Repository: knative/pkg
Pull request #1725 (2020-09-21 14:52:19)

Apply gosec checks to the codebase, except tests.
Pretty much the same as https://github.com/knative/serving/pull/9489.
/hold

To review the TLS stuff.

knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/pkg/pull/1725#" title="Author self-approved">markusthoemmes</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fpkg).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative/pkg/blob/master/OWNERS)~~ [markusthoemmes]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/pkg/pull/1725?src=pr&el=h1) Report
> :exclamation: No coverage uploaded for pull request base (`master@de640e8`). [Click here to learn what that means](https://docs.codecov.io/docs/error-reference#section-missing-base-commit).
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/pkg/pull/1725/graphs/tree.svg?width=650&height=150&src=pr&token=rlqpDnfxbO)](https://codecov.io/gh/knative/pkg/pull/1725?src=pr&el=tree)

```diff
@@            Coverage Diff            @@
##             master    #1725   +/-   ##
=========================================
  Coverage          ?   67.61%           
=========================================
  Files             ?      226           
  Lines             ?     9545           
  Branches          ?        0           
=========================================
  Hits              ?     6454           
  Misses            ?     2719           
  Partials          ?      372           
```



------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/pkg/pull/1725?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/pkg/pull/1725?src=pr&el=footer). Last update [de640e8...d94d446](https://codecov.io/gh/knative/pkg/pull/1725?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

knative-prow-robot: @markusthoemmes: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-pkg-unit-tests | d94d44641073da18a5c57974d3ab14c712a3d2ec | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_pkg/1725/pull-knative-pkg-unit-tests/1308056673788628995) | `/test pull-knative-pkg-unit-tests`

[Full PR test history](https://gubernator.knative.dev/pr/knative_pkg/1725). [Your PR dashboard](https://gubernator.knative.dev/pr/markusthoemmes).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
mattmoor: TestMetrics (cc @evankanderson )
/retest
evankanderson: Ugh, thanks!

Patch:
diff --git a/.github/workflows/knative-donotsubmit.yaml b/.github/workflows/knative-donotsubmit.yaml
index dcfd1ed86..92a96636b 100644
--- a/.github/workflows/knative-donotsubmit.yaml
+++ b/.github/workflows/knative-donotsubmit.yaml
@@ -49,10 +49,7 @@ jobs:
           echo '::group:: Running DO NOT SUBMIT with reviewdog 🐶 ...'
           # Don't fail because of grep
           set +o pipefail
-          find . -path './vendor' -prune \
-                 -o -path './third_party' -prune \
-                 -o -path './.github/workflows' -prune \
-                 -o -type f |
+          find . -type f -not -path './vendor/*' -not -path './third_party/*' -not -path './.git/*' -not -path './.github/workflows/*' |
           xargs grep -n "DO NOT SUBMIT" |
           reviewdog -efm="%f:%l:%m" \
                 -name="DO NOT SUBMIT" \
diff --git a/.github/workflows/knative-go-build.yaml b/.github/workflows/knative-go-build.yaml
index 98c9e411a..609551157 100644
--- a/.github/workflows/knative-go-build.yaml
+++ b/.github/workflows/knative-go-build.yaml
@@ -27,7 +27,7 @@ jobs:
     name: Build
     strategy:
       matrix:
-        go-version: [1.14.x]
+        go-version: [1.15.x]
         platform: [ubuntu-latest]
 
     runs-on: ${{ matrix.platform }}
diff --git a/.github/workflows/knative-style.yaml b/.github/workflows/knative-style.yaml
index 687f4b195..31a0aeb2e 100644
--- a/.github/workflows/knative-style.yaml
+++ b/.github/workflows/knative-style.yaml
@@ -29,29 +29,51 @@ jobs:
 
     steps:
 
-      - name: Set up Go 1.14.x
+      - name: Set up Go 1.15.x
         uses: actions/setup-go@v2
         with:
-          go-version: 1.14.x
+          go-version: 1.15.x
         id: go
 
       - name: Check out code
         uses: actions/checkout@v2
 
+      - name: Install Dependencies
+        run: |
+          cd $(mktemp -d)
+          GO111MODULE=on go get golang.org/x/tools/cmd/goimports
+
       # Run this last because it alters the workspace.
       # TODO: add prettier step
-      # TODO: add goimports step
+      - name: Go Imports
+        shell: bash
+        run: |
+          goimports -w $(find -path './vendor' -prune -o -path './third_party' -prune -o -name '*.pb.go' -prune -o -type f -name '*.go' -print)
+          echo "::set-env name=FMT_TOOL::goimports"
+      - name: Verify goimport
+        shell: bash
+        run: |
+          if [[ $(git diff-index --name-only HEAD --) ]]; then
+              echo "Found diffs in:"
+              git diff-index --name-only HEAD --
+              echo "${{ github.repository }} is out of style. Please run $FMT_TOOL."
+              exit 1
+          fi
+          echo "${{ github.repository }} is formatted correctly."
+
       - name: Go Format
         shell: bash
         run: |
-          gofmt -s -w $(find -path './vendor' -prune -o -path './third_party' -prune -o -type f -name '*.go' -print)
-      - name: Verify
+          gofmt -s -w $(find -path './vendor' -prune -o -path './third_party' -prune -o -name '*.pb.go' -prune -o -type f -name '*.go' -print)
+          echo "::set-env name=FMT_TOOL::gofmt"
+      - name: Verify gofmt
         shell: bash
+        # TODO(mattmoor): combine with above via anchors when actions support it.
         run: |
           if [[ $(git diff-index --name-only HEAD --) ]]; then
               echo "Found diffs in:"
               git diff-index --name-only HEAD --
-              echo "${{ github.repository }} is out of style. Please run go fmt."
+              echo "${{ github.repository }} is out of style. Please run $FMT_TOOL."
               exit 1
           fi
           echo "${{ github.repository }} is formatted correctly."
@@ -61,21 +83,38 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-
-      - name: Set up Go 1.14.x
+      - name: Set up Go 1.15.x
         uses: actions/setup-go@v2
         with:
-          go-version: 1.14.x
+          go-version: 1.15.x
         id: go
 
       - name: Check out code
         uses: actions/checkout@v2
 
+      - name: Install Tools
+        run: |
+          TEMP_PATH="$(mktemp -d)"
+          cd $TEMP_PATH
+
+          echo '::group::🐶 Installing reviewdog ... https://github.com/reviewdog/reviewdog'
+          curl -sfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b "${TEMP_PATH}" 2>&1
+          echo '::endgroup::'
+
+          echo '::group:: Installing misspell ... https://github.com/client9/misspell'
+          go get github.com/client9/misspell/cmd/misspell
+          echo '::endgroup::'
+
+          echo '::group:: Installing woke ... https://github.com/get-woke/woke'
+          curl -sfL https://raw.githubusercontent.com/get-woke/woke/main/install.sh | sh -s -- -b "${TEMP_PATH}" "${WOKE_VERSION}" 2>&1
+          echo '::endgroup::'
+
+          echo "::add-path::${TEMP_PATH}"
+
       - id: golangci_configuration
         uses: andstor/file-existence-action@v1
         with:
           files: .golangci.yaml
-
       - name: Go Lint
         if: steps.golangci_configuration.outputs.files_exists == 'true'
         uses: golangci/golangci-lint-action@v2
@@ -92,26 +131,65 @@ jobs:
           set -e
           cd "${GITHUB_WORKSPACE}" || exit 1
 
-          TEMP_PATH="$(mktemp -d)"
-          PATH="${TEMP_PATH}:$PATH"
+          echo '::group:: Running github.com/client9/misspell with reviewdog 🐶 ...'
+          # Don't fail because of misspell
+          set +o pipefail
+          find . -type f -not -path './vendor/*' -not -path './third_party/*' -not -path './.git/*' |
+          xargs misspell -error |
+          reviewdog -efm="%f:%l:%c: %m" \
+                -name="github.com/client9/misspell" \
+                -reporter="github-pr-check" \
+                -filter-mode="added" \
+                -fail-on-error="true" \
+                -level="error"
 
-          echo '::group:: Installing misspell ... https://github.com/client9/misspell'
-          go get github.com/client9/misspell/cmd/misspell
           echo '::endgroup::'
 
-          echo '::group::🐶 Installing reviewdog ... https://github.com/reviewdog/reviewdog'
-          curl -sfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b "${TEMP_PATH}" 2>&1
+      - name: trailing whitespace
+        shell: bash
+        if: ${{ always() }}
+        env:
+          REVIEWDOG_GITHUB_API_TOKEN: ${{ github.token }}
+        run: |
+          set -e
+          cd "${GITHUB_WORKSPACE}" || exit 1
+
+          echo '::group:: Flagging trailing whitespace with reviewdog 🐶 ...'
+          # Don't fail because of grep
+          set +o pipefail
+          find . -type f -not -path './vendor/*' -not -path './third_party/*' -not -path './.git/*' |
+          xargs grep -nE " +$" |
+          reviewdog -efm="%f:%l:%m" \
+                -name="trailing whitespace" \
+                -reporter="github-pr-check" \
+                -filter-mode="added" \
+                -fail-on-error="true" \
+                -level="error"
+
           echo '::endgroup::'
 
-          echo '::group:: Running github.com/client9/misspell with reviewdog 🐶 ...'
+      - name: EOF newline
+        shell: bash
+        if: ${{ always() }}
+        env:
+          REVIEWDOG_GITHUB_API_TOKEN: ${{ github.token }}
+        run: |
+          set -e
+          cd "${GITHUB_WORKSPACE}" || exit 1
+
+          echo '::group:: Flagging missing EOF newlines with reviewdog 🐶 ...'
           # Don't fail because of misspell
           set +o pipefail
-          find . -path './vendor' -prune \
-                 -o -path './third_party' -prune \
-                 -o -type f |
-          xargs misspell -error |
-          reviewdog -efm="%f:%l:%c: %m" \
-                -name="github.com/client9/misspell" \
+          for x in $(find . -type f -not -path './vendor/*' -not -path './third_party/*' -not -path './.git/*'); do
+            # Based on https://stackoverflow.com/questions/34943632/linux-check-if-there-is-an-empty-line-at-the-end-of-a-file
+            if [[ -f $x && ! ( -s "$x" && -z "$(tail -c 1 $x)" ) ]]; then
+              # We add 1 to `wc -l` here because of this limitation (from the man page):
+              # Characters beyond the final <newline> character will not be included in the line count.
+              echo $x:$((1 + $(wc -l $x | tr -s ' ' | cut -d' ' -f 1))): Missing newline
+            fi
+          done |
+          reviewdog -efm="%f:%l: %m" \
+                -name="EOF Newline" \
                 -reporter="github-pr-check" \
                 -filter-mode="added" \
                 -fail-on-error="true" \
@@ -131,20 +209,12 @@ jobs:
           set -e
           cd "${GITHUB_WORKSPACE}" || exit 1
 
-          TEMP_PATH="$(mktemp -d)"
-          PATH="${TEMP_PATH}:$PATH"
-
-          echo '::group::🐶 Installing reviewdog ... https://github.com/reviewdog/reviewdog'
-          curl -sfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b "${TEMP_PATH}" 2>&1
-          echo '::endgroup::'
-
-          echo '::group:: Installing woke ... https://github.com/get-woke/woke'
-          curl -sfL https://raw.githubusercontent.com/get-woke/woke/main/install.sh | sh -s -- -b "${TEMP_PATH}" "${WOKE_VERSION}" 2>&1
-          echo '::endgroup::'
-
           # Create a minimal .wokeignore if none already exist.
           if [ ! -f .wokeignore ]; then
-            echo "vendor\nthird_party" > .wokeignore
+            cat > .wokeignore <<EOF
+            vendor/*
+            third_party/*
+          EOF
           fi
 
           echo '::group:: Running woke with reviewdog 🐶 ...'
diff --git a/.github/workflows/knative-verify.yaml b/.github/workflows/knative-verify.yaml
index c29a6a04d..57b541280 100644
--- a/.github/workflows/knative-verify.yaml
+++ b/.github/workflows/knative-verify.yaml
@@ -27,7 +27,7 @@ jobs:
     name: Verify Deps and Codegen
     strategy:
       matrix:
-        go-version: [1.14.x]
+        go-version: [1.15.x]
         platform: [ubuntu-latest]
 
     runs-on: ${{ matrix.platform }}
diff --git a/.golangci.yaml b/.golangci.yaml
index a33656679..d569408fe 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -7,7 +7,14 @@ run:
 
 linters:
   enable:
-    - unconvert
+    - gosec
     - prealloc
+    - unconvert
   disable:
     - errcheck
+
+issues:
+  exclude-rules:
+    - path: test # Excludes /test, *_test.go etc.
+      linters:
+        - gosec
diff --git a/configmap/hash-gen/main.go b/configmap/hash-gen/main.go
index 8d9b7bfe0..bde4f7871 100644
--- a/configmap/hash-gen/main.go
+++ b/configmap/hash-gen/main.go
@@ -49,6 +49,7 @@ func processFile(fileName string) error {
 		return err
 	}
 
+	// nolint:gosec // This is not security critical so open permissions are fine.
 	if err := ioutil.WriteFile(fileName, out, 0644); err != nil {
 		return fmt.Errorf("failed to write file: %w", err)
 	}
diff --git a/go.mod b/go.mod
index 77197770c..e1224ed17 100644
--- a/go.mod
+++ b/go.mod
@@ -55,7 +55,7 @@ require (
 	k8s.io/code-generator v0.18.8
 	k8s.io/gengo v0.0.0-20200205140755-e0e292d8aa12
 	k8s.io/klog v1.0.0
-	knative.dev/test-infra v0.0.0-20200918021244-22269d552166
+	knative.dev/test-infra v0.0.0-20200921012245-37f1a12adbd3
 	sigs.k8s.io/boskos v0.0.0-20200729174948-794df80db9c9
 )
 
diff --git a/go.sum b/go.sum
index 4fbd3c6e8..1e2569a19 100644
--- a/go.sum
+++ b/go.sum
@@ -1846,8 +1846,8 @@ knative.dev/test-infra v0.0.0-20200505052144-5ea2f705bb55/go.mod h1:WqF1Azka+FxP
 knative.dev/test-infra v0.0.0-20200513011557-d03429a76034/go.mod h1:aMif0KXL4g19YCYwsy4Ocjjz5xgPlseYV+B95Oo4JGE=
 knative.dev/test-infra v0.0.0-20200519015156-82551620b0a9/go.mod h1:A5b2OAXTOeHT3hHhVQm3dmtbuWvIDP7qzgtqxA3/2pE=
 knative.dev/test-infra v0.0.0-20200707183444-aed09e56ddc7/go.mod h1:RjYAhXnZqeHw9+B0zsbqSPlae0lCvjekO/nw5ZMpLCs=
-knative.dev/test-infra v0.0.0-20200918021244-22269d552166 h1:7Ls02/98BkpQbCItaIjkpNDKGy5oOam1SsGS6U0zl54=
-knative.dev/test-infra v0.0.0-20200918021244-22269d552166/go.mod h1:Pmg2c7Z7q7BGFUV/GOpU5BlrD3ePJft4MPqx8AYBplc=
+knative.dev/test-infra v0.0.0-20200921012245-37f1a12adbd3 h1:abacWewpeP9QUByQAunuOA8F9hQ6Ryr2P63r38ns5sA=
+knative.dev/test-infra v0.0.0-20200921012245-37f1a12adbd3/go.mod h1:Pmg2c7Z7q7BGFUV/GOpU5BlrD3ePJft4MPqx8AYBplc=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
diff --git a/kmeta/names.go b/kmeta/names.go
index c59090b52..43d12de80 100644
--- a/kmeta/names.go
+++ b/kmeta/names.go
@@ -17,7 +17,7 @@ limitations under the license.
 package kmeta
 
 import (
-	"crypto/md5"
+	"crypto/md5" // nolint:gosec // No strong cryptography needed.
 	"fmt"
 	"strings"
 )
@@ -42,6 +42,7 @@ func ChildName(parent, suffix string) string {
 		// If the suffix is longer than the longest allowed suffix, then
 		// we hash the whole combined string and use that as the suffix.
 		if head-len(suffix) <= 0 {
+			// nolint:gosec // No strong cryptography needed.
 			h := md5.Sum([]byte(parent + suffix))
 			// 1. trim parent, if needed
 			if head < len(parent) {
@@ -58,6 +59,7 @@ func ChildName(parent, suffix string) string {
 			// remove it.
 			return strings.TrimRight(ret, "-")
 		}
+		// nolint:gosec // No strong cryptography needed.
 		n = fmt.Sprintf("%s%x", parent[:head-len(suffix)], md5.Sum([]byte(parent)))
 	}
 	return n + suffix
diff --git a/metrics/opencensus_exporter.go b/metrics/opencensus_exporter.go
index c0a475250..403449e23 100644
--- a/metrics/opencensus_exporter.go
+++ b/metrics/opencensus_exporter.go
@@ -99,6 +99,7 @@ func getCredentials(component string, secret *corev1.Secret, logger *zap.Sugared
 		return nil
 	}
 	return credentials.NewTLS(&tls.Config{
+		MinVersion: tls.VersionTLS12,
 		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
 			cert, err := tls.X509KeyPair(secret.Data["client-cert.pem"], secret.Data["client-key.pem"])
 			if err != nil {
diff --git a/metrics/resource_view.go b/metrics/resource_view.go
index 7d69ae94e..1e89787f6 100644
--- a/metrics/resource_view.go
+++ b/metrics/resource_view.go
@@ -72,11 +72,7 @@ func RegisterResourceView(views ...*view.View) error {
 	defer resourceViews.lock.Unlock()
 	for _, meter := range allMeters.meters {
 		// make a copy of views to avoid data races
-		viewCopy := make([]*view.View, 0, len(views))
-		for _, v := range views {
-			c := *v
-			viewCopy = append(viewCopy, &c)
-		}
+		viewCopy := copyViews(views)
 		if e := meter.m.Register(viewCopy...); e != nil {
 			err = e
 		}
@@ -213,11 +209,7 @@ func meterExporterForResource(r *resource.Resource) *meterExporter {
 	resourceViews.lock.Lock()
 	defer resourceViews.lock.Unlock()
 	// make a copy of views to avoid data races
-	viewsCopy := make([]*view.View, 0, len(resourceViews.views))
-	for _, v := range resourceViews.views {
-		c := *v
-		viewsCopy = append(viewsCopy, &c)
-	}
+	viewsCopy := copyViews(resourceViews.views)
 	mE.m.Register(viewsCopy...)
 	mE.o = stats.WithRecorder(mE.m)
 	allMeters.meters[key] = mE
@@ -295,6 +287,21 @@ func resourceFromKey(s string) *resource.Resource {
 	return r
 }
 
+func copyViews(views []*view.View) []*view.View {
+	viewsCopy := make([]*view.View, 0, len(resourceViews.views))
+	for _, v := range views {
+		c := *v
+		c.TagKeys = make([]tag.Key, len(v.TagKeys))
+		copy(c.TagKeys, v.TagKeys)
+		agg := *v.Aggregation
+		c.Aggregation = &agg
+		c.Aggregation.Buckets = make([]float64, len(v.Aggregation.Buckets))
+		copy(c.Aggregation.Buckets, v.Aggregation.Buckets)
+		viewsCopy = append(viewsCopy, &c)
+	}
+	return viewsCopy
+}
+
 // defaultMeterImpl is a pass-through to the default worker in OpenCensus.
 type defaultMeterImpl struct{}
 
diff --git a/network/transports.go b/network/transports.go
index 84f7a1e9c..64ce11845 100644
--- a/network/transports.go
+++ b/network/transports.go
@@ -93,19 +93,13 @@ func dialBackOffHelper(ctx context.Context, network, address string, bo wait.Bac
 }
 
 func newHTTPTransport(disableKeepAlives bool, maxIdle, maxIdlePerHost int) http.RoundTripper {
-	return &http.Transport{
-		// Those match net/http/transport.go
-		Proxy:                 http.ProxyFromEnvironment,
-		IdleConnTimeout:       90 * time.Second,
-		TLSHandshakeTimeout:   10 * time.Second,
-		ExpectContinueTimeout: 1 * time.Second,
-		DisableKeepAlives:     disableKeepAlives,
-
-		// Those are bespoke.
-		DialContext:         DialWithBackOff,
-		MaxIdleConns:        maxIdle,
-		MaxIdleConnsPerHost: maxIdlePerHost,
-	}
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.DialContext = DialWithBackOff
+	transport.DisableKeepAlives = disableKeepAlives
+	transport.MaxIdleConns = maxIdle
+	transport.MaxIdleConnsPerHost = maxIdlePerHost
+	transport.ForceAttemptHTTP2 = false
+	return transport
 }
 
 // NewProberTransport creates a RoundTripper that is useful for probing,
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 36ddc75ff..906ba91f1 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -975,7 +975,7 @@ k8s.io/utils/buffer
 k8s.io/utils/integer
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/test-infra v0.0.0-20200918021244-22269d552166
+# knative.dev/test-infra v0.0.0-20200921012245-37f1a12adbd3
 ## explicit
 knative.dev/test-infra/scripts
 # sigs.k8s.io/boskos v0.0.0-20200729174948-794df80db9c9
diff --git a/webhook/stats_reporter.go b/webhook/stats_reporter.go
index 13293200c..4c6d72134 100644
--- a/webhook/stats_reporter.go
+++ b/webhook/stats_reporter.go
@@ -55,7 +55,6 @@ var (
 	resourceGroupKey     = tag.MustNewKey("resource_group")
 	resourceVersionKey   = tag.MustNewKey("resource_version")
 	resourceResourceKey  = tag.MustNewKey("resource_resource")
-	resourceNameKey      = tag.MustNewKey("resource_name")
 	resourceNamespaceKey = tag.MustNewKey("resource_namespace")
 	admissionAllowedKey  = tag.MustNewKey("admission_allowed")
 )
@@ -93,7 +92,6 @@ func (r *reporter) ReportRequest(req *admissionv1.AdmissionRequest, resp *admiss
 		tag.Insert(resourceGroupKey, req.Resource.Group),
 		tag.Insert(resourceVersionKey, req.Resource.Version),
 		tag.Insert(resourceResourceKey, req.Resource.Resource),
-		tag.Insert(resourceNameKey, req.Name),
 		tag.Insert(resourceNamespaceKey, req.Namespace),
 		tag.Insert(admissionAllowedKey, strconv.FormatBool(resp.Allowed)),
 	)
@@ -117,7 +115,6 @@ func RegisterMetrics() {
 		resourceVersionKey,
 		resourceResourceKey,
 		resourceNamespaceKey,
-		resourceNameKey,
 		admissionAllowedKey}
 
 	if err := view.Register(
diff --git a/webhook/webhook.go b/webhook/webhook.go
index 8d628c5e3..c65c9f3c3 100644
--- a/webhook/webhook.go
+++ b/webhook/webhook.go
@@ -183,6 +183,7 @@ func (wh *Webhook) Run(stop <-chan struct{}) error {
 		Handler: drainer,
 		Addr:    fmt.Sprintf(":%d", wh.Options.Port),
 		TLSConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
 			GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
 				secret, err := wh.secretlister.Secrets(system.Namespace()).Get(wh.Options.SecretName)
 				if err != nil {


Test patch:
diff --git a/.github/workflows/knative-go-test.yaml b/.github/workflows/knative-go-test.yaml
index f8dcfd88d..bfe6c6ad2 100644
--- a/.github/workflows/knative-go-test.yaml
+++ b/.github/workflows/knative-go-test.yaml
@@ -31,7 +31,7 @@ jobs:
     name: Unit Tests
     strategy:
       matrix:
-        go-version: [1.14.x]
+        go-version: [1.15.x]
         platform: [ubuntu-latest]
 
     runs-on: ${{ matrix.platform }}
diff --git a/vendor/knative.dev/test-infra/scripts/library.sh b/vendor/knative.dev/test-infra/scripts/library.sh
index e7ecbc9be..ab9f303fe 100644
--- a/vendor/knative.dev/test-infra/scripts/library.sh
+++ b/vendor/knative.dev/test-infra/scripts/library.sh
@@ -127,13 +127,50 @@ function wait_until_object_does_not_exist() {
 # Waits until all pods are running in the given namespace.
 # Parameters: $1 - namespace.
 function wait_until_pods_running() {
-  echo "Waiting until all pods in namespace $1 are up"
-  kubectl wait pod --for=condition=Ready -n "$1" -l '!job-name' --timeout=5m || return 1
-  # Also wait for all the job pods to be completed.
-  # This is mainly for maintaining backward compatibility.
-  if [[ $(kubectl get jobs --ignore-not-found=true -n "$1") ]]; then
-    kubectl wait job --for=condition=Complete --all -n "$1" --timeout=5m || return 1
+  echo -n "Waiting until all pods in namespace $1 are up"
+  local failed_pod=""
+  for i in {1..150}; do  # timeout after 5 minutes
+    # List all pods. Ignore Terminating pods as those have either been replaced through
+    # a deployment or terminated on purpose (through chaosduck for example).
+    local pods="$(kubectl get pods --no-headers -n $1 2>/dev/null | grep -v Terminating)"
+    # All pods must be running (ignore ImagePull error to allow the pod to retry)
+    local not_running_pods=$(echo "${pods}" | grep -v Running | grep -v Completed | grep -v ErrImagePull | grep -v ImagePullBackOff)
+    if [[ -n "${pods}" ]] && [[ -z "${not_running_pods}" ]]; then
+      # All Pods are running or completed. Verify the containers on each Pod.
+      local all_ready=1
+      while read pod ; do
+        local status=(`echo -n ${pod} | cut -f2 -d' ' | tr '/' ' '`)
+        # Set this Pod as the failed_pod. If nothing is wrong with it, then after the checks, set
+        # failed_pod to the empty string.
+        failed_pod=$(echo -n "${pod}" | cut -f1 -d' ')
+        # All containers must be ready
+        [[ -z ${status[0]} ]] && all_ready=0 && break
+        [[ -z ${status[1]} ]] && all_ready=0 && break
+        [[ ${status[0]} -lt 1 ]] && all_ready=0 && break
+        [[ ${status[1]} -lt 1 ]] && all_ready=0 && break
+        [[ ${status[0]} -ne ${status[1]} ]] && all_ready=0 && break
+        # All the tests passed, this is not a failed pod.
+        failed_pod=""
+      done <<< "$(echo "${pods}" | grep -v Completed)"
+      if (( all_ready )); then
+        echo -e "\nAll pods are up:\n${pods}"
+        return 0
+      fi
+    elif [[ -n "${not_running_pods}" ]]; then
+      # At least one Pod is not running, just save the first one's name as the failed_pod.
+      failed_pod="$(echo "${not_running_pods}" | head -n 1 | cut -f1 -d' ')"
+    fi
+    echo -n "."
+    sleep 2
+  done
+  echo -e "\n\nERROR: timeout waiting for pods to come up\n${pods}"
+  if [[ -n "${failed_pod}" ]]; then
+    echo -e "\n\nFailed Pod (data in YAML format) - ${failed_pod}\n"
+    kubectl -n $1 get pods "${failed_pod}" -oyaml
+    echo -e "\n\nPod Logs\n"
+    kubectl -n $1 logs "${failed_pod}" --all-containers
   fi
+  return 1
 }
 
 # Waits until all batch jobs complete in the given namespace.
diff --git a/webhook/stats_reporter_test.go b/webhook/stats_reporter_test.go
index 94b1cc47c..755c14cfb 100644
--- a/webhook/stats_reporter_test.go
+++ b/webhook/stats_reporter_test.go
@@ -54,7 +54,6 @@ func TestWebhookStatsReporter(t *testing.T) {
 		resourceGroupKey.Name():     req.Resource.Group,
 		resourceVersionKey.Name():   req.Resource.Version,
 		resourceResourceKey.Name():  req.Resource.Resource,
-		resourceNameKey.Name():      req.Name,
 		resourceNamespaceKey.Name(): req.Namespace,
 		admissionAllowedKey.Name():  strconv.FormatBool(resp.Allowed),
 	}