stable-no-mesh-tls | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-istio-stable-no-mesh-tls/1335992260331835392) | `/test pull-knative-serving-istio-stable-no-mesh-tls`
pull-knative-serving-upgrade-tests | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1336000766137077760) | `/test pull-knative-serving-upgrade-tests`
pull-knative-serving-contour-latest | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-contour-latest/1335992260365389824) | `/test pull-knative-serving-contour-latest`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: New changes are detected. LGTM label has been removed.
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-contour-latest | a3d237a091d1ed22cfbf0b246d9fea284db88111 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-contour-latest/1335992260365389824) | `/test pull-knative-serving-contour-latest`
pull-knative-serving-upgrade-tests | 2f89bb8858e88256facb17291bc16bce3bd64bf0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1336269846832222208) | `/test pull-knative-serving-upgrade-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-upgrade-tests | 2f89bb8858e88256facb17291bc16bce3bd64bf0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1336269846832222208) | `/test pull-knative-serving-upgrade-tests`
pull-knative-serving-contour-latest | 2f89bb8858e88256facb17291bc16bce3bd64bf0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-contour-latest/1336269846974828544) | `/test pull-knative-serving-contour-latest`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-automation: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-upgrade-tests | 2f89bb8858e88256facb17291bc16bce3bd64bf0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-upgrade-tests/1336269846832222208) | `/test pull-knative-serving-upgrade-tests`
pull-knative-serving-contour-latest | 2f89bb8858e88256facb17291bc16bce3bd64bf0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-contour-latest/1336269846974828544) | `/test pull-knative-serving-contour-latest`
pull-knative-serving-istio-stable-no-mesh | 2f89bb8858e88256facb17291bc16bce3bd64bf0 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10280/pull-knative-serving-istio-stable-no-mesh/1336269846857388032) | `/test pull-knative-serving-istio-stable-no-mesh`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10280). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
vagababov: /lgtm
/retest

Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 5ab36ed92..c4dec9529 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -40,9 +40,10 @@ aliases:
   - vagababov       # Scaling
 
   autoscaling-approvers:
+  - julz
   - markusthoemmes
   - vagababov
-  - julz
+  - yanweiguo
   autoscaling-reviewers:
   - julz
   - markusthoemmes
diff --git a/go.mod b/go.mod
index 71819088c..56fb7a444 100644
--- a/go.mod
+++ b/go.mod
@@ -34,8 +34,8 @@ require (
 	k8s.io/client-go v0.18.12
 	k8s.io/code-generator v0.18.12
 	k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29
-	knative.dev/caching v0.0.0-20201204024709-8decac65dea7
+	knative.dev/caching v0.0.0-20201208013740-3ca9791186ed
 	knative.dev/hack v0.0.0-20201201234937-fddbf732e450
-	knative.dev/networking v0.0.0-20201203234509-4cd0793eed11
-	knative.dev/pkg v0.0.0-20201204175509-c9bac6be76ca
+	knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626
+	knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80
 )
diff --git a/go.sum b/go.sum
index ac9251412..7c081bb47 100644
--- a/go.sum
+++ b/go.sum
@@ -1216,16 +1216,15 @@ k8s.io/legacy-cloud-providers v0.18.8/go.mod h1:tgp4xYf6lvjrWnjQwTOPvWQE9IVqSBGP
 k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20200603063816-c1c6865ac451 h1:v8ud2Up6QK1lNOKFgiIVrZdMg7MpmSnvtrOieolJKoE=
 k8s.io/utils v0.0.0-20200603063816-c1c6865ac451/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/caching v0.0.0-20201204024709-8decac65dea7 h1:ZGlDPyF7ycBjKZ/kBFQNAYKJORvtVo88ofk5RQVUAw4=
-knative.dev/caching v0.0.0-20201204024709-8decac65dea7/go.mod h1:addawKx4UeuW2pSFGXQPDJ8w+OZmG3MQ+rdT3jjvCxU=
+knative.dev/caching v0.0.0-20201208013740-3ca9791186ed h1:Hl6jZZFVPRv++MDHtD9hy8lhJ/38HVImg+uJtBPo7BQ=
+knative.dev/caching v0.0.0-20201208013740-3ca9791186ed/go.mod h1:i+e4gaoBB34anvKMMiQDV86N7HbFYN6m+Op1IRhXXY8=
 knative.dev/hack v0.0.0-20201201234937-fddbf732e450 h1:IyitWF7OzfunCgE4b9ZsJAeIRoQ6JOyqDrz/19X4iS4=
 knative.dev/hack v0.0.0-20201201234937-fddbf732e450/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20201203234509-4cd0793eed11 h1:sogSEftyYRTNZ3g2Ynmvw8djj9X0RwBNa9GCDDLQMr4=
-knative.dev/networking v0.0.0-20201203234509-4cd0793eed11/go.mod h1:vj8h8ODz+HnStJgIgvAY2pyc146SJA1CaB9iKFpSjiM=
-knative.dev/pkg v0.0.0-20201203193109-a536174bdf99 h1:92aXqHzL90KS8KG/8tw90cUs+nEDssZXmeux7LLfrMs=
-knative.dev/pkg v0.0.0-20201203193109-a536174bdf99/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
-knative.dev/pkg v0.0.0-20201204175509-c9bac6be76ca h1:A8Nly0CAT2J+oVs37pzRIqOiBqSGWPMGNXCNwGoUwkQ=
-knative.dev/pkg v0.0.0-20201204175509-c9bac6be76ca/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
+knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626 h1:e8IIJxggzVD7kMNf+4mYY421vcWpD2U1jXXIRDWy7bg=
+knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626/go.mod h1:V4CU4mLLkWboLw3NOVmPHHOCL5nrUO3/vsRDUjsnJUQ=
+knative.dev/pkg v0.0.0-20201207225040-7e918163fc4f/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
+knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80 h1:wBRwTtE3saOiXsS/eh4FYDAC/Gj+djH8ZNkvd0OgtmE=
+knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
 modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
 modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
diff --git a/pkg/apis/serving/v1alpha1/domainmapping_lifecycle.go b/pkg/apis/serving/v1alpha1/domainmapping_lifecycle.go
index 0f9f9e494..4ab88d439 100644
--- a/pkg/apis/serving/v1alpha1/domainmapping_lifecycle.go
+++ b/pkg/apis/serving/v1alpha1/domainmapping_lifecycle.go
@@ -27,6 +27,7 @@ var domainMappingCondSet = apis.NewLivingConditionSet(
 	DomainMappingConditionDomainClaimed,
 	DomainMappingConditionReferenceResolved,
 	DomainMappingConditionIngressReady,
+	DomainMappingConditionCertificateProvisioned,
 )
 
 // GetConditionSet retrieves the condition set for this resource. Implements the KRShaped interface.
@@ -57,6 +58,60 @@ func (dms *DomainMappingStatus) InitializeConditions() {
 	domainMappingCondSet.Manage(dms).InitializeConditions()
 }
 
+const (
+	// AutoTLSNotEnabledMessage is the message which is set on the
+	// DomainMappingConditionCertificateProvisioned condition when it is set to True
+	// because AutoTLS was not enabled.
+	AutoTLSNotEnabledMessage = "autoTLS is not enabled"
+)
+
+// MarkTLSNotEnabled sets DomainMappingConditionCertificateProvisioned to true when
+// certificate provisioning was skipped because TLS was not enabled.
+func (dms *DomainMappingStatus) MarkTLSNotEnabled(msg string) {
+	domainMappingCondSet.Manage(dms).MarkTrueWithReason(DomainMappingConditionCertificateProvisioned,
+		"TLSNotEnabled", msg)
+}
+
+// MarkCertificateReady marks the DomainMappingConditionCertificateProvisioned
+// condition to indicate that the Certificate is ready.
+func (dms *DomainMappingStatus) MarkCertificateReady(name string) {
+	domainMappingCondSet.Manage(dms).MarkTrue(DomainMappingConditionCertificateProvisioned)
+}
+
+// MarkCertificateNotReady marks the DomainMappingConditionCertificateProvisioned
+// condition to indicate that the Certificate is not ready.
+func (dms *DomainMappingStatus) MarkCertificateNotReady(name string) {
+	domainMappingCondSet.Manage(dms).MarkUnknown(DomainMappingConditionCertificateProvisioned,
+		"CertificateNotReady",
+		"Certificate %s is not ready.", name)
+}
+
+// MarkCertificateNotOwned changes the DomainMappingConditionCertificateProvisioned
+// status to be false with the reason being that there is an existing
+// certificate with the name we wanted to use.
+func (dms *DomainMappingStatus) MarkCertificateNotOwned(name string) {
+	domainMappingCondSet.Manage(dms).MarkFalse(DomainMappingConditionCertificateProvisioned,
+		"CertificateNotOwned",
+		"There is an existing certificate %s that we don't own.", name)
+}
+
+// MarkCertificateProvisionFailed marks the
+// DomainMappingConditionCertificateProvisioned condition to indicate that the
+// Certificate provisioning failed.
+func (dms *DomainMappingStatus) MarkCertificateProvisionFailed(name string) {
+	domainMappingCondSet.Manage(dms).MarkFalse(DomainMappingConditionCertificateProvisioned,
+		"CertificateProvisionFailed",
+		"Certificate %s failed to be provisioned.", name)
+}
+
+// MarkHTTPDowngrade sets DomainMappingConditionCertificateProvisioned to true when plain
+// HTTP is enabled even when Certificate is not ready.
+func (dms *DomainMappingStatus) MarkHTTPDowngrade(name string) {
+	domainMappingCondSet.Manage(dms).MarkTrueWithReason(DomainMappingConditionCertificateProvisioned,
+		"HTTPDowngrade",
+		"Certificate %s is not ready downgrade HTTP.", name)
+}
+
 // MarkIngressNotConfigured changes the IngressReady condition to be unknown to reflect
 // that the Ingress does not yet have a Status.
 func (dms *DomainMappingStatus) MarkIngressNotConfigured() {
diff --git a/pkg/apis/serving/v1alpha1/domainmapping_types.go b/pkg/apis/serving/v1alpha1/domainmapping_types.go
index 8421afdf0..0fa82ca95 100644
--- a/pkg/apis/serving/v1alpha1/domainmapping_types.go
+++ b/pkg/apis/serving/v1alpha1/domainmapping_types.go
@@ -106,6 +106,10 @@ const (
 	// DomainMappingConditionDomainClaimed reflects that the ClusterDomainClaim
 	// for this DomainMapping exists, and is owned by this DomainMapping.
 	DomainMappingConditionDomainClaimed apis.ConditionType = "DomainClaimed"
+
+	// DomainMappingConditionCertificateProvisioned is set to False when the
+	// Knative Certificates fail to be provisioned for the DomainMapping.
+	DomainMappingConditionCertificateProvisioned apis.ConditionType = "CertificateProvisioned"
 )
 
 // GetStatus retrieves the status of the DomainMapping. Implements the KRShaped interface.
diff --git a/pkg/reconciler/domainmapping/reconciler.go b/pkg/reconciler/domainmapping/reconciler.go
index 17ec099b6..f0da3bdfa 100644
--- a/pkg/reconciler/domainmapping/reconciler.go
+++ b/pkg/reconciler/domainmapping/reconciler.go
@@ -58,6 +58,9 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, dm *v1alpha1.DomainMappi
 	logger := logging.FromContext(ctx)
 	logger.Debugf("Reconciling DomainMapping %s/%s", dm.Namespace, dm.Name)
 
+	// TODO(https://github.com/knative/serving/issues/10247)
+	dm.Status.MarkTLSNotEnabled("AutoTLS for DomainMapping is not implemented")
+
 	// Defensively assume the ingress is not configured until we manage to
 	// successfully reconcile it below. This avoids error cases where we fail
 	// before we've reconciled the ingress and get a new ObservedGeneration but
diff --git a/pkg/reconciler/route/reconcile_resources.go b/pkg/reconciler/route/reconcile_resources.go
index 14a91c791..e84c373b5 100644
--- a/pkg/reconciler/route/reconcile_resources.go
+++ b/pkg/reconciler/route/reconcile_resources.go
@@ -21,7 +21,9 @@ import (
 	"encoding/json"
 	"fmt"
 
+	"github.com/google/go-cmp/cmp"
 	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
 	"golang.org/x/sync/errgroup"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -77,9 +79,19 @@ func (c *Reconciler) reconcileIngress(
 		// And recompute the rollout state.
 		effectiveRO := curRO.Step(prevRO, int(c.clock.Now().UnixNano()))
 
+		// Comparing and diffing isn't cheap so do it only if we're going
+		// to actually log the message.
+		// Those are well known types, cmp won't panic.
+		logger := logging.FromContext(ctx).Desugar()
+		if logger.Core().Enabled(zapcore.DebugLevel) && !cmp.Equal(prevRO, effectiveRO) {
+			logger.Debug("Rollout diff:(-was,+now)",
+				zap.String("diff", cmp.Diff(prevRO, effectiveRO)))
+		}
+
 		// Now check if the ingress status changed from not ready to ready.
 		rtView := r.Status.GetCondition(v1.RouteConditionIngressReady)
 		if ingress.IsReady() && !rtView.IsTrue() {
+			logger.Debug("Observing Ingress not-ready to ready switch condition for rollout")
 			effectiveRO.ObserveReady(int(c.clock.Now().UnixNano()))
 		}
 
@@ -92,13 +104,14 @@ func (c *Reconciler) reconcileIngress(
 		if !equality.Semantic.DeepEqual(ingress.Spec, desired.Spec) ||
 			!equality.Semantic.DeepEqual(ingress.Annotations, desired.Annotations) ||
 			!equality.Semantic.DeepEqual(ingress.Labels, desired.Labels) {
+
 			// It is notable that one reason for differences here may be defaulting.
 			// When that is the case, the Update will end up being a nop because the
 			// webhook will bring them into alignment and no new reconciliation will occur.
 			// Also, compare annotation and label in case ingress.Class or parent route's labels
 			// is updated.
 
-			// Don't modify the informers copy
+			// Don't modify the informers copy.
 			origin := ingress.DeepCopy()
 			origin.Spec = desired.Spec
 			origin.Annotations = desired.Annotations
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index fc587484f..c9ac44c38 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -196,7 +196,7 @@ func (cur *Rollout) Step(prev *Rollout, nowTS int) *Rollout {
 				j++
 			case ccfgs[i].ConfigurationName < pcfgs[j].ConfigurationName:
 				// A new config, has been added. No action for rollout though.
-				// Keep it if it will receive traffic.
+				// Keep it for future rollout actions.
 				if ccfgs[i].Percent != 0 {
 					ret = append(ret, *ccfgs[i])
 				}
@@ -323,27 +323,37 @@ func stepConfig(goal, prev *ConfigurationRollout, nowTS int) *ConfigurationRollo
 	// If it matches the last revision of the previous rollout state (or there were no revisions)
 	// then no new rollout has begun for this configuration.
 	if len(prev.Revisions) == 0 || goal.Revisions[0].RevisionName == prev.Revisions[pc-1].RevisionName {
-		if len(prev.Revisions) > 0 {
+		// So if |prev.revisions| == 0 => then there was no rollout —
+		// nothing is required to step.
+		// If |prev.revisions| == 1 and it matches current revision then
+		// we're done.
+		// Thus we need to perform work only if there is more than one
+		// revision in the previous state.
+		if len(prev.Revisions) > 1 {
 			ret.Revisions = prev.Revisions
 
-			// TODO(vagababov): here would go the logic to compute new percentages for the rollout,
-			// i.e step function, so return value will change, depending on that.
-			// Copy the duration info from the previous when no new revision
+			// Copy various rollout stats from the previous when no new revision
 			// has been created.
+			ret.StartTime = prev.StartTime
 			ret.Deadline = prev.Deadline
 			ret.NextStepTime = prev.NextStepTime
 			ret.StepDuration = prev.StepDuration
-			ret.StartTime = prev.StartTime
 			ret.StepSize = prev.StepSize
-			// adjustPercentage above would've already accounted if target for the
-			// whole Configuration changed up or down. So here we should just redistribute
-			// the existing values.
-			stepRevisions(ret, nowTS)
+			// We might end up here before `ObserveReady` is called.
+			// In that case don't step individual revisions just yet.
+			if ret.StepSize > 0 {
+				// adjustPercentage above would've already accounted if target for the
+				// whole Configuration changed up or down. So here we should just redistribute
+				// the existing values.
+				stepRevisions(ret, nowTS)
+			}
 		}
 		return ret
 	}
 
-	// Otherwise we start a rollout, which means we need to stamp the starttime.
+	// Otherwise we start a rollout, which means we need to stamp the starttime,
+	// the rest of the fields will remain unset and `ObserveReady` will
+	// compute them when the ingress becomes ready.
 	ret.StartTime = nowTS
 
 	// Go backwards and find first revision with traffic assignment > 0.
diff --git a/vendor/knative.dev/pkg/logging/config.go b/vendor/knative.dev/pkg/logging/config.go
index 65b50395a..1effe1b35 100644
--- a/vendor/knative.dev/pkg/logging/config.go
+++ b/vendor/knative.dev/pkg/logging/config.go
@@ -62,9 +62,9 @@ func NewLogger(configJSON string, levelOverride string, opts ...zap.Option) (*za
 		}
 	}
 
-	logger, err2 := loggingCfg.Build(append(opts, zapdriver.WrapCore())...)
-	if err2 != nil {
-		panic(err2)
+	logger, err = loggingCfg.Build(append(opts, zapdriver.WrapCore())...)
+	if err != nil {
+		panic(err)
 	}
 
 	slogger := enrichLoggerWithCommitID(logger.Named(fallbackLoggerName))
@@ -74,13 +74,14 @@ func NewLogger(configJSON string, levelOverride string, opts ...zap.Option) (*za
 
 func enrichLoggerWithCommitID(logger *zap.Logger) *zap.SugaredLogger {
 	commitID, err := changeset.Get()
-	if err == nil {
-		// Enrich logs with GitHub commit ID.
-		return logger.With(zap.String(logkey.GitHubCommitID, commitID)).Sugar()
+	if err != nil {
+		logger.Info("Fetch GitHub commit ID from kodata failed", zap.Error(err))
+		return logger.Sugar()
 	}
 
-	logger.Info("Fetch GitHub commit ID from kodata failed", zap.Error(err))
-	return logger.Sugar()
+	// Enrich logs with GitHub commit ID.
+	return logger.With(zap.String(logkey.GitHubCommitID, commitID)).Sugar()
+
 }
 
 // NewLoggerFromConfig creates a logger using the provided Config
@@ -94,7 +95,7 @@ func NewLoggerFromConfig(config *Config, name string, opts ...zap.Option) (*zap.
 	return logger.Named(name), level
 }
 
-func newLoggerFromConfig(configJSON string, levelOverride string, opts []zap.Option) (*zap.Logger, zap.AtomicLevel, error) {
+func newLoggerFromConfig(configJSON, levelOverride string, opts []zap.Option) (*zap.Logger, zap.AtomicLevel, error) {
 	loggingCfg, err := zapConfigFromJSON(configJSON)
 	if err != nil {
 		return nil, zap.AtomicLevel{}, err
@@ -179,7 +180,6 @@ func levelFromString(level string) (*zapcore.Level, error) {
 // when a config map is updated
 func UpdateLevelFromConfigMap(logger *zap.SugaredLogger, atomicLevel zap.AtomicLevel,
 	levelKey string) func(configMap *corev1.ConfigMap) {
-
 	return func(configMap *corev1.ConfigMap) {
 		config, err := NewConfigFromConfigMap(configMap)
 		if err != nil {
diff --git a/vendor/knative.dev/pkg/profiling/server.go b/vendor/knative.dev/pkg/profiling/server.go
index 9ac2c5f05..9d61c0981 100644
--- a/vendor/knative.dev/pkg/profiling/server.go
+++ b/vendor/knative.dev/pkg/profiling/server.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/pprof"
+	"os"
 	"strconv"
 
 	"go.uber.org/atomic"
@@ -28,7 +29,11 @@ import (
 )
 
 const (
-	// ProfilingPort specifies the port where profiling data is available when profiling is enabled
+	// ProfilingPortKey specified the name of an environment variable that
+	// may be used to override the default profiling port.
+	ProfilingPortKey = "PROFILING_PORT"
+
+	// ProfilingPort specifies the default port where profiling data is available when profiling is enabled
 	ProfilingPort = 8008
 
 	// profilingKey is the name of the key in config-observability config map
@@ -100,8 +105,13 @@ func (h *Handler) UpdateFromConfigMap(configMap *corev1.ConfigMap) {
 
 // NewServer creates a new http server that exposes profiling data on the default profiling port
 func NewServer(handler http.Handler) *http.Server {
+	port := os.Getenv(ProfilingPortKey)
+	if port == "" {
+		port = strconv.Itoa(ProfilingPort)
+	}
+
 	return &http.Server{
-		Addr:    ":" + strconv.Itoa(ProfilingPort),
+		Addr:    ":" + port,
 		Handler: handler,
 	}
 }
diff --git a/vendor/knative.dev/pkg/version/version.go b/vendor/knative.dev/pkg/version/version.go
index 9e13c1d19..cac1399a4 100644
--- a/vendor/knative.dev/pkg/version/version.go
+++ b/vendor/knative.dev/pkg/version/version.go
@@ -61,6 +61,12 @@ func CheckMinimumVersion(versioner discovery.ServerVersionInterface) error {
 		return err
 	}
 
+	// If no specific pre-release requirement is set, we default to "-0" to always allow
+	// pre-release versions of the same Major.Minor.Patch version.
+	if len(minimumVersion.Pre) == 0 {
+		minimumVersion.Pre = []semver.PRVersion{{VersionNum: 0}}
+	}
+
 	// Compare returns 1 if the first version is greater than the
 	// second version.
 	if currentVersion.LT(minimumVersion) {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 45951769b..fc16696b4 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -954,7 +954,7 @@ k8s.io/utils/buffer
 k8s.io/utils/integer
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20201204024709-8decac65dea7
+# knative.dev/caching v0.0.0-20201208013740-3ca9791186ed
 ## explicit
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -978,7 +978,7 @@ knative.dev/caching/pkg/client/listers/caching/v1alpha1
 # knative.dev/hack v0.0.0-20201201234937-fddbf732e450
 ## explicit
 knative.dev/hack
-# knative.dev/networking v0.0.0-20201203234509-4cd0793eed11
+# knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626
 ## explicit
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -1012,7 +1012,7 @@ knative.dev/networking/test/conformance/ingress
 knative.dev/networking/test/defaultsystem
 knative.dev/networking/test/test_images/grpc-ping/proto
 knative.dev/networking/test/types
-# knative.dev/pkg v0.0.0-20201204175509-c9bac6be76ca
+# knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80
 ## explicit
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/pkg/apis/serving/v1alpha1/domainmapping_lifecycle_test.go b/pkg/apis/serving/v1alpha1/domainmapping_lifecycle_test.go
index bbcb3ecc5..675c44836 100644
--- a/pkg/apis/serving/v1alpha1/domainmapping_lifecycle_test.go
+++ b/pkg/apis/serving/v1alpha1/domainmapping_lifecycle_test.go
@@ -71,6 +71,7 @@ func TestDomainClaimConditions(t *testing.T) {
 	dms := &DomainMappingStatus{}
 
 	dms.InitializeConditions()
+	dms.MarkTLSNotEnabled("AutoTLS not yet available for DomainMapping")
 	apistest.CheckConditionOngoing(dms, DomainMappingConditionDomainClaimed, t)
 	apistest.CheckConditionOngoing(dms, DomainMappingConditionReady, t)
 
@@ -102,6 +103,7 @@ func TestReferenceResolvedCondition(t *testing.T) {
 	dms := &DomainMappingStatus{}
 
 	dms.InitializeConditions()
+	dms.MarkTLSNotEnabled("AutoTLS not yet available for DomainMapping")
 	apistest.CheckConditionOngoing(dms, DomainMappingConditionReferenceResolved, t)
 	apistest.CheckConditionOngoing(dms, DomainMappingConditionReady, t)
 
@@ -129,10 +131,53 @@ func TestReferenceResolvedCondition(t *testing.T) {
 	apistest.CheckConditionFailed(dms, DomainMappingConditionReady, t)
 }
 
+func TestCertificateNotReady(t *testing.T) {
+	dms := &DomainMappingStatus{}
+
+	dms.InitializeConditions()
+	dms.MarkCertificateNotReady("cert pending")
+
+	apistest.CheckConditionOngoing(dms, DomainMappingConditionCertificateProvisioned, t)
+}
+
+func TestCertificateProvisionFailed(t *testing.T) {
+	dms := &DomainMappingStatus{}
+
+	dms.InitializeConditions()
+	dms.MarkCertificateProvisionFailed("cert failed")
+
+	apistest.CheckConditionFailed(dms, DomainMappingConditionCertificateProvisioned, t)
+}
+
+func TestDomainMappingNotOwnCertificate(t *testing.T) {
+	dms := &DomainMappingStatus{}
+	dms.InitializeConditions()
+	dms.MarkCertificateNotOwned("cert not owned")
+
+	apistest.CheckConditionFailed(dms, DomainMappingConditionCertificateProvisioned, t)
+}
+
+func TestDomainMappingAutoTLSNotEnabled(t *testing.T) {
+	dms := &DomainMappingStatus{}
+	dms.InitializeConditions()
+	dms.MarkTLSNotEnabled(AutoTLSNotEnabledMessage)
+
+	apistest.CheckConditionSucceeded(dms, DomainMappingConditionCertificateProvisioned, t)
+}
+
+func TestDomainMappingHTTPDowngrade(t *testing.T) {
+	dms := &DomainMappingStatus{}
+	dms.InitializeConditions()
+	dms.MarkHTTPDowngrade("downgraded to HTTP because we can't obtain cert")
+
+	apistest.CheckConditionSucceeded(dms, DomainMappingConditionCertificateProvisioned, t)
+}
+
 func TestPropagateIngressStatus(t *testing.T) {
 	dms := &DomainMappingStatus{}
 
 	dms.InitializeConditions()
+	dms.MarkTLSNotEnabled("AutoTLS not yet available for DomainMapping")
 	apistest.CheckConditionOngoing(dms, DomainMappingConditionIngressReady, t)
 	apistest.CheckConditionOngoing(dms, DomainMappingConditionReady, t)
 
diff --git a/pkg/reconciler/domainmapping/table_test.go b/pkg/reconciler/domainmapping/table_test.go
index 230ddca68..7243ae972 100644
--- a/pkg/reconciler/domainmapping/table_test.go
+++ b/pkg/reconciler/domainmapping/table_test.go
@@ -604,6 +604,7 @@ func withPropagatedStatus(status netv1alpha1.IngressStatus) domainMappingOption
 
 func withInitDomainMappingConditions(dm *v1alpha1.DomainMapping) {
 	dm.Status.InitializeConditions()
+	dm.Status.MarkTLSNotEnabled("AutoTLS for DomainMapping is not implemented")
 }
 
 func withDomainClaimNotOwned(dm *v1alpha1.DomainMapping) {
diff --git a/pkg/reconciler/route/traffic/rollout_test.go b/pkg/reconciler/route/traffic/rollout_test.go
index a5124af1c..8927d5143 100644
--- a/pkg/reconciler/route/traffic/rollout_test.go
+++ b/pkg/reconciler/route/traffic/rollout_test.go
@@ -31,7 +31,7 @@ import (
 )
 
 func TestStep(t *testing.T) {
-	now := int(time.Now().UnixNano())
+	const now = 2020
 	tests := []struct {
 		name            string
 		prev, cur, want *Rollout
@@ -78,7 +78,7 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     2006, // <- Those should be ignored.
+				Deadline:     2006, // <- Those should be kept.
 				NextStepTime: 2009,
 				StepDuration: 2020,
 				StartTime:    2004,
@@ -93,11 +93,6 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     1982, // <- Those should be copied.
-				NextStepTime: 1984,
-				StepDuration: 1988,
-				StartTime:    1955,
-				StepSize:     15,
 			}},
 		},
 		want: &Rollout{
@@ -108,11 +103,107 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     1982,
-				NextStepTime: 1984,
-				StepDuration: 1988,
-				StartTime:    1955,
-				StepSize:     15,
+			}},
+		},
+	}, {
+		name: "simplest, step",
+		cur: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "let-it-bleed",
+					Percent:      100,
+				}},
+				NextStepTime: 2009,
+				StepDuration: 2020,
+				StartTime:    2004,
+				StepSize:     14,
+			}},
+		},
+		prev: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				NextStepTime:      2019,
+				StepDuration:      5,
+				StartTime:         2004,
+				StepSize:          3,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      95,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      5,
+				}},
+			}},
+		},
+		want: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      92, // -3
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      8, // +3
+				}},
+				NextStepTime: 2020 + 5, // now + duration.
+				StepDuration: 5,
+				StartTime:    2004,
+				StepSize:     3,
+			}},
+		},
+	}, {
+		name: "simplest, step, when stepsize=0",
+		cur: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "let-it-bleed",
+					Percent:      100,
+				}},
+				Deadline:     2006,
+				NextStepTime: 2009,
+				StepDuration: 2020,
+				StartTime:    2004,
+				StepSize:     14,
+			}},
+		},
+		prev: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				NextStepTime:      2019, // <- Those should be reset and/or updated.
+				StartTime:         2004,
+				StepDuration:      5,
+				StepSize:          0,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      95,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      5,
+				}},
+			}},
+		},
+		want: &Rollout{
+			Configurations: []ConfigurationRollout{{
+				ConfigurationName: "mick",
+				Percent:           100,
+				Revisions: []RevisionRollout{{
+					RevisionName: "their-satanic-majesties-request",
+					Percent:      95,
+				}, {
+					RevisionName: "let-it-bleed",
+					Percent:      5,
+				}},
+				NextStepTime: 2019,
+				StartTime:    2004,
+				StepDuration: 5,
+				StepSize:     0,
 			}},
 		},
 	}, {
@@ -200,6 +291,7 @@ func TestStep(t *testing.T) {
 				Deadline:     1982, // <- Those should be thrown out.
 				NextStepTime: 1984,
 				StepDuration: 1988,
+				StepSize:     11,
 			}},
 		},
 		want: &Rollout{
diff --git a/test/config/security/authorization_service.yaml b/test/config/security/authorization_service.yaml
deleted file mode 100644
index fb45c3605..000000000
--- a/test/config/security/authorization_service.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Copyright 2020 The Knative Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: security.istio.io/v1beta1
-kind: AuthorizationPolicy
-metadata:
-  name: deny-all
-  namespace: serving-tests
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  {}
----
-apiVersion: security.istio.io/v1beta1
-kind: AuthorizationPolicy
-metadata:
-  name: allow-namespaces
-  namespace: serving-tests
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  action: ALLOW
-  rules:
-  - from:
-    - source:
-       # knative-serving
-       # * This is for access to knative services from autoscaler and access via activator.
-       # istio-system
-       # * This is for access to k8s services from ingress-gateway in istio-system. e.g. conformance/ingress/*
-       # serving-tests
-       # * This is for access to k8s services from serving-tests. e.g TestVisibilitySplit
-       namespaces: ["knative-serving", "istio-system", "serving-tests"]
diff --git a/test/config/security/destinationrule.yaml b/test/config/security/destinationrule.yaml
deleted file mode 100644
index 728a57dd6..000000000
--- a/test/config/security/destinationrule.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-# Copyright 2019 The Knative Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: "networking.istio.io/v1alpha3"
-kind: "DestinationRule"
-metadata:
-  name: "mtls-services"
-  namespace: "serving-tests"
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  host: "*.local"
-  trafficPolicy:
-    tls:
-      mode: ISTIO_MUTUAL
----
-apiVersion: "networking.istio.io/v1alpha3"
-kind: "DestinationRule"
-metadata:
-  name: "mtls-services"
-  namespace: "serving-tests-alt"
-  labels:
-    test.knative.dev/dependency: istio-sidecar
-spec:
-  host: "*.local"
-  trafficPolicy:
-    tls:
-      mode: ISTIO_MUTUAL
diff --git a/test/e2e-common.sh b/test/e2e-common.sh
index 2c65c7af0..e4f35aa59 100644
--- a/test/e2e-common.sh
+++ b/test/e2e-common.sh
@@ -429,9 +429,7 @@ function test_teardown() {
   local TEST_CONFIG_DIR=${TMP_DIR}/test/config
   echo ">> Removing test resources (${TEST_CONFIG_DIR}/)"
   ko delete --ignore-not-found=true --now -f ${TEST_CONFIG_DIR}/
-  if (( MESH )); then
-    ko delete --ignore-not-found=true --now -f ${TEST_CONFIG_DIR}/security/
-  fi
+
   echo ">> Ensuring test namespaces are clean"
   kubectl delete all --all --ignore-not-found --now --timeout 60s -n serving-tests
   kubectl delete --ignore-not-found --now --timeout 60s namespace serving-tests
diff --git a/test/e2e/autotls/config/util.go b/test/e2e/autotls/config/util.go
index 8876a2f64..fcb246f5e 100644
--- a/test/e2e/autotls/config/util.go
+++ b/test/e2e/autotls/config/util.go
@@ -75,7 +75,7 @@ func ChangeDNSRecord(change *dns.Change, svc *dns.Service, dnsProject, dnsZone s
 		return err
 	}
 	// Wait for change to be acknowledged.
-	return wait.PollImmediate(time.Second, 5*time.Minute, func() (bool, error) {
+	return wait.PollImmediate(10*time.Second, 5*time.Minute, func() (bool, error) {
 		tmp, err := svc.Changes.Get(dnsProject, dnsZone, chg.Id).Do()
 		if err != nil {
 			return false, err
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index d06f9e82a..4e51baf1c 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 webhooks:
   - admissionReviewVersions:
       - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,14 +168,14 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20201204-b873d22"
+        serving.knative.dev/release: "v20201208-3a1ba61"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-certmanager
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:93f7cbfadf6d7fefb3e2d6502f86fb386971c4b8c64a4882712a3df02bec2c54
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:b9d86275283f61cec2a2c8d0433b3389f59742a45a47de7f2456caad4cea418b
           resources:
             requests:
               cpu: 30m
@@ -213,7 +213,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -250,7 +250,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 spec:
   selector:
     matchLabels:
@@ -263,14 +263,14 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20201204-b873d22"
+        serving.knative.dev/release: "v20201208-3a1ba61"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:bbec7adb7a92e7f599c889d1143d39269b987170859a4f0f9e08826e784b20d0
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:255ac94c18a903babea3161e7faf506f5113fab96cd42c564811fd1ae7be1fa3
           resources:
             requests:
               cpu: 20m
@@ -329,7 +329,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20201204-b873d22"
+    serving.knative.dev/release: "v20201208-3a1ba61"
 spec:
   ports:
     # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index 5b49f8400..b6c49c1ee 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -1482,7 +1482,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: Always
           command:
             - contour
@@ -1709,7 +1709,7 @@ spec:
             - --contour-key-file=/certs/tls.key
             - --config-path=/config/contour.yaml
           command: ["contour"]
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -1798,7 +1798,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -1875,7 +1875,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -2097,7 +2097,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: Always
           command:
             - contour
@@ -2217,7 +2217,7 @@ spec:
             - --contour-key-file=/certs/tls.key
             - --config-path=/config/contour.yaml
           command: ["contour"]
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2306,7 +2306,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2383,7 +2383,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:4d3c13bd373148befdd226eeb99d583ad33fee2ac275d742743a9f709be07a37
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 23bf5a790..29a78bddf 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -33,7 +33,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: contour
-    serving.knative.dev/release: "v20201204-b12ac184"
+    serving.knative.dev/release: "v20201208-1b117ce1"
 data:
   _example: |
     ################################
@@ -103,7 +103,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:264111aa7b24595dbce9738883f668fa66f50a846ad49e3036f572d5090f8c0e
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:75a52252dc2ca97373045dbb91de57cea540e647c6f3bd599ec2f530e29617e5
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 2396be2f8..5412614a3 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 97df6abf586ce7b3c9d933e23d12ce6481f55c71
+# Generated when HEAD was e87b1c73e380aa7798c73cd0a38ec32734af353a
 #
 # Copyright 2019 The Knative Authors
 #
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -126,7 +126,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -141,7 +141,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -170,7 +170,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -206,7 +206,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -244,7 +244,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -268,7 +268,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -338,7 +338,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -354,14 +354,14 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20201207-97df6abf"
+        serving.knative.dev/release: "v20201208-e87b1c73"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-istio
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:0480d98296fe54e24915df0855fcf691988436adf12e6d51af2155e7bdf0982b
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:39fde178bac6f7994fe76871fae2c294bce5971627d3874be85176b421749233
           resources:
             requests:
               cpu: 30m
@@ -418,7 +418,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -432,14 +432,14 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20201207-97df6abf"
+        serving.knative.dev/release: "v20201208-e87b1c73"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:13d12f8438d78574fbbbcd6a9771915e1058e94adc30b48a1fc69010b26be277
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:38dd61407135120cb3a452914e566e19bdc2fd90499ed1a9f32b824efa605710
           resources:
             requests:
               cpu: 20m
@@ -493,7 +493,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20201207-97df6abf"
+    serving.knative.dev/release: "v20201208-e87b1c73"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index 19f1171ce..866d513c8 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -18,7 +18,7 @@ metadata:
   name: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -42,7 +42,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -51,7 +51,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 rules:
   - apiGroups: [""]
     resources: ["events"]
@@ -78,7 +78,7 @@ metadata:
   name: 3scale-kourier
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -110,7 +110,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   replicas: 1
   selector:
@@ -122,7 +122,7 @@ spec:
         app: 3scale-kourier-control
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:4c64e406888f8530439d3dbe7fbe038f8b5d1c6cb1fa9495fa2e65f4fc099028
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:54167f3d5b79c5401c59e0747563940b9cf5d31f357bf8ed242d3955a2cd0b4a
           name: kourier-control
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -158,7 +158,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   ports:
     - name: grpc-xds
@@ -191,7 +191,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   selector:
     matchLabels:
@@ -257,7 +257,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   ports:
     - name: http2
@@ -279,7 +279,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 spec:
   ports:
     - name: http2
@@ -297,7 +297,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201207-5980e37f"
+    serving.knative.dev/release: "v20201208-105c052d"
 data:
   envoy-bootstrap.yaml: |
     dynamic_resources:
diff --git a/vendor/knative.dev/pkg/test/spoof/spoof.go b/vendor/knative.dev/pkg/test/spoof/spoof.go
index 9d00bad9e..48ffcffa8 100644
--- a/vendor/knative.dev/pkg/test/spoof/spoof.go
+++ b/vendor/knative.dev/pkg/test/spoof/spoof.go
@@ -96,7 +96,7 @@ func New(
 	opts ...TransportOption) (*SpoofingClient, error) {
 	endpoint, mapper, err := ResolveEndpoint(ctx, kubeClientset, domain, resolvable, endpointOverride)
 	if err != nil {
-		return nil, fmt.Errorf("failed get the cluster endpoint: %w", err)
+		return nil, fmt.Errorf("failed to get the cluster endpoint: %w", err)
 	}
 
 	// Spoof the hostname at the resolver level