Repository: knative/serving
Pull request #12286 (2021-11-16 12:20:21)

Hpa stabilization window
The default stabilization window for HPA is 300s and can be set to different values. The meaning of this window is very similar to the KPA window, so we can use the same annotation.

<!-- Please include the 'why' behind your changes if no issue exists -->
## Proposed Changes

* Set HPA stabilization window from autoscaling window annotation


**Release Note**

<!-- Enter your extended release note in the below block. If the PR requires
additional action from users switching to the new release, include the string
"action required". If no release note is required, write "NONE". -->

```release-note
HPA autoscaler stabilization window can be set from autoscaling window annotation
```


knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/12286#" title="Author self-approved">enoodle</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **vagababov** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @vagababov` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[pkg/apis/autoscaling/OWNERS](https://github.com/knative/serving/blob/main/pkg/apis/autoscaling/OWNERS)**
- **[pkg/reconciler/autoscaling/OWNERS](https://github.com/knative/serving/blob/main/pkg/reconciler/autoscaling/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["vagababov"]} -->
knative-prow-robot: Hi @enoodle. Thanks for your PR.

I'm waiting for a [knative](https://github.com/orgs/knative/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://github.com/orgs/knative/people) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

markusthoemmes: /ok-to-test

Thanks for breaking these up!
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
> Merging [#12286](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (381f1de) into [main](https://codecov.io/gh/knative/serving/commit/532231b6e78433021eef6bb4a2390d94c5465ca9?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (532231b) will **decrease** coverage by `0.03%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/12286/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)

```diff
@@            Coverage Diff             @@
##             main   #12286      +/-   ##
==========================================
- Coverage   87.33%   87.30%   -0.04%     
==========================================
  Files         195      195              
  Lines        9610     9616       +6     
==========================================
+ Hits         8393     8395       +2     
- Misses        937      940       +3     
- Partials      280      281       +1     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | Coverage Δ | |
|---|---|---|
| [pkg/apis/autoscaling/annotation\_validation.go](https://codecov.io/gh/knative/serving/pull/12286/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2FwaXMvYXV0b3NjYWxpbmcvYW5ub3RhdGlvbl92YWxpZGF0aW9uLmdv) | `100.00% <ø> (ø)` | |
| [pkg/reconciler/autoscaling/hpa/resources/hpa.go](https://codecov.io/gh/knative/serving/pull/12286/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcvaHBhL3Jlc291cmNlcy9ocGEuZ28=) | `100.00% <100.00%> (ø)` | |
| [pkg/autoscaler/scaling/multiscaler.go](https://codecov.io/gh/knative/serving/pull/12286/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL2F1dG9zY2FsZXIvc2NhbGluZy9tdWx0aXNjYWxlci5nbw==) | `87.27% <0.00%> (-1.82%)` | :arrow_down: |
| [pkg/reconciler/configuration/configuration.go](https://codecov.io/gh/knative/serving/pull/12286/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-cGtnL3JlY29uY2lsZXIvY29uZmlndXJhdGlvbi9jb25maWd1cmF0aW9uLmdv) | `84.61% <0.00%> (-1.54%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Last update [532231b...381f1de](https://codecov.io/gh/knative/serving/pull/12286?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).


Patch:
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index f7c82a9b7..b3468af10 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -5,6 +5,7 @@ aliases:
   api-core-wg-leads:
   - dprotaso
   autoscaling-reviewers:
+  - nader-ziada
   - psschwei
   - taragu
   autoscaling-wg-leads:
@@ -39,11 +40,16 @@ aliases:
   - omerbensaadon
   - pmbanugo
   - snneji
-  docs-wg-leads: []
+  docs-wg-leads:
+  - csantanapr
+  - omerbensaadon
+  - snneji
   docs-writers:
   - RichardJJG
   - abrennan89
   - carieshmarie
+  - csantanapr
+  - omerbensaadon
   - richieescarez
   - snneji
   eventing-reviewers:
@@ -81,7 +87,6 @@ aliases:
   - matzew
   - mbehrendt
   - nak3
-  - omerbensaadon
   - pmorie
   - rhuss
   - spencerdillard
@@ -182,6 +187,7 @@ aliases:
   serving-reviewers:
   - carlisia
   - julz
+  - nader-ziada
   - nealhu
   - psschwei
   - whaught
@@ -207,11 +213,13 @@ aliases:
   - rhuss
   trademark-committee:
   - duglin
-  - omerbensaadon
+  - evankanderson
   - spencerdillard
   ux-wg-leads:
   - csantanapr
   - omerbensaadon
+  - snneji
   ux-writers:
   - csantanapr
   - omerbensaadon
+  - snneji
diff --git a/cmd/queue/main.go b/cmd/queue/main.go
index 6494d4d20..cf6ddaec0 100644
--- a/cmd/queue/main.go
+++ b/cmd/queue/main.go
@@ -64,11 +64,6 @@ const (
 	drainSleepDuration = 30 * time.Second
 )
 
-var (
-	// This creates an abstract socket instead of an actual file.
-	unixSocketPath = "@/knative.dev/serving/queue.sock"
-)
-
 type config struct {
 	ContainerConcurrency     int    `split_words:"true" required:"true"`
 	QueueServingPort         string `split_words:"true" required:"true"`
@@ -162,15 +157,10 @@ func main() {
 		probe = buildProbe(logger, env.ServingReadinessProbe, env.EnableHTTP2AutoDetection).ProbeContainer
 	}
 
-	drainer := &pkghandler.Drainer{
-		QuietPeriod: drainSleepDuration,
-		// Add Activator probe header to the drainer so it can handle probes directly from activator
-		HealthCheckUAPrefixes: []string{network.ActivatorUserAgent},
-	}
-	mainServer := buildServer(ctx, env, drainer, probe, stats, logger)
+	mainServer, drain := buildServer(ctx, env, probe, stats, logger)
 	servers := map[string]*http.Server{
 		"main":    mainServer,
-		"admin":   buildAdminServer(logger, drainer),
+		"admin":   buildAdminServer(logger, drain),
 		"metrics": buildMetricsServer(promStatReporter, protoStatReporter),
 	}
 	if env.EnableProfiling {
@@ -178,46 +168,15 @@ func main() {
 	}
 
 	errCh := make(chan error)
-	listenCh := make(chan struct{})
 	for name, server := range servers {
 		go func(name string, s *http.Server) {
-			l, err := net.Listen("tcp", s.Addr)
-			if err != nil {
-				errCh <- fmt.Errorf("%s server failed to listen: %w", name, err)
-				return
-			}
-
-			// Notify the unix socket setup that the tcp socket for the main server is ready.
-			if s == mainServer {
-				close(listenCh)
-			}
-
 			// Don't forward ErrServerClosed as that indicates we're already shutting down.
-			if err := s.Serve(l); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			if err := s.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 				errCh <- fmt.Errorf("%s server failed to serve: %w", name, err)
 			}
 		}(name, server)
 	}
 
-	// Listen on a unix socket so that the exec probe can avoid having to go
-	// through the full tcp network stack.
-	go func() {
-		// Only start listening on the unix socket once the tcp socket for the
-		// main server is setup.
-		// This avoids the unix socket path succeeding before the tcp socket path
-		// is actually working and thus it avoids a race.
-		<-listenCh
-
-		l, err := net.Listen("unix", unixSocketPath)
-		if err != nil {
-			errCh <- fmt.Errorf("failed to listen to unix socket: %w", err)
-			return
-		}
-		if err := http.Serve(l, mainServer.Handler); err != nil {
-			errCh <- fmt.Errorf("serving failed on unix socket: %w", err)
-		}
-	}()
-
 	// Blocks until we actually receive a TERM signal or one of the servers
 	// exits unexpectedly. We fold both signals together because we only want
 	// to act on the first of those to reach here.
@@ -230,7 +189,7 @@ func main() {
 	case <-ctx.Done():
 		logger.Info("Received TERM signal, attempting to gracefully shutdown servers.")
 		logger.Infof("Sleeping %v to allow K8s propagation of non-ready state", drainSleepDuration)
-		drainer.Drain()
+		drain()
 
 		// Removing the main server from the shutdown logic as we've already shut it down.
 		delete(servers, "main")
@@ -256,9 +215,7 @@ func buildProbe(logger *zap.SugaredLogger, encodedProbe string, autodetectHTTP2
 	return readiness.NewProbe(coreProbe)
 }
 
-func buildServer(ctx context.Context, env config, drainer *pkghandler.Drainer, probeContainer func() bool, stats *network.RequestStats,
-	logger *zap.SugaredLogger) *http.Server {
-
+func buildServer(ctx context.Context, env config, probeContainer func() bool, stats *network.RequestStats, logger *zap.SugaredLogger) (server *http.Server, drain func()) {
 	maxIdleConns := 1000 // TODO: somewhat arbitrary value for CC=0, needs experimental validation.
 	if env.ContainerConcurrency > 0 {
 		maxIdleConns = env.ContainerConcurrency
@@ -293,10 +250,7 @@ func buildServer(ctx context.Context, env config, drainer *pkghandler.Drainer, p
 		}()
 		composedHandler = queue.ConcurrencyStateHandler(logger, composedHandler, ce.Pause, ce.Resume)
 		// start paused
-		if err := ce.Pause(); err != nil {
-			logger.Errorf("Error handling initial pause request: %v", err)
-			queue.HandleStateRequestError(logger, ce.Pause)
-		}
+		ce.Pause(logger)
 	}
 	if metricsSupported {
 		composedHandler = requestAppMetricsHandler(logger, composedHandler, breaker, env)
@@ -311,22 +265,23 @@ func buildServer(ctx context.Context, env config, drainer *pkghandler.Drainer, p
 	if tracingEnabled {
 		composedHandler = tracing.HTTPSpanMiddleware(composedHandler)
 	}
-	if env.ServingEnableRequestLog {
-		composedHandler = requestLogHandler(logger, composedHandler, env)
+
+	drainer := &pkghandler.Drainer{
+		QuietPeriod: drainSleepDuration,
+		// Add Activator probe header to the drainer so it can handle probes directly from activator
+		HealthCheckUAPrefixes: []string{network.ActivatorUserAgent},
+		Inner:                 composedHandler,
+		HealthCheck:           health.ProbeHandler(probeContainer, tracingEnabled),
 	}
+	composedHandler = drainer
 
-	var healthcheckHandler http.Handler
-	healthcheckHandler = health.ProbeHandler(probeContainer, tracingEnabled, healthcheckHandler)
-	// We want to capture the probes/healthchecks in the request logs.
-	// Hence we need to have RequestLogHandler to be the first one.
 	if env.ServingEnableRequestLog {
-		healthcheckHandler = requestLogHandler(logger, healthcheckHandler, env)
+		// We want to capture the probes/healthchecks in the request logs.
+		// Hence we need to have RequestLogHandler be the first one.
+		composedHandler = requestLogHandler(logger, composedHandler, env)
 	}
 
-	drainer.Inner = composedHandler
-	drainer.HealthCheck = healthcheckHandler.ServeHTTP
-
-	return pkgnet.NewServer(":"+env.QueueServingPort, drainer)
+	return pkgnet.NewServer(":"+env.QueueServingPort, composedHandler), drainer.Drain
 }
 
 func buildTransport(env config, logger *zap.SugaredLogger, maxConns int) http.RoundTripper {
@@ -382,11 +337,11 @@ func supportsMetrics(ctx context.Context, logger *zap.SugaredLogger, env config)
 	return true
 }
 
-func buildAdminServer(logger *zap.SugaredLogger, drainer *pkghandler.Drainer) *http.Server {
+func buildAdminServer(logger *zap.SugaredLogger, drain func()) *http.Server {
 	adminMux := http.NewServeMux()
 	adminMux.HandleFunc(queue.RequestQueueDrainPath, func(w http.ResponseWriter, r *http.Request) {
 		logger.Info("Attached drain handler from user-container")
-		drainer.Drain()
+		drain()
 	})
 
 	return &http.Server{
diff --git a/config/core/configmaps/autoscaler.yaml b/config/core/configmaps/autoscaler.yaml
index 3fc53df28..620bcaa26 100644
--- a/config/core/configmaps/autoscaler.yaml
+++ b/config/core/configmaps/autoscaler.yaml
@@ -23,7 +23,7 @@ metadata:
     app.kubernetes.io/version: devel
     serving.knative.dev/release: devel
   annotations:
-    knative.dev/example-checksum: "604cb513"
+    knative.dev/example-checksum: "b4401cf4"
 data:
   _example: |
     ################################
@@ -187,6 +187,10 @@ data:
     # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0.
     allow-zero-initial-scale: "false"
 
+    # min-scale is the cluster-wide default value for the min scale of a revision,
+    # unless overridden by the "autoscaling.knative.dev/minScale" annotation.
+    min-scale: "0"
+
     # max-scale is the cluster-wide default value for the max scale of a revision,
     # unless overridden by the "autoscaling.knative.dev/maxScale" annotation.
     # If set to 0, the revision has no maximum scale.
diff --git a/go.mod b/go.mod
index 821465a91..d7ad343ad 100644
--- a/go.mod
+++ b/go.mod
@@ -43,9 +43,9 @@ require (
 	k8s.io/code-generator v0.21.4
 	k8s.io/kube-openapi v0.0.0-20210305001622-591a79e4bda7
 	k8s.io/utils v0.0.0-20210111153108-fddb29f9d009 // indirect
-	knative.dev/caching v0.0.0-20211111075937-0c3d96f98a71
-	knative.dev/hack v0.0.0-20211112192837-128cf0150a69
-	knative.dev/networking v0.0.0-20211111131538-526348e63718
-	knative.dev/pkg v0.0.0-20211111114938-0b0c3390a475
+	knative.dev/caching v0.0.0-20211118070729-77b107b17fef
+	knative.dev/hack v0.0.0-20211117134436-69a2295d54ce
+	knative.dev/networking v0.0.0-20211119210323-bab26a807fa3
+	knative.dev/pkg v0.0.0-20211120133512-d016976f2567
 	sigs.k8s.io/yaml v1.3.0
 )
diff --git a/go.sum b/go.sum
index 1850daa1c..9c9f7d164 100644
--- a/go.sum
+++ b/go.sum
@@ -1604,17 +1604,16 @@ k8s.io/legacy-cloud-providers v0.21.0/go.mod h1:bNxo7gDg+PGkBmT/MFZswLTWdSWK9kAl
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20210111153108-fddb29f9d009 h1:0T5IaWHO3sJTEmCP6mUlBvMukxPKUQWqiI/YuiBNMiQ=
 k8s.io/utils v0.0.0-20210111153108-fddb29f9d009/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/caching v0.0.0-20211111075937-0c3d96f98a71 h1:hvaFy6/ePirqFXWG7x/t4UU8tcHGyAgcRkFS3YiiAA8=
-knative.dev/caching v0.0.0-20211111075937-0c3d96f98a71/go.mod h1:B1UvFZohVEmH+Fruuimvj5uJZcGde8F5ZhtYapFnyVg=
-knative.dev/hack v0.0.0-20211105231158-29f86c2653b5/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/hack v0.0.0-20211108170701-96aac1c30be3/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/hack v0.0.0-20211112192837-128cf0150a69 h1:/3NW6B9VeqAwpW0ZAS+8xLfwgVMIqH+CPmesDATovhk=
+knative.dev/caching v0.0.0-20211118070729-77b107b17fef h1:Jp7UTD+f0zz2Gzqnem+U0PVLiVXxgrRQL1FJwBAA1xI=
+knative.dev/caching v0.0.0-20211118070729-77b107b17fef/go.mod h1:X+9PhcWYdvl0pdZ/cJpiXIERNNCS2CLSk8r2bJAsle4=
 knative.dev/hack v0.0.0-20211112192837-128cf0150a69/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20211111131538-526348e63718 h1:65k2eGsGgUbAoogb4y5c156OD+vJ5ak8Abp1m8MTdq0=
-knative.dev/networking v0.0.0-20211111131538-526348e63718/go.mod h1:XskFTw7FTMeGwD60lrTT+P3BNp59fJxLS0019WNHq9o=
-knative.dev/pkg v0.0.0-20211108064904-3cc697a3cb09/go.mod h1:YiSfFDMdYHZTuO5XS8UzxSeOEmocy+Kb2YOGik9C8lw=
-knative.dev/pkg v0.0.0-20211111114938-0b0c3390a475 h1:BoZ88UHlgwRiGkkz7MQtoSlQyBRQxfu1ROOpUNDG3bU=
-knative.dev/pkg v0.0.0-20211111114938-0b0c3390a475/go.mod h1:plYIuKk6WNC9LyiG/9xBnOBYuxO0Ro6xN0z7iXWVUtk=
+knative.dev/hack v0.0.0-20211117134436-69a2295d54ce h1:dPARWsX/9nmWg9g09MtGnsn7nZUwjA0UWpKSUozgS6g=
+knative.dev/hack v0.0.0-20211117134436-69a2295d54ce/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
+knative.dev/networking v0.0.0-20211119210323-bab26a807fa3 h1:gSLMDkmk6qi3vdE/4hVHNAOld0B3YTglxjhvkqzZfmM=
+knative.dev/networking v0.0.0-20211119210323-bab26a807fa3/go.mod h1:z4CZcjF4UrkUL0ULxAbXpjNlfYJYADCOFaO6+pK4L/I=
+knative.dev/pkg v0.0.0-20211117215328-5708c4c44232/go.mod h1:VqUp1KWJqpTDNoiSI/heaX3uMdubImslJE2tBkP+Bbw=
+knative.dev/pkg v0.0.0-20211120133512-d016976f2567 h1:IPQ6QKOvMIRX9/UI1cAtSl36+CbGv8HErSvID03CRr4=
+knative.dev/pkg v0.0.0-20211120133512-d016976f2567/go.mod h1:VqUp1KWJqpTDNoiSI/heaX3uMdubImslJE2tBkP+Bbw=
 pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/pkg/apis/autoscaling/annotation_validation.go b/pkg/apis/autoscaling/annotation_validation.go
index aebcf0547..16881fae7 100644
--- a/pkg/apis/autoscaling/annotation_validation.go
+++ b/pkg/apis/autoscaling/annotation_validation.go
@@ -158,10 +158,6 @@ func validateLastPodRetention(annotations map[string]string) *apis.FieldError {
 
 func validateWindow(annotations map[string]string) *apis.FieldError {
 	if w, ok := annotations[WindowAnnotationKey]; ok {
-		if annotations[ClassAnnotationKey] == HPA && (annotations[MetricAnnotationKey] == CPU || annotations[MetricAnnotationKey] == Memory) {
-			return apis.ErrInvalidKeyName(WindowAnnotationKey, apis.CurrentField, fmt.Sprintf("%s for %s %s", HPA,
-				MetricAnnotationKey, annotations[MetricAnnotationKey]))
-		}
 		switch d, err := time.ParseDuration(w); {
 		case err != nil:
 			return apis.ErrInvalidValue(w, WindowAnnotationKey)
diff --git a/pkg/apis/autoscaling/v1alpha1/pa_lifecycle.go b/pkg/apis/autoscaling/v1alpha1/pa_lifecycle.go
index e2fee67ff..2318a5f36 100644
--- a/pkg/apis/autoscaling/v1alpha1/pa_lifecycle.go
+++ b/pkg/apis/autoscaling/v1alpha1/pa_lifecycle.go
@@ -86,7 +86,10 @@ func (pa *PodAutoscaler) annotationFloat64(key string) (float64, bool) {
 func (pa *PodAutoscaler) ScaleBounds(asConfig *autoscalerconfig.Config) (int32, int32) {
 	var min int32
 	if pa.Spec.Reachability != ReachabilityUnreachable {
-		min, _ = pa.annotationInt32(autoscaling.MinScaleAnnotationKey)
+		min = asConfig.MinScale
+		if paMin, ok := pa.annotationInt32(autoscaling.MinScaleAnnotationKey); ok {
+			min = paMin
+		}
 	}
 
 	max := asConfig.MaxScale
diff --git a/pkg/autoscaler/config/autoscalerconfig/autoscalerconfig.go b/pkg/autoscaler/config/autoscalerconfig/autoscalerconfig.go
index 6ab3b8508..cd3788d88 100644
--- a/pkg/autoscaler/config/autoscalerconfig/autoscalerconfig.go
+++ b/pkg/autoscaler/config/autoscalerconfig/autoscalerconfig.go
@@ -50,6 +50,10 @@ type Config struct {
 	// services. This can be set to 0 iff AllowZeroInitialScale is true.
 	InitialScale int32
 
+	// MinScale is the default min scale for any revision created without an
+	// autoscaling.knative.dev/minScale annotation
+	MinScale int32
+
 	// MaxScale is the default max scale for any revision created without an
 	// autoscaling.knative.dev/maxScale annotation
 	MaxScale int32
diff --git a/pkg/autoscaler/config/config.go b/pkg/autoscaler/config/config.go
index e4f1d8541..b3eff7b2e 100644
--- a/pkg/autoscaler/config/config.go
+++ b/pkg/autoscaler/config/config.go
@@ -60,6 +60,7 @@ func defaultConfig() *autoscalerconfig.Config {
 		PodAutoscalerClass:            autoscaling.KPA,
 		AllowZeroInitialScale:         false,
 		InitialScale:                  1,
+		MinScale:                      0,
 		MaxScale:                      0,
 		MaxScaleLimit:                 0,
 	}
@@ -86,6 +87,7 @@ func NewConfigFromMap(data map[string]string) (*autoscalerconfig.Config, error)
 		cm.AsFloat64("panic-threshold-percentage", &lc.PanicThresholdPercentage),
 
 		cm.AsInt32("initial-scale", &lc.InitialScale),
+		cm.AsInt32("min-scale", &lc.MinScale),
 		cm.AsInt32("max-scale", &lc.MaxScale),
 		cm.AsInt32("max-scale-limit", &lc.MaxScaleLimit),
 
@@ -176,6 +178,10 @@ func validate(lc *autoscalerconfig.Config) (*autoscalerconfig.Config, error) {
 		return nil, fmt.Errorf("initial-scale = %v, must be at least 0 (or at least 1 when allow-zero-initial-scale is false)", lc.InitialScale)
 	}
 
+	if lc.MinScale < 0 {
+		return nil, fmt.Errorf("min-scale = %v, must be at least 0", lc.MinScale)
+	}
+
 	var minMaxScale int32
 	if lc.MaxScaleLimit > 0 {
 		// Default maxScale must be set if maxScaleLimit is set.
@@ -191,6 +197,10 @@ func validate(lc *autoscalerconfig.Config) (*autoscalerconfig.Config, error) {
 		return nil, fmt.Errorf("max-scale-limit = %v, must be at least 0", lc.MaxScaleLimit)
 	}
 
+	if lc.MinScale > lc.MaxScale && lc.MaxScale > 0 {
+		return nil, fmt.Errorf("min-scale (%d) must be less than max-scale (%d)", lc.MinScale, lc.MaxScale)
+	}
+
 	return lc, nil
 }
 
diff --git a/pkg/queue/concurrency_state.go b/pkg/queue/concurrency_state.go
index 7d0ba09a6..82a447d28 100644
--- a/pkg/queue/concurrency_state.go
+++ b/pkg/queue/concurrency_state.go
@@ -35,7 +35,7 @@ import (
 // runs the `resume` function. If either of `pause` or `resume` are not passed, it runs
 // the respective local function(s). The local functions are the expected behavior; the
 // function parameters are enabled primarily for testing purposes.
-func ConcurrencyStateHandler(logger *zap.SugaredLogger, h http.Handler, pause, resume func() error) http.HandlerFunc {
+func ConcurrencyStateHandler(logger *zap.SugaredLogger, h http.Handler, pause, resume func(*zap.SugaredLogger)) http.HandlerFunc {
 
 	var (
 		inFlight = atomic.NewInt64(0)
@@ -51,11 +51,8 @@ func ConcurrencyStateHandler(logger *zap.SugaredLogger, h http.Handler, pause, r
 				// We need to doublecheck this since another request can have reached the
 				// handler meanwhile. We don't want to do anything in that case.
 				if !paused && inFlight.Load() == 0 {
-					logger.Info("Requests dropped to zero")
-					if err := pause(); err != nil {
-						logger.Errorf("Error handling resume request: %v", err)
-						HandleStateRequestError(logger, pause)
-					}
+					logger.Debug("Requests dropped to zero")
+					pause(logger)
 					paused = true
 					logger.Debug("To-Zero request successfully processed")
 				}
@@ -80,11 +77,8 @@ func ConcurrencyStateHandler(logger *zap.SugaredLogger, h http.Handler, pause, r
 			return
 		}
 
-		logger.Info("Requests increased from zero")
-		if err := resume(); err != nil {
-			logger.Errorf("Error handling resume request: %v", err)
-			HandleStateRequestError(logger, resume)
-		}
+		logger.Debug("Requests increased from zero")
+		resume(logger)
 		paused = false
 		logger.Debug("From-Zero request successfully processed")
 		mux.Unlock()
@@ -93,15 +87,19 @@ func ConcurrencyStateHandler(logger *zap.SugaredLogger, h http.Handler, pause, r
 	}
 }
 
-// HandleStateRequestError handles retry logic
-func HandleStateRequestError(logger *zap.SugaredLogger, requestHandler func() error) {
+// retryRequest takes a request function and repeatedly tries it for a specified period
+// of time or until successful. If the request ultimately fails, it kills the container.
+func retryRequest(logger *zap.SugaredLogger, requestHandler func(string) error, request string) {
 	var errReq error
 	retryFunc := func() (bool, error) {
-		errReq = requestHandler()
+		errReq = requestHandler(request)
+		if errReq != nil {
+			logger.Errorw(fmt.Sprintf("%s request failed", request), zap.Error(errReq))
+		}
 		return errReq == nil, nil
 	}
-	if err := wait.Poll(time.Millisecond*200, 15*time.Minute, retryFunc); err != nil {
-		logger.Fatalf("Retry pause/resume request failed: %v", errReq)
+	if err := wait.PollImmediate(time.Millisecond*200, 15*time.Minute, retryFunc); err != nil {
+		logger.Fatalw(fmt.Sprintf("%s request failed", request), zap.Error(err))
 		os.Exit(1)
 	}
 }
@@ -112,7 +110,7 @@ type ConcurrencyEndpoint struct {
 	token     atomic.Value
 }
 
-func NewConcurrencyEndpoint(e, m string) ConcurrencyEndpoint {
+func NewConcurrencyEndpoint(e, m string) *ConcurrencyEndpoint {
 	c := ConcurrencyEndpoint{
 		endpoint: os.Expand(e, func(s string) string {
 			if s == "HOST_IP" {
@@ -123,14 +121,22 @@ func NewConcurrencyEndpoint(e, m string) ConcurrencyEndpoint {
 		mountPath: m,
 	}
 	c.RefreshToken()
-	return c
+	return &c
 }
 
-func (c ConcurrencyEndpoint) Pause() error { return c.Request("pause") }
+// Pause freezes a container, retrying until either successful or a timeout is
+// reached, at which point the container is killed
+func (c *ConcurrencyEndpoint) Pause(logger *zap.SugaredLogger) {
+	retryRequest(logger, c.Request, "pause")
+}
 
-func (c ConcurrencyEndpoint) Resume() error { return c.Request("resume") }
+// Resume thaws a container, retrying until either successful or a timeout is
+// reached, at which point the container is killed
+func (c *ConcurrencyEndpoint) Resume(logger *zap.SugaredLogger) {
+	retryRequest(logger, c.Request, "resume")
+}
 
-func (c ConcurrencyEndpoint) Request(action string) error {
+func (c *ConcurrencyEndpoint) Request(action string) error {
 	bodyText := fmt.Sprintf(`{ "action": %q }`, action)
 	body := bytes.NewBufferString(bodyText)
 	req, err := http.NewRequest(http.MethodPost, c.endpoint, body)
diff --git a/pkg/queue/health/handler.go b/pkg/queue/health/handler.go
index 2cab6718b..3ad393797 100644
--- a/pkg/queue/health/handler.go
+++ b/pkg/queue/health/handler.go
@@ -28,17 +28,12 @@ import (
 
 const badProbeTemplate = "unexpected probe header value: "
 
-// ProbeHandler returns a http.HandlerFunc that responds to health checks if the
-// knative network probe header is passed, and otherwise delegates to the next handler.
-func ProbeHandler(prober func() bool, tracingEnabled bool, next http.Handler) http.HandlerFunc {
+// ProbeHandler returns a http.HandlerFunc that responds to health checks.
+// This handler assumes the Knative Probe Header will be passed.
+func ProbeHandler(prober func() bool, tracingEnabled bool) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ph := network.KnativeProbeHeader(r)
 
-		if ph == "" {
-			next.ServeHTTP(w, r)
-			return
-		}
-
 		var probeSpan *trace.Span
 		if tracingEnabled {
 			_, probeSpan = trace.StartSpan(r.Context(), "probe")
diff --git a/pkg/reconciler/autoscaling/hpa/resources/hpa.go b/pkg/reconciler/autoscaling/hpa/resources/hpa.go
index a0cf0fa11..6caeb5cba 100644
--- a/pkg/reconciler/autoscaling/hpa/resources/hpa.go
+++ b/pkg/reconciler/autoscaling/hpa/resources/hpa.go
@@ -88,5 +88,17 @@ func MakeHPA(pa *autoscalingv1alpha1.PodAutoscaler, config *autoscalerconfig.Con
 		}
 	}
 
+	if window, hasWindow := pa.Window(); hasWindow {
+		windowSeconds := int32(window.Seconds())
+		hpa.Spec.Behavior = &autoscalingv2beta2.HorizontalPodAutoscalerBehavior{
+			ScaleDown: &autoscalingv2beta2.HPAScalingRules{
+				StabilizationWindowSeconds: &windowSeconds,
+			},
+			ScaleUp: &autoscalingv2beta2.HPAScalingRules{
+				StabilizationWindowSeconds: &windowSeconds,
+			},
+		}
+	}
+
 	return hpa
 }
diff --git a/pkg/reconciler/domainmapping/reconciler.go b/pkg/reconciler/domainmapping/reconciler.go
index 67d2971d6..8708358e9 100644
--- a/pkg/reconciler/domainmapping/reconciler.go
+++ b/pkg/reconciler/domainmapping/reconciler.go
@@ -99,7 +99,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, dm *v1alpha1.DomainMappi
 	dm.Status.Address = &duckv1.Addressable{URL: url}
 
 	// IngressClass can be set via annotations or in the config map.
-	ingressClass := dm.Annotations[networking.IngressClassAnnotationKey]
+	ingressClass := networking.GetIngressClass(dm.Annotations)
 	if ingressClass == "" {
 		ingressClass = config.FromContext(ctx).Network.DefaultIngressClass
 	}
@@ -181,7 +181,7 @@ func autoTLSEnabled(ctx context.Context, dm *v1alpha1.DomainMapping) bool {
 	if !config.FromContext(ctx).Network.AutoTLS {
 		return false
 	}
-	annotationValue := dm.Annotations[networking.DisableAutoTLSAnnotationKey]
+	annotationValue := networking.GetDisableAutoTLS(dm.Annotations)
 	disabledByAnnotation, err := strconv.ParseBool(annotationValue)
 	if annotationValue != "" && err != nil {
 		logger := logging.FromContext(ctx)
diff --git a/pkg/reconciler/nscert/nscert.go b/pkg/reconciler/nscert/nscert.go
index e1644deac..6f4d13c7a 100644
--- a/pkg/reconciler/nscert/nscert.go
+++ b/pkg/reconciler/nscert/nscert.go
@@ -56,7 +56,7 @@ var _ namespacereconciler.Interface = (*reconciler)(nil)
 var domainTemplateRegex = regexp.MustCompile(`^\*\..+$`)
 
 func certClass(ctx context.Context, r *corev1.Namespace) string {
-	if class := r.Annotations[networking.CertificateClassAnnotationKey]; class != "" {
+	if class := networking.GetCertificateClass(r.Annotations); class != "" {
 		return class
 	}
 	return config.FromContext(ctx).Network.DefaultCertificateClass
diff --git a/pkg/reconciler/revision/resources/queue.go b/pkg/reconciler/revision/resources/queue.go
index b2b58381a..669a57fc6 100644
--- a/pkg/reconciler/revision/resources/queue.go
+++ b/pkg/reconciler/revision/resources/queue.go
@@ -208,10 +208,10 @@ func makeQueueContainer(rev *v1.Revision, cfg *config.Config) (*corev1.Container
 	var httpProbe, execProbe *corev1.Probe
 	var userProbeJSON string
 	if container.ReadinessProbe != nil {
-		// During startup we want to poll the container faster than Kubernetes will
-		// allow, so we use an ExecProbe which starts immediately and then polls
-		// every 25ms. We encode the original probe as JSON in an environment
-		// variable for this probe to use.
+		// The activator attempts to detect readiness itself by checking the Queue
+		// Proxy's health endpoint rather than waiting for Kubernetes to check and
+		// propagate the Ready state. We encode the original probe as JSON in an
+		// environment variable for this health endpoint to use.
 		userProbe := container.ReadinessProbe.DeepCopy()
 		applyReadinessProbeDefaultsForExec(userProbe, userPort)
 
diff --git a/pkg/reconciler/route/resources/ingress.go b/pkg/reconciler/route/resources/ingress.go
index e081b3f69..a17f56a41 100644
--- a/pkg/reconciler/route/resources/ingress.go
+++ b/pkg/reconciler/route/resources/ingress.go
@@ -195,7 +195,7 @@ func makeIngressSpec(
 		}
 	}
 
-	httpOption, err := getHTTPOption(ctx, r.Annotations)
+	httpProtocol, err := getHTTPProtocol(ctx, r.Annotations)
 	if err != nil {
 		return netv1alpha1.IngressSpec{}, err
 	}
@@ -203,20 +203,20 @@ func makeIngressSpec(
 	return netv1alpha1.IngressSpec{
 		Rules:      rules,
 		TLS:        tls,
-		HTTPOption: httpOption,
+		HTTPOption: httpProtocol,
 	}, nil
 }
 
-func getHTTPOption(ctx context.Context, annotations map[string]string) (netv1alpha1.HTTPOption, error) {
-	if len(annotations) != 0 && annotations[networking.HTTPOptionAnnotationKey] != "" {
-		annotation := annotations[networking.HTTPOptionAnnotationKey]
-		switch strings.ToLower(annotation) {
-		case "enabled":
+func getHTTPProtocol(ctx context.Context, annotations map[string]string) (netv1alpha1.HTTPOption, error) {
+	if len(annotations) != 0 && networking.GetHTTPProtocol(annotations) != "" {
+		protocol := strings.ToLower(networking.GetHTTPProtocol(annotations))
+		switch network.HTTPProtocol(protocol) {
+		case network.HTTPEnabled:
 			return netv1alpha1.HTTPOptionEnabled, nil
-		case "redirected":
+		case network.HTTPRedirected:
 			return netv1alpha1.HTTPOptionRedirected, nil
 		default:
-			return "", fmt.Errorf("incorrect HTTPOption annotation:" + annotation)
+			return "", fmt.Errorf("incorrect http-protocol annotation:" + protocol)
 		}
 	}
 
diff --git a/pkg/reconciler/route/route.go b/pkg/reconciler/route/route.go
index f522e5b49..0cfb0816e 100644
--- a/pkg/reconciler/route/route.go
+++ b/pkg/reconciler/route/route.go
@@ -83,14 +83,14 @@ type Reconciler struct {
 var _ routereconciler.Interface = (*Reconciler)(nil)
 
 func ingressClassForRoute(ctx context.Context, r *v1.Route) string {
-	if ingressClass := r.Annotations[networking.IngressClassAnnotationKey]; ingressClass != "" {
+	if ingressClass := networking.GetIngressClass(r.Annotations); ingressClass != "" {
 		return ingressClass
 	}
 	return config.FromContext(ctx).Network.DefaultIngressClass
 }
 
 func certClass(ctx context.Context, r *v1.Route) string {
-	if class := r.Annotations[networking.CertificateClassAnnotationKey]; class != "" {
+	if class := networking.GetCertificateClass(r.Annotations); class != "" {
 		return class
 	}
 	return config.FromContext(ctx).Network.DefaultCertificateClass
@@ -476,7 +476,7 @@ func autoTLSEnabled(ctx context.Context, r *v1.Route) bool {
 	}
 
 	logger := logging.FromContext(ctx)
-	annotationValue := r.Annotations[networking.DisableAutoTLSAnnotationKey]
+	annotationValue := networking.GetDisableAutoTLS(r.Annotations)
 
 	disabledByAnnotation, err := strconv.ParseBool(annotationValue)
 	if annotationValue != "" && err != nil {
diff --git a/support/COMMUNITY_CONTACTS.md b/support/COMMUNITY_CONTACTS.md
index 9c389316c..a98b357a5 100644
--- a/support/COMMUNITY_CONTACTS.md
+++ b/support/COMMUNITY_CONTACTS.md
@@ -68,7 +68,6 @@ rotation, feel free to send a PR to remove yourself.
 - [carlisia](https://github.com/carlisia)
 - [dprotaso](https://github.com/dprotaso)
 - [julz](https://github.com/julz)
-- [markusthoemmes](https://github.com/markusthoemmes)
 - [nader-ziada](https://github.com/nader-ziada)
 - [nak3](https://github.com/nak3)
 - [shinigambit](https://github.com/shinigambit)
diff --git a/support/support.rotation b/support/support.rotation
index e895d0020..a64fce334 100644
--- a/support/support.rotation
+++ b/support/support.rotation
@@ -19,9 +19,9 @@
 2021-12-13T01:00:00Z | julz
 2021-12-20T01:00:00Z | N/A - break
 2021-12-27T01:00:00Z | N/A - break
-2022-01-03T01:00:00Z | markusthoemmes
+2022-01-03T01:00:00Z | TBD
 2022-01-10T01:00:00Z | nader-ziada
 2022-01-11T01:00:00Z | yanweiguo
-2022-01-17T01:00:00Z | nak3s
+2022-01-17T01:00:00Z | nak3
 2022-01-24T01:00:00Z | shinigambit
 2022-02-07T01:00:00Z | ZhiminXiang
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/metadata_validation.go b/vendor/knative.dev/networking/pkg/apis/networking/metadata_validation.go
index e7ea78925..85f69717f 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/metadata_validation.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/metadata_validation.go
@@ -26,9 +26,15 @@ import (
 
 var (
 	allowedAnnotations = sets.NewString(
-		DisableAutoTLSAnnotationKey,
+		IngressClassAnnotationKey,
 		CertificateClassAnnotationKey,
+		DisableAutoTLSAnnotationKey,
 		HTTPOptionAnnotationKey,
+
+		IngressClassAnnotationAltKey,
+		CertificateClassAnnotationAltKey,
+		DisableAutoTLSAnnotationAltKey,
+		HTTPProtocolAnnotationKey,
 	)
 )
 
diff --git a/vendor/knative.dev/networking/pkg/apis/networking/register.go b/vendor/knative.dev/networking/pkg/apis/networking/register.go
index ec18c4bc0..28dc03f63 100644
--- a/vendor/knative.dev/networking/pkg/apis/networking/register.go
+++ b/vendor/knative.dev/networking/pkg/apis/networking/register.go
@@ -20,29 +20,6 @@ const (
 	// GroupName is the name for the networking API group.
 	GroupName = "networking.internal.knative.dev"
 
-	// IngressClassAnnotationKey is the annotation for the
-	// explicit class of Ingress that a particular resource has
-	// opted into. For example,
-	//
-	//    networking.knative.dev/ingress.class: some-network-impl
-	//
-	// This uses a different domain because unlike the resource, it is
-	// user-facing.
-	//
-	// The parent resource may use its own annotations to choose the
-	// annotation value for the Ingress it uses.  Based on such
-	// value a different reconciliation logic may be used (for examples,
-	// Istio-based Ingress will reconcile into a VirtualService).
-	IngressClassAnnotationKey = "networking.knative.dev/ingress.class"
-
-	// DisableAutoTLSAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
-	// to indicate that AutoTLS should not be enabled for it.
-	DisableAutoTLSAnnotationKey = "networking.knative.dev/disableAutoTLS"
-
-	// HTTPOptionAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
-	// to indicate the HTTP option of it.
-	HTTPOptionAnnotationKey = "networking.knative.dev/httpOption"
-
 	// IngressLabelKey is the label key attached to underlying network programming
 	// resources to indicate which Ingress triggered their creation.
 	IngressLabelKey = GroupName + "/ingress"
@@ -58,6 +35,11 @@ const (
 	// RolloutAnnotationKey is the annotation key for storing
 	// the rollout state in the Annotations of the Kingress or Route.Status.
 	RolloutAnnotationKey = GroupName + "/rollout"
+)
+
+const (
+	// PublicGroupName is the name for hte public networking API group
+	PublicGroupName = "networking.knative.dev"
 
 	// CertificateClassAnnotationKey is the annotation for the
 	// explicit class of Certificate that a particular resource has
@@ -72,15 +54,54 @@ const (
 	// annotation value for the Certificate it uses.  Based on such
 	// value a different reconciliation logic may be used (for examples,
 	// Cert-Manager-based Certificate will reconcile into a Cert-Manager Certificate).
-	CertificateClassAnnotationKey = "networking.knative.dev/certificate.class"
+	CertificateClassAnnotationKey = PublicGroupName + "/certificate.class"
 
-	// DisableWildcardCertLabelKey is the label key attached to a namespace to indicate that
-	// a wildcard certificate should be not created for it.
-	DisableWildcardCertLabelKey = "networking.knative.dev/disableWildcardCert"
+	// CertificateClassAnnotationAltKey is an alternative casing to CertificateClassAnnotationKey
+	//
+	// This annotation is meant to be applied to Knative Services or Routes. Serving
+	// will translate this to original casing for better compatibility with different
+	// certificate providers
+	CertificateClassAnnotationAltKey = PublicGroupName + "/certificate-class"
+
+	// DisableAutoTLSAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
+	// to indicate that AutoTLS should not be enabled for it.
+	DisableAutoTLSAnnotationKey = PublicGroupName + "/disableAutoTLS"
+
+	// DisableAutoTLSAnnotationAltKey is an alternative casing to DisableAutoTLSAnnotationKey
+	DisableAutoTLSAnnotationAltKey = PublicGroupName + "/disable-auto-tls"
+
+	// HTTPOptionAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
+	// to indicate the HTTP option of it.
+	HTTPOptionAnnotationKey = PublicGroupName + "/httpOption"
+
+	// HTTPProtocolAnnotationKey is an alternative to HTTPOptionAnnotationKey
+	HTTPProtocolAnnotationKey = PublicGroupName + "/http-protocol"
+
+	// IngressClassAnnotationKey is the annotation for the
+	// explicit class of Ingress that a particular resource has
+	// opted into. For example,
+	//
+	//    networking.knative.dev/ingress.class: some-network-impl
+	//
+	// This uses a different domain because unlike the resource, it is
+	// user-facing.
+	//
+	// The parent resource may use its own annotations to choose the
+	// annotation value for the Ingress it uses.  Based on such
+	// value a different reconciliation logic may be used (for examples,
+	// Istio-based Ingress will reconcile into a VirtualService).
+	IngressClassAnnotationKey = PublicGroupName + "/ingress.class"
+
+	// IngressClassAnnotationAltKey is an alternative casing to IngressClassAnnotationKey
+	//
+	// This annotation is meant to be applied to Knative Services or Routes. Serving
+	// will translate this to original casing for better compatibility with different
+	// ingress providers
+	IngressClassAnnotationAltKey = PublicGroupName + "/ingress-class"
 
 	// WildcardCertDomainLabelKey is the label key attached to a certificate to indicate the
 	// domain for which it was issued.
-	WildcardCertDomainLabelKey = "networking.knative.dev/wildcardDomain"
+	WildcardCertDomainLabelKey = PublicGroupName + "/wildcardDomain"
 )
 
 // Pseudo-constants
@@ -88,3 +109,35 @@ var (
 	// DefaultRetryCount will be set if Attempts not specified.
 	DefaultRetryCount = 3
 )
+
+func GetIngressClass(annotations map[string]string) (val string) {
+	val, ok := annotations[IngressClassAnnotationAltKey]
+	if ok {
+		return val
+	}
+	return annotations[IngressClassAnnotationKey]
+}
+
+func GetCertificateClass(annotations map[string]string) (val string) {
+	val, ok := annotations[CertificateClassAnnotationAltKey]
+	if ok {
+		return val
+	}
+	return annotations[CertificateClassAnnotationKey]
+}
+
+func GetHTTPProtocol(annotations map[string]string) (val string) {
+	val, ok := annotations[HTTPProtocolAnnotationKey]
+	if ok {
+		return val
+	}
+	return annotations[HTTPOptionAnnotationKey]
+}
+
+func GetDisableAutoTLS(annotations map[string]string) (val string) {
+	val, ok := annotations[DisableAutoTLSAnnotationAltKey]
+	if ok {
+		return val
+	}
+	return annotations[DisableAutoTLSAnnotationKey]
+}
diff --git a/vendor/knative.dev/pkg/apis/duck/v1/status_types.go b/vendor/knative.dev/pkg/apis/duck/v1/status_types.go
index bf740e065..15e264534 100644
--- a/vendor/knative.dev/pkg/apis/duck/v1/status_types.go
+++ b/vendor/knative.dev/pkg/apis/duck/v1/status_types.go
@@ -21,7 +21,7 @@ import (
 
 	"knative.dev/pkg/apis"
 	"knative.dev/pkg/apis/duck/ducktypes"
-	"knative.dev/pkg/kmeta"
+	"knative.dev/pkg/kmap"
 )
 
 // +genduck
@@ -92,8 +92,7 @@ func (s *Status) GetCondition(t apis.ConditionType) *apis.Condition {
 func (s *Status) ConvertTo(ctx context.Context, sink *Status, predicates ...func(apis.ConditionType) bool) {
 	sink.ObservedGeneration = s.ObservedGeneration
 	if s.Annotations != nil {
-		// This will deep copy the map.
-		sink.Annotations = kmeta.UnionMaps(s.Annotations)
+		sink.Annotations = kmap.Union(s.Annotations)
 	}
 
 	conditions := make(apis.Conditions, 0, len(s.Conditions))
diff --git a/vendor/knative.dev/pkg/apis/duck/v1beta1/status_types.go b/vendor/knative.dev/pkg/apis/duck/v1beta1/status_types.go
index 722902676..e1ae875eb 100644
--- a/vendor/knative.dev/pkg/apis/duck/v1beta1/status_types.go
+++ b/vendor/knative.dev/pkg/apis/duck/v1beta1/status_types.go
@@ -26,7 +26,7 @@ import (
 
 	"knative.dev/pkg/apis"
 	"knative.dev/pkg/apis/duck/ducktypes"
-	"knative.dev/pkg/kmeta"
+	"knative.dev/pkg/kmap"
 )
 
 // +genduck
@@ -109,8 +109,7 @@ func (s *Status) GetCondition(t apis.ConditionType) *apis.Condition {
 func (s *Status) ConvertTo(ctx context.Context, sink *Status) {
 	sink.ObservedGeneration = s.ObservedGeneration
 	if s.Annotations != nil {
-		// This will deep copy the map.
-		sink.Annotations = kmeta.UnionMaps(s.Annotations)
+		sink.Annotations = kmap.Copy(s.Annotations)
 	}
 	for _, c := range s.Conditions {
 		switch c.Type {
diff --git a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/comment_parser.go b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/comment_parser.go
index ada0dff3e..68ac8b4cb 100644
--- a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/comment_parser.go
+++ b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/comment_parser.go
@@ -19,25 +19,41 @@ import "strings"
 
 // Adapted from the k8s.io comment parser https://github.com/kubernetes/gengo/blob/master/types/comments.go
 
+// CommentsTags maps marker prefixes to a set of tags containing keys and values
+type CommentTags map[string]CommentTag
+
+// CommentTags maps keys to a list of values
+type CommentTag map[string][]string
+
 // ExtractCommentTags parses comments for lines of the form:
 //
-//   'marker' + ':' "key=value,key2=value2".
+//   "marker" + "prefix" + ':' + "key=value,key2=value2".
 //
-// Values are optional; empty map is the default.  A tag can be specified more than
+//  In the following example the marker is '+' and the prefix is 'foo':
+//   +foo:key=value1,key2=value2,key=value3
+//
+// Values are optional; empty map is the default. A tag can be specified more than
 // one time and all values are returned.  If the resulting map has an entry for
 // a key, the value (a slice) is guaranteed to have at least 1 element.
 //
 // Example: if you pass "+" for 'marker', and the following lines are in
 // the comments:
-//   +foo:key=value1,key2=value2
+//   +foo:key=value1,key2=value2,key=value3
 //   +bar
 //
 // Then this function will return:
-//   map[string]map[string]string{"foo":{"key":value1","key2":"value2"}, "bar": nil}
+//   map[string]map[string]string{
+//     "foo":{
+//      "key":  []string{"value1", "value3"},
+//      "key2": []string{"value2"}
+//     },
+//     "bar": {},
+//  }
 //
 // Users are not expected to repeat values.
-func ExtractCommentTags(marker string, lines []string) map[string]map[string]string {
-	out := map[string]map[string]string{}
+func ExtractCommentTags(marker string, lines []string) CommentTags {
+	out := CommentTags{}
+
 	for _, line := range lines {
 		line = strings.TrimSpace(line)
 		if len(line) == 0 || !strings.HasPrefix(line, marker) {
@@ -45,29 +61,32 @@ func ExtractCommentTags(marker string, lines []string) map[string]map[string]str
 		}
 
 		options := strings.SplitN(line[len(marker):], ":", 2)
+		prefix := options[0]
+
 		if len(options) == 2 {
 			vals := strings.Split(options[1], ",")
 
-			opts := out[options[0]]
+			opts := out[prefix]
 			if opts == nil {
-				opts = make(map[string]string, len(vals))
+				opts = make(CommentTag, len(vals))
+				out[prefix] = opts
 			}
 
 			for _, pair := range vals {
-				if kv := strings.SplitN(pair, "=", 2); len(kv) == 2 {
-					opts[kv[0]] = kv[1]
-				} else if kv[0] != "" {
-					opts[kv[0]] = ""
+				kv := strings.SplitN(pair, "=", 2)
+				if len(kv) == 1 && kv[0] == "" {
+					continue
+				}
+				if _, ok := opts[kv[0]]; !ok {
+					opts[kv[0]] = []string{}
+				}
+				if len(kv) == 2 {
+					opts[kv[0]] = append(opts[kv[0]], kv[1])
 				}
-			}
-			if len(opts) == 0 {
-				out[options[0]] = nil
-			} else {
-				out[options[0]] = opts
 			}
 		} else if len(options) == 1 && options[0] != "" {
-			if _, has := out[options[0]]; !has {
-				out[options[0]] = nil
+			if _, has := out[prefix]; !has {
+				out[prefix] = CommentTag{}
 			}
 		}
 	}
diff --git a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/packages.go b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/packages.go
index 1900802fa..f79339824 100644
--- a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/packages.go
+++ b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/packages.go
@@ -193,29 +193,36 @@ func MustParseClientGenTags(lines []string) Tags {
 	return ret
 }
 
-func extractCommentTags(t *types.Type) map[string]map[string]string {
+func extractCommentTags(t *types.Type) CommentTags {
 	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
 	return ExtractCommentTags("+", comments)
 }
 
-func extractReconcilerClassTag(tags map[string]map[string]string) (string, bool) {
+func extractReconcilerClassesTag(tags CommentTags) ([]string, bool) {
 	vals, ok := tags["genreconciler"]
 	if !ok {
-		return "", false
+		return nil, false
 	}
-	classname, has := vals["class"]
-	return classname, has
+	classnames, has := vals["class"]
+	if has && len(classnames) == 0 {
+		return nil, false
+	}
+	return classnames, has
 }
 
-func isKRShaped(tags map[string]map[string]string) bool {
+func isKRShaped(tags CommentTags) bool {
 	vals, has := tags["genreconciler"]
 	if !has {
 		return false
 	}
-	return vals["krshapedlogic"] != "false"
+	stringVals, has := vals["krshapedlogic"]
+	if !has || len(vals) == 0 {
+		return true // Default is true
+	}
+	return stringVals[0] != "false"
 }
 
-func isNonNamespaced(tags map[string]map[string]string) bool {
+func isNonNamespaced(tags CommentTags) bool {
 	vals, has := tags["genclient"]
 	if !has {
 		return false
@@ -224,7 +231,7 @@ func isNonNamespaced(tags map[string]map[string]string) bool {
 	return has
 }
 
-func stubs(tags map[string]map[string]string) bool {
+func stubs(tags CommentTags) bool {
 	vals, has := tags["genreconciler"]
 	if !has {
 		return false
@@ -545,7 +552,7 @@ func reconcilerPackages(basePackage string, groupPkgName string, gv clientgentyp
 		// Fix for golang iterator bug.
 		t := t
 		extracted := extractCommentTags(t)
-		reconcilerClass, hasReconcilerClass := extractReconcilerClassTag(extracted)
+		reconcilerClasses, hasReconcilerClass := extractReconcilerClassesTag(extracted)
 		nonNamespaced := isNonNamespaced(extracted)
 		isKRShaped := isKRShaped(extracted)
 		stubs := stubs(extracted)
@@ -573,7 +580,7 @@ func reconcilerPackages(basePackage string, groupPkgName string, gv clientgentyp
 					clientPkg:           clientPackagePath,
 					informerPackagePath: informerPackagePath,
 					schemePkg:           filepath.Join(customArgs.VersionedClientSetPackage, "scheme"),
-					reconcilerClass:     reconcilerClass,
+					reconcilerClasses:   reconcilerClasses,
 					hasReconcilerClass:  hasReconcilerClass,
 					hasStatus:           hasStatus(t),
 				})
@@ -602,7 +609,7 @@ func reconcilerPackages(basePackage string, groupPkgName string, gv clientgentyp
 						outputPackage:       filepath.Join(packagePath, "stub"),
 						imports:             generator.NewImportTracker(),
 						informerPackagePath: informerPackagePath,
-						reconcilerClass:     reconcilerClass,
+						reconcilerClasses:   reconcilerClasses,
 						hasReconcilerClass:  hasReconcilerClass,
 					})
 					return generators
@@ -633,7 +640,7 @@ func reconcilerPackages(basePackage string, groupPkgName string, gv clientgentyp
 					listerPkg:          listerPackagePath,
 					groupGoName:        groupGoName,
 					groupVersion:       gv,
-					reconcilerClass:    reconcilerClass,
+					reconcilerClasses:  reconcilerClasses,
 					hasReconcilerClass: hasReconcilerClass,
 					nonNamespaced:      nonNamespaced,
 					isKRShaped:         isKRShaped,
diff --git a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller.go b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller.go
index a624275a5..63556dec6 100644
--- a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller.go
+++ b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller.go
@@ -38,7 +38,7 @@ type reconcilerControllerGenerator struct {
 	schemePkg           string
 	informerPackagePath string
 
-	reconcilerClass    string
+	reconcilerClasses  []string
 	hasReconcilerClass bool
 	hasStatus          bool
 }
@@ -69,7 +69,7 @@ func (g *reconcilerControllerGenerator) GenerateType(c *generator.Context, t *ty
 	m := map[string]interface{}{
 		"type":      t,
 		"group":     g.groupName,
-		"class":     g.reconcilerClass,
+		"classes":   g.reconcilerClasses,
 		"hasClass":  g.hasReconcilerClass,
 		"hasStatus": g.hasStatus,
 		"controllerImpl": c.Universe.Type(types.Name{
@@ -195,12 +195,24 @@ var reconcilerControllerNewImpl = `
 const (
 	defaultControllerAgentName = "{{.type|lowercaseSingular}}-controller"
 	defaultFinalizerName       = "{{.type|allLowercasePlural}}.{{.group}}"
-	{{if .hasClass}}
+	{{if .hasClass }}
 	// ClassAnnotationKey points to the annotation for the class of this resource.
-	ClassAnnotationKey = "{{ .class }}"
+	{{if gt (.classes | len) 1 }}// Deprecated: Use ClassAnnotationKeys given multiple keys exist
+	{{end -}}
+	ClassAnnotationKey = "{{ index .classes 0 }}"
 	{{end}}
 )
 
+{{if gt (.classes | len) 1 }}
+var (
+	// ClassAnnotationKeys points to the annotation for the class of this resource.
+	ClassAnnotationKeys = []string{
+		{{range $class := .classes}}"{{$class}}",
+		{{end}}
+	}
+)
+{{end}}
+
 // NewImpl returns a {{.controllerImpl|raw}} that handles queuing and feeding work from
 // the queue through an implementation of {{.controllerReconciler|raw}}, delegating to
 // the provided Interface and optional Finalizer methods. OptionsFn is used to return
diff --git a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller_stub.go b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller_stub.go
index 37db246c3..13dff4d51 100644
--- a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller_stub.go
+++ b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_controller_stub.go
@@ -35,7 +35,7 @@ type reconcilerControllerStubGenerator struct {
 
 	reconcilerPkg       string
 	informerPackagePath string
-	reconcilerClass     string
+	reconcilerClasses   []string
 	hasReconcilerClass  bool
 }
 
@@ -64,7 +64,7 @@ func (g *reconcilerControllerStubGenerator) GenerateType(c *generator.Context, t
 
 	m := map[string]interface{}{
 		"type":     t,
-		"class":    g.reconcilerClass,
+		"classes":  g.reconcilerClasses,
 		"hasClass": g.hasReconcilerClass,
 		"informerGet": c.Universe.Function(types.Name{
 			Package: g.informerPackagePath,
@@ -91,10 +91,18 @@ func (g *reconcilerControllerStubGenerator) GenerateType(c *generator.Context, t
 			Package: g.reconcilerPkg,
 			Name:    "ClassAnnotationKey",
 		}),
+		"classAnnotationKeys": c.Universe.Variable(types.Name{
+			Package: g.reconcilerPkg,
+			Name:    "ClassAnnotationKeys",
+		}),
 		"annotationFilterFunc": c.Universe.Function(types.Name{
 			Package: "knative.dev/pkg/reconciler",
 			Name:    "AnnotationFilterFunc",
 		}),
+		"orFilterFunc": c.Universe.Function(types.Name{
+			Package: "knative.dev/pkg/reconciler",
+			Name:    "Or",
+		}),
 		"filterHandler": c.Universe.Type(types.Name{
 			Package: "k8s.io/client-go/tools/cache",
 			Name:    "FilteringResourceEventHandler",
@@ -120,7 +128,17 @@ func NewController(
 
 	{{if .hasClass}}
 	classValue := "default" // TODO: update this to the appropriate value.
+	{{if len .classes | eq 1 }}
 	classFilter := {{.annotationFilterFunc|raw}}({{.classAnnotationKey|raw}}, classValue, false /*allowUnset*/)
+	{{else if gt (len .classes) 1 }}
+	filterFuncs := make([]func(interface{}) bool, 0, len({{.classAnnotationKeys|raw}}))
+
+	for _, key := range {{.classAnnotationKeys|raw}} {
+		filterFuncs = append(filterFuncs, {{.annotationFilterFunc|raw}}(key, classValue, false /*allowUnset*/))
+	}
+
+	classFilter := {{.orFilterFunc|raw}}(filterFuncs...)
+	{{end}}
 	{{end}}
 
 	// TODO: setup additional informers here.
diff --git a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_reconciler.go b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_reconciler.go
index e787096b3..5e3f23faf 100644
--- a/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_reconciler.go
+++ b/vendor/knative.dev/pkg/codegen/cmd/injection-gen/generators/reconciler_reconciler.go
@@ -37,7 +37,7 @@ type reconcilerReconcilerGenerator struct {
 	listerName     string
 	listerPkg      string
 
-	reconcilerClass    string
+	reconcilerClasses  []string
 	hasReconcilerClass bool
 	nonNamespaced      bool
 	isKRShaped         bool
@@ -74,7 +74,7 @@ func (g *reconcilerReconcilerGenerator) GenerateType(c *generator.Context, t *ty
 		"type":          t,
 		"group":         namer.IC(g.groupGoName),
 		"version":       namer.IC(g.groupVersion.Version.String()),
-		"class":         g.reconcilerClass,
+		"classes":       g.reconcilerClasses,
 		"hasClass":      g.hasReconcilerClass,
 		"isKRShaped":    g.isKRShaped,
 		"hasStatus":     g.hasStatus,
@@ -219,6 +219,9 @@ func (g *reconcilerReconcilerGenerator) GenerateType(c *generator.Context, t *ty
 	sw.Do(reconcilerInterfaceFactory, m)
 	sw.Do(reconcilerNewReconciler, m)
 	sw.Do(reconcilerImplFactory, m)
+	if len(g.reconcilerClasses) > 1 {
+		sw.Do(reconcilerLookupClass, m)
+	}
 	if g.hasStatus {
 		sw.Do(reconcilerStatusFactory, m)
 	}
@@ -227,6 +230,17 @@ func (g *reconcilerReconcilerGenerator) GenerateType(c *generator.Context, t *ty
 	return sw.Error()
 }
 
+var reconcilerLookupClass = `
+func lookupClass(annotations map[string]string) (string, bool) {
+	for _, key := range ClassAnnotationKeys {
+		 if val, ok := annotations[key]; ok {
+		   return val, true
+		 }
+	}
+	return "", false
+}
+`
+
 var reconcilerInterfaceFactory = `
 // Interface defines the strongly typed interfaces to be implemented by a
 // controller reconciling {{.type|raw}}.
@@ -293,8 +307,15 @@ type reconcilerImpl struct {
 	skipStatusUpdates bool
 	{{end}}
 
-	{{if .hasClass}}
-	// classValue is the resource annotation[{{ .class }}] instance value this reconciler instance filters on.
+	{{if len .classes | eq 1 }}
+	// classValue is the resource annotation[{{ index .classes 0 }}] instance value this reconciler instance filters on.
+	classValue string
+	{{else if gt (len .classes) 1 }}
+	// classValue is the resource annotation instance value this reconciler instance filters on.
+	// The annotations key are:
+	{{- range $class := .classes}}
+	//   {{$class}}
+	{{- end}}
 	classValue string
 	{{end}}
 }
@@ -416,14 +437,22 @@ func (r *reconcilerImpl) Reconcile(ctx {{.contextContext|raw}}, key string) erro
 	} else if err != nil {
 		return err
 	}
-	{{if .hasClass}}
+
+{{if len .classes | eq 1 }}
 	if classValue, found := original.GetAnnotations()[ClassAnnotationKey]; !found || classValue != r.classValue {
 		logger.Debugw("Skip reconciling resource, class annotation value does not match reconciler instance value.",
 			zap.String("classKey", ClassAnnotationKey),
 			zap.String("issue", classValue+"!="+r.classValue))
 		return nil
 	}
-	{{end}}
+{{else if gt (len .classes) 1 }}
+	if classValue, found := lookupClass(original.GetAnnotations()); !found || classValue != r.classValue {
+		logger.Debugw("Skip reconciling resource, class annotation value does not match reconciler instance value.",
+			zap.Strings("classKeys", ClassAnnotationKeys),
+			zap.String("issue", classValue+"!="+r.classValue))
+		return nil
+	}
+{{end}}
 
 	// Don't modify the informers copy.
 	resource := original.DeepCopy()
diff --git a/vendor/knative.dev/pkg/injection/interface.go b/vendor/knative.dev/pkg/injection/interface.go
index 433728298..158864015 100644
--- a/vendor/knative.dev/pkg/injection/interface.go
+++ b/vendor/knative.dev/pkg/injection/interface.go
@@ -103,6 +103,14 @@ type DynamicInterface interface {
 
 type ControllerConstructor func(context.Context, configmap.Watcher) *controller.Impl
 
+// NamedControllerConstructor is a ControllerConstructor with an associated name.
+type NamedControllerConstructor struct {
+	// Name is the name associated with the controller returned by ControllerConstructor.
+	Name string
+	// ControllerConstructor is a constructor for a controller.
+	ControllerConstructor ControllerConstructor
+}
+
 var (
 	// Check that impl implements Interface
 	_ Interface = (*impl)(nil)
diff --git a/vendor/knative.dev/pkg/injection/sharedmain/main.go b/vendor/knative.dev/pkg/injection/sharedmain/main.go
index 8cc6fb195..b2a1d5117 100644
--- a/vendor/knative.dev/pkg/injection/sharedmain/main.go
+++ b/vendor/knative.dev/pkg/injection/sharedmain/main.go
@@ -26,6 +26,8 @@ import (
 	"os"
 	"time"
 
+	"github.com/spf13/pflag"
+
 	"go.uber.org/automaxprocs/maxprocs" // automatically set GOMAXPROCS based on cgroups
 	"go.uber.org/zap"
 	"golang.org/x/sync/errgroup"
@@ -34,6 +36,7 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/rest"
 
@@ -111,6 +114,43 @@ var (
 	WebhookMainWithConfig  = MainWithConfig
 )
 
+// MainNamed runs the generic main flow for controllers and webhooks.
+//
+// In addition to the MainWithConfig flow, it defines a `disabled-controllers` flag that allows disabling controllers
+// by name.
+func MainNamed(ctx context.Context, component string, ctors ...injection.NamedControllerConstructor) {
+
+	disabledControllers := pflag.StringSlice("disable-controllers", []string{}, "Comma-separated list of disabled controllers.")
+
+	// HACK: This parses flags, so the above should be set once this runs.
+	cfg := injection.ParseAndGetRESTConfigOrDie()
+
+	enabledCtors := enabledControllers(*disabledControllers, ctors)
+
+	MainWithConfig(ctx, component, cfg, toControllerConstructors(enabledCtors)...)
+}
+
+func enabledControllers(disabledControllers []string, ctors []injection.NamedControllerConstructor) []injection.NamedControllerConstructor {
+	disabledControllersSet := sets.NewString(disabledControllers...)
+	activeCtors := make([]injection.NamedControllerConstructor, 0, len(ctors))
+	for _, ctor := range ctors {
+		if disabledControllersSet.Has(ctor.Name) {
+			log.Printf("Disabling controller %s", ctor.Name)
+			continue
+		}
+		activeCtors = append(activeCtors, ctor)
+	}
+	return activeCtors
+}
+
+func toControllerConstructors(namedCtors []injection.NamedControllerConstructor) []injection.ControllerConstructor {
+	ctors := make([]injection.ControllerConstructor, 0, len(namedCtors))
+	for _, ctor := range namedCtors {
+		ctors = append(ctors, ctor.ControllerConstructor)
+	}
+	return ctors
+}
+
 // MainWithContext runs the generic main flow for controllers and
 // webhooks. Use MainWithContext if you do not need to serve webhooks.
 func MainWithContext(ctx context.Context, component string, ctors ...injection.ControllerConstructor) {
diff --git a/vendor/knative.dev/pkg/kmap/lookup.go b/vendor/knative.dev/pkg/kmap/lookup.go
new file mode 100644
index 000000000..e24041b6e
--- /dev/null
+++ b/vendor/knative.dev/pkg/kmap/lookup.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2021 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kmap
+
+// KeyPriority is a utility struct for getting values from a map
+// given a list of ordered keys
+//
+// This is to help the migration/renaming of annotations & labels
+type KeyPriority []string
+
+// Key returns the default key that should be used for
+// accessing the map
+func (p KeyPriority) Key() string {
+	// this intentionally panics rather than returning an empty string
+	return p[0]
+}
+
+// Value iterates looks up the ordered keys in the map and returns
+// a string value. An empty string will be returned if the keys
+// are not present in the map
+func (p KeyPriority) Value(m map[string]string) string {
+	_, v, _ := p.Get(m)
+	return v
+}
+
+// Get iterates over the ordered keys and looks up the corresponding
+// values in the map
+//
+// It returns the key, value, and true|false signaling whether the
+// key was present in the map
+//
+// If no key is present the default key (lowest ordinal) is returned
+// with an empty string as the value
+func (p KeyPriority) Get(m map[string]string) (string, string, bool) {
+	var k, v string
+	var ok bool
+	for _, k = range p {
+		v, ok = m[k]
+		if ok {
+			return k, v, ok
+		}
+	}
+
+	return p.Key(), "", false
+}
+
+// UpdateKey will update the map with the KeyPriority's default
+// key iff any of the other synonym keys are present
+func (p KeyPriority) UpdateKey(m map[string]string) {
+	if k, v, ok := p.Get(m); ok && k != p.Key() {
+		delete(m, k)
+		m[p.Key()] = v
+	}
+}
+
+// UpdateKeys iterates over the lookups and updates entries in the map
+// to use the default key
+func UpdateKeys(m map[string]string, keys ...KeyPriority) map[string]string {
+	for _, key := range keys {
+		key.UpdateKey(m)
+	}
+	return m
+}
diff --git a/vendor/knative.dev/pkg/kmap/map.go b/vendor/knative.dev/pkg/kmap/map.go
new file mode 100644
index 000000000..006348d76
--- /dev/null
+++ b/vendor/knative.dev/pkg/kmap/map.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2021 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kmap
+
+// Copy makes a copy of the map.
+func Copy(a map[string]string) map[string]string {
+	ret := make(map[string]string, len(a))
+	for k, v := range a {
+		ret[k] = v
+	}
+	return ret
+}
+
+// Union returns a map constructed from the union of input maps.
+// where values from latter maps win.
+func Union(maps ...map[string]string) map[string]string {
+	if len(maps) == 0 {
+		return map[string]string{}
+	}
+	out := make(map[string]string, len(maps[0]))
+
+	for _, m := range maps {
+		for k, v := range m {
+			out[k] = v
+		}
+	}
+	return out
+}
+
+// Filter creates a copy of the provided map, filtering out the elements
+// that match `filter`.
+// nil `filter` is accepted.
+func Filter(in map[string]string, filter func(string) bool) map[string]string {
+	ret := make(map[string]string, len(in))
+	for k, v := range in {
+		if filter != nil && filter(k) {
+			continue
+		}
+		ret[k] = v
+	}
+	return ret
+}
+
+// ExcludeKeys creates a copy of the provided map filtering out the excluded `keys`
+func ExcludeKeys(in map[string]string, keys ...string) map[string]string {
+	return ExcludeKeyList(in, keys)
+}
+
+// ExcludeKeyList creates a copy of the provided map filtering out excluded `keys`
+func ExcludeKeyList(in map[string]string, keys []string) map[string]string {
+	ret := make(map[string]string, len(in))
+
+outer:
+	for k, v := range in {
+		// opted to skip memory allocation (creating a set) in favour of
+		// looping since the places Knative will use this we typically
+		// exclude one or two keys
+		for _, excluded := range keys {
+			if k == excluded {
+				continue outer
+			}
+		}
+		ret[k] = v
+	}
+	return ret
+}
diff --git a/vendor/knative.dev/pkg/kmeta/map.go b/vendor/knative.dev/pkg/kmeta/map.go
index 37154cd28..475923320 100644
--- a/vendor/knative.dev/pkg/kmeta/map.go
+++ b/vendor/knative.dev/pkg/kmeta/map.go
@@ -16,41 +16,19 @@ limitations under the License.
 
 package kmeta
 
+import "knative.dev/pkg/kmap"
+
 // CopyMap makes a copy of the map.
-func CopyMap(a map[string]string) map[string]string {
-	ret := make(map[string]string, len(a))
-	for k, v := range a {
-		ret[k] = v
-	}
-	return ret
-}
+// Deprecated: use kmap.Copy
+var CopyMap = kmap.Copy
 
 // UnionMaps returns a map constructed from the union of input maps.
 // where values from latter maps win.
-func UnionMaps(maps ...map[string]string) map[string]string {
-	if len(maps) == 0 {
-		return map[string]string{}
-	}
-	out := make(map[string]string, len(maps[0]))
-
-	for _, m := range maps {
-		for k, v := range m {
-			out[k] = v
-		}
-	}
-	return out
-}
+// Deprecated: use kmap.Union
+var UnionMaps = kmap.Union
 
 // FilterMap creates a copy of the provided map, filtering out the elements
 // that match `filter`.
 // nil `filter` is accepted.
-func FilterMap(in map[string]string, filter func(string) bool) map[string]string {
-	ret := make(map[string]string, len(in))
-	for k, v := range in {
-		if filter != nil && filter(k) {
-			continue
-		}
-		ret[k] = v
-	}
-	return ret
-}
+// Deprecated: use kmap.Filter
+var FilterMap = kmap.Filter
diff --git a/vendor/knative.dev/pkg/reconciler/filter.go b/vendor/knative.dev/pkg/reconciler/filter.go
index 36c86c4d3..9f7d2fa36 100644
--- a/vendor/knative.dev/pkg/reconciler/filter.go
+++ b/vendor/knative.dev/pkg/reconciler/filter.go
@@ -77,6 +77,18 @@ func Not(f func(interface{}) bool) func(interface{}) bool {
 	}
 }
 
+// Or creates a FilterFunc which performs an OR of the passed in FilterFuncs
+func Or(funcs ...func(interface{}) bool) func(interface{}) bool {
+	return func(obj interface{}) bool {
+		for _, f := range funcs {
+			if f(obj) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
 // ChainFilterFuncs creates a FilterFunc which performs an AND of the passed FilterFuncs.
 func ChainFilterFuncs(funcs ...func(interface{}) bool) func(interface{}) bool {
 	return func(obj interface{}) bool {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 29980bbdb..41fbab013 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -991,7 +991,7 @@ k8s.io/utils/buffer
 k8s.io/utils/integer
 k8s.io/utils/pointer
 k8s.io/utils/trace
-# knative.dev/caching v0.0.0-20211111075937-0c3d96f98a71
+# knative.dev/caching v0.0.0-20211118070729-77b107b17fef
 ## explicit
 knative.dev/caching/config
 knative.dev/caching/pkg/apis/caching
@@ -1012,11 +1012,11 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/hack v0.0.0-20211112192837-128cf0150a69
+# knative.dev/hack v0.0.0-20211117134436-69a2295d54ce
 ## explicit
 knative.dev/hack
 knative.dev/hack/shell
-# knative.dev/networking v0.0.0-20211111131538-526348e63718
+# knative.dev/networking v0.0.0-20211119210323-bab26a807fa3
 ## explicit
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -1046,7 +1046,7 @@ knative.dev/networking/pkg/client/injection/reconciler/networking/v1alpha1/serve
 knative.dev/networking/pkg/client/listers/networking/v1alpha1
 knative.dev/networking/pkg/ingress
 knative.dev/networking/pkg/prober
-# knative.dev/pkg v0.0.0-20211111114938-0b0c3390a475
+# knative.dev/pkg v0.0.0-20211120133512-d016976f2567
 ## explicit
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate
@@ -1106,6 +1106,7 @@ knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret
 knative.dev/pkg/injection/clients/namespacedkube/informers/factory
 knative.dev/pkg/injection/sharedmain
 knative.dev/pkg/kflag
+knative.dev/pkg/kmap
 knative.dev/pkg/kmeta
 knative.dev/pkg/kmp
 knative.dev/pkg/leaderelection


Test patch:
diff --git a/cmd/queue/main_test.go b/cmd/queue/main_test.go
index 386a7a872..344ab1f45 100644
--- a/cmd/queue/main_test.go
+++ b/cmd/queue/main_test.go
@@ -148,7 +148,7 @@ func TestQueueTraceSpans(t *testing.T) {
 				h := queue.ProxyHandler(breaker, network.NewRequestStats(time.Now()), true /*tracingEnabled*/, proxy)
 				h(writer, req)
 			} else {
-				h := health.ProbeHandler(tc.prober, true /*tracingEnabled*/, nil)
+				h := health.ProbeHandler(tc.prober, true /*tracingEnabled*/)
 				req.Header.Set(network.ProbeHeaderName, tc.requestHeader)
 				h(writer, req)
 			}
diff --git a/pkg/apis/autoscaling/annotation_validation_test.go b/pkg/apis/autoscaling/annotation_validation_test.go
index 42fe7545a..4597fbfb9 100644
--- a/pkg/apis/autoscaling/annotation_validation_test.go
+++ b/pkg/apis/autoscaling/annotation_validation_test.go
@@ -18,7 +18,6 @@ package autoscaling
 
 import (
 	"context"
-	"fmt"
 	"reflect"
 	"testing"
 
@@ -238,10 +237,6 @@ func TestValidateAnnotations(t *testing.T) {
 		name:        "window too precise",
 		annotations: map[string]string{WindowAnnotationKey: "1m9s82ms"},
 		expectErr:   "must be specified with at most second precision: " + WindowAnnotationKey,
-	}, {
-		name:        "annotation /window is invalid for class HPA and metric CPU",
-		annotations: map[string]string{WindowAnnotationKey: "7s", ClassAnnotationKey: HPA, MetricAnnotationKey: CPU},
-		expectErr:   fmt.Sprintf("invalid key name %q: \n%s for %s %s", WindowAnnotationKey, HPA, MetricAnnotationKey, CPU),
 	}, {
 		name:        "annotation /window is valid for class KPA",
 		annotations: map[string]string{WindowAnnotationKey: "7s", ClassAnnotationKey: KPA},
@@ -250,10 +245,6 @@ func TestValidateAnnotations(t *testing.T) {
 		name:        "annotation /window is valid for other than HPA and KPA class",
 		annotations: map[string]string{WindowAnnotationKey: "7s", ClassAnnotationKey: "test"},
 		expectErr:   "",
-	}, {
-		name:        "value too short and invalid class for /window annotation",
-		annotations: map[string]string{WindowAnnotationKey: "1s", ClassAnnotationKey: HPA, MetricAnnotationKey: CPU},
-		expectErr:   fmt.Sprintf("invalid key name %q: \n%s for %s %s", WindowAnnotationKey, HPA, MetricAnnotationKey, CPU),
 	}, {
 		name:        "value too long and valid class for /window annotation",
 		annotations: map[string]string{WindowAnnotationKey: "365h", ClassAnnotationKey: KPA},
diff --git a/pkg/apis/autoscaling/v1alpha1/pa_lifecycle_test.go b/pkg/apis/autoscaling/v1alpha1/pa_lifecycle_test.go
index 50a4c452a..6ef7b3b1c 100644
--- a/pkg/apis/autoscaling/v1alpha1/pa_lifecycle_test.go
+++ b/pkg/apis/autoscaling/v1alpha1/pa_lifecycle_test.go
@@ -596,6 +596,13 @@ func TestScaleBounds(t *testing.T) {
 		max:     "sandwich",
 		wantMin: 0,
 		wantMax: 0,
+	}, {
+		name: "min-scale set but unreachable",
+		config: autoscalerconfig.Config{
+			MinScale: 2,
+		},
+		reachability: ReachabilityUnreachable,
+		wantMin:      0,
 	}}
 
 	for _, tc := range cases {
diff --git a/pkg/autoscaler/config/config_test.go b/pkg/autoscaler/config/config_test.go
index 871ecb3a2..831950cb0 100644
--- a/pkg/autoscaler/config/config_test.go
+++ b/pkg/autoscaler/config/config_test.go
@@ -133,10 +133,14 @@ func TestNewConfig(t *testing.T) {
 		name: "with toggles explicitly flipped",
 		input: map[string]string{
 			"enable-scale-to-zero": "false",
+			"min-scale":            "1",
+			"max-scale":            "2",
 		},
 		want: func() *autoscalerconfig.Config {
 			c := defaultConfig()
 			c.EnableScaleToZero = false
+			c.MinScale = 1
+			c.MaxScale = 2
 			return c
 		}(),
 	}, {
@@ -144,11 +148,15 @@ func TestNewConfig(t *testing.T) {
 		input: map[string]string{
 			"enable-scale-to-zero":       "false",
 			"scale-to-zero-grace-period": "33s",
+			"min-scale":                  "1",
+			"max-scale":                  "2",
 		},
 		want: func() *autoscalerconfig.Config {
 			c := defaultConfig()
 			c.EnableScaleToZero = false
 			c.ScaleToZeroGracePeriod = 33 * time.Second
+			c.MinScale = 1
+			c.MaxScale = 2
 			return c
 		}(),
 	}, {
@@ -350,6 +358,23 @@ func TestNewConfig(t *testing.T) {
 			"max-scale-limit": "11",
 		},
 		wantErr: true,
+	}, {
+		name: "with max scale less than min-scale",
+		input: map[string]string{
+			"min-scale": "4",
+			"max-scale": "3",
+		},
+		wantErr: true,
+	}, {
+		name: "with min scale set but max-scale not set",
+		input: map[string]string{
+			"min-scale": "4",
+		},
+		want: func() *autoscalerconfig.Config {
+			c := defaultConfig()
+			c.MinScale = 4
+			return c
+		}(),
 	}, {
 		name: "with valid default max scale and max scale limit",
 		input: map[string]string{
diff --git a/pkg/queue/concurrency_state_test.go b/pkg/queue/concurrency_state_test.go
index ad20fd692..0e31765c4 100644
--- a/pkg/queue/concurrency_state_test.go
+++ b/pkg/queue/concurrency_state_test.go
@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"go.uber.org/atomic"
+	"go.uber.org/zap"
 	pkglogging "knative.dev/pkg/logging"
 	ltesting "knative.dev/pkg/logging/testing"
 
@@ -38,7 +39,7 @@ func TestConcurrencyStateHandler(t *testing.T) {
 
 	handler := func(w http.ResponseWriter, r *http.Request) {}
 	logger := ltesting.TestLogger(t)
-	h := ConcurrencyStateHandler(logger, http.HandlerFunc(handler), func() error { paused.Inc(); return nil }, func() error { resumed.Inc(); return nil })
+	h := ConcurrencyStateHandler(logger, http.HandlerFunc(handler), func(*zap.SugaredLogger) { paused.Inc() }, func(*zap.SugaredLogger) { resumed.Inc() })
 
 	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest("GET", "http://target", nil))
 	if got, want := paused.Load(), int64(1); got != want {
@@ -71,7 +72,7 @@ func TestConcurrencyStateHandlerParallelSubsumed(t *testing.T) {
 		}
 	}
 	logger := ltesting.TestLogger(t)
-	h := ConcurrencyStateHandler(logger, http.HandlerFunc(handler), func() error { paused.Inc(); return nil }, func() error { resumed.Inc(); return nil })
+	h := ConcurrencyStateHandler(logger, http.HandlerFunc(handler), func(*zap.SugaredLogger) { paused.Inc() }, func(*zap.SugaredLogger) { resumed.Inc() })
 
 	go func() {
 		defer func() { req1 <- struct{}{} }()
@@ -111,7 +112,7 @@ func TestConcurrencyStateHandlerParallelOverlapping(t *testing.T) {
 		}
 	}
 	logger := ltesting.TestLogger(t)
-	h := ConcurrencyStateHandler(logger, http.HandlerFunc(handler), func() error { paused.Inc(); return nil }, func() error { resumed.Inc(); return nil })
+	h := ConcurrencyStateHandler(logger, http.HandlerFunc(handler), func(*zap.SugaredLogger) { paused.Inc() }, func(*zap.SugaredLogger) { resumed.Inc() })
 
 	go func() {
 		defer func() { req1 <- struct{}{} }()
@@ -157,7 +158,7 @@ func TestConcurrencyStateTokenRefresh(t *testing.T) {
 	}
 
 	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Pause(); err != nil {
+	if err := c.Request("pause"); err != nil {
 		t.Errorf("initial token check returned an error: %s", err)
 	}
 
@@ -166,7 +167,7 @@ func TestConcurrencyStateTokenRefresh(t *testing.T) {
 		t.Fatal(err)
 	}
 	c.RefreshToken()
-	if err := c.Pause(); err != nil {
+	if err := c.Request("pause"); err != nil {
 		t.Errorf("updated token check returned an error: %s", err)
 	}
 }
@@ -223,7 +224,7 @@ func TestConcurrencyStatePauseHeader(t *testing.T) {
 		t.Fatal(err)
 	}
 	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Pause(); err != nil {
+	if err := c.Request("pause"); err != nil {
 		t.Errorf("pause header check returned an error: %s", err)
 	}
 }
@@ -246,12 +247,12 @@ func TestConcurrencyStatePauseRequest(t *testing.T) {
 		t.Fatal(err)
 	}
 	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Pause(); err != nil {
+	if err := c.Request("pause"); err != nil {
 		t.Errorf("request test returned an error: %s", err)
 	}
 }
 
-func TestConcurrencyStatePauseResponse(t *testing.T) {
+func TestConcurrencyStateBadResponse(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusBadRequest)
 	}))
@@ -262,8 +263,11 @@ func TestConcurrencyStatePauseResponse(t *testing.T) {
 		t.Fatal(err)
 	}
 	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Pause(); err == nil {
-		t.Errorf("pausefunction did not return an error")
+	if err := c.Request("pause"); err == nil {
+		t.Errorf(`Request("pause") function did not return an error`)
+	}
+	if err := c.Request("resume"); err == nil {
+		t.Errorf(`Request("resume") function did not return an error`)
 	}
 }
 
@@ -280,7 +284,7 @@ func TestConcurrencyStateResumeHeader(t *testing.T) {
 		t.Fatal(err)
 	}
 	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Resume(); err != nil {
+	if err := c.Request("resume"); err != nil {
 		t.Errorf("resume header check returned an error: %s", err)
 	}
 }
@@ -303,27 +307,11 @@ func TestConcurrencyStateResumeRequest(t *testing.T) {
 		t.Fatal(err)
 	}
 	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Resume(); err != nil {
+	if err := c.Request("resume"); err != nil {
 		t.Errorf("request test returned an error: %s", err)
 	}
 }
 
-func TestConcurrencyStateResumeResponse(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusBadRequest)
-	}))
-	defer ts.Close()
-
-	tokenPath := filepath.Join(t.TempDir(), "secret")
-	if err := os.WriteFile(tokenPath, []byte("0123456789"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	c := NewConcurrencyEndpoint(ts.URL, tokenPath)
-	if err := c.Resume(); err == nil {
-		t.Errorf("resume function did not return an error")
-	}
-}
-
 func TestConcurrencyStateErrorRetryOperation(t *testing.T) {
 	reqCnt := 0
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -403,12 +391,8 @@ func BenchmarkConcurrencyStateProxyHandler(b *testing.B) {
 				promStatReporter.Report(stats.Report(now))
 			}
 		}()
-		pause := func() error {
-			return nil
-		}
-		resume := func() error {
-			return nil
-		}
+		pause := func(*zap.SugaredLogger) {}
+		resume := func(*zap.SugaredLogger) {}
 
 		h := ConcurrencyStateHandler(logger, ProxyHandler(tc.breaker, stats, true /*tracingEnabled*/, baseHandler), pause, resume)
 		b.Run("sequential-"+tc.label, func(b *testing.B) {
diff --git a/pkg/queue/health/handler_test.go b/pkg/queue/health/handler_test.go
index 1fdcf9599..9dba5f0dd 100644
--- a/pkg/queue/health/handler_test.go
+++ b/pkg/queue/health/handler_test.go
@@ -23,17 +23,12 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"go.uber.org/atomic"
 
 	"knative.dev/pkg/network"
 	"knative.dev/serving/pkg/queue"
 )
 
 func TestProbeHandler(t *testing.T) {
-	var passed atomic.Int32
-	incHandler := http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
-		passed.Inc()
-	})
 	testcases := []struct {
 		name          string
 		prober        func() bool
@@ -65,9 +60,9 @@ func TestProbeHandler(t *testing.T) {
 		wantCode:      http.StatusServiceUnavailable,
 		requestHeader: queue.Name,
 	}, {
-		name:      "not a probe, verify chaining",
+		name:      "must be called with a probe header",
 		notAProbe: true,
-		wantCode:  http.StatusOK,
+		wantCode:  http.StatusBadRequest,
 	}}
 
 	for _, tc := range testcases {
@@ -79,7 +74,7 @@ func TestProbeHandler(t *testing.T) {
 				req.Header.Set(network.ProbeHeaderName, tc.requestHeader)
 			}
 
-			h := ProbeHandler(tc.prober, true /*tracingEnabled*/, incHandler)
+			h := ProbeHandler(tc.prober, true /*tracingEnabled*/)
 			h(writer, req)
 
 			if got, want := writer.Code, tc.wantCode; got != want {
diff --git a/pkg/reconciler/autoscaling/hpa/resources/hpa_test.go b/pkg/reconciler/autoscaling/hpa/resources/hpa_test.go
index 4879e8a72..d0f1008dd 100644
--- a/pkg/reconciler/autoscaling/hpa/resources/hpa_test.go
+++ b/pkg/reconciler/autoscaling/hpa/resources/hpa_test.go
@@ -106,6 +106,32 @@ func TestMakeHPA(t *testing.T) {
 					},
 				},
 			})),
+	}, {
+		name: "with window annotation",
+		pa:   pa(WithTargetAnnotation("50"), WithMetricAnnotation(autoscaling.CPU), WithWindowAnnotation("60s")),
+		want: hpa(
+			withAnnotationValue(autoscaling.MetricAnnotationKey, autoscaling.CPU),
+			withAnnotationValue(autoscaling.TargetAnnotationKey, "50"),
+			withAnnotationValue(autoscaling.WindowAnnotationKey, "60s"),
+			withMetric(autoscalingv2beta2.MetricSpec{
+				Type: autoscalingv2beta2.ResourceMetricSourceType,
+				Resource: &autoscalingv2beta2.ResourceMetricSource{
+					Name: corev1.ResourceCPU,
+					Target: autoscalingv2beta2.MetricTarget{
+						Type:               autoscalingv2beta2.UtilizationMetricType,
+						AverageUtilization: ptr.Int32(50),
+					},
+				},
+			}),
+			withBehavior(&autoscalingv2beta2.HorizontalPodAutoscalerBehavior{
+				ScaleDown: &autoscalingv2beta2.HPAScalingRules{
+					StabilizationWindowSeconds: ptr.Int32(60),
+				},
+				ScaleUp: &autoscalingv2beta2.HPAScalingRules{
+					StabilizationWindowSeconds: ptr.Int32(60),
+				},
+			}),
+		),
 	}}
 
 	for _, tc := range cases {
@@ -210,6 +236,12 @@ func withMetric(m autoscalingv2beta2.MetricSpec) hpaOption {
 	}
 }
 
+func withBehavior(m *autoscalingv2beta2.HorizontalPodAutoscalerBehavior) hpaOption {
+	return func(hpa *autoscalingv2beta2.HorizontalPodAutoscaler) {
+		hpa.Spec.Behavior = m
+	}
+}
+
 var config = &autoscalerconfig.Config{
 	EnableScaleToZero:                  true,
 	ContainerConcurrencyTargetFraction: 1.0,
diff --git a/pkg/reconciler/autoscaling/kpa/kpa_test.go b/pkg/reconciler/autoscaling/kpa/kpa_test.go
index 0cf6890e5..e0e088700 100644
--- a/pkg/reconciler/autoscaling/kpa/kpa_test.go
+++ b/pkg/reconciler/autoscaling/kpa/kpa_test.go
@@ -111,6 +111,7 @@ func defaultConfigMapData() map[string]string {
 		"panic-window":                            "10s",
 		"scale-to-zero-grace-period":              gracePeriod.String(),
 		"tick-interval":                           "2s",
+		"min-scale":                               "0",
 	}
 }
 
@@ -118,6 +119,7 @@ func initialScaleZeroASConfig() *autoscalerconfig.Config {
 	ac, _ := asconfig.NewConfigFromMap(defaultConfigMapData())
 	ac.AllowZeroInitialScale = true
 	ac.InitialScale = 0
+	ac.MinScale = 0
 	ac.EnableScaleToZero = true
 	return ac
 }
diff --git a/pkg/reconciler/domainmapping/resources/certificate_test.go b/pkg/reconciler/domainmapping/resources/certificate_test.go
index 07349ad58..d26ebd3c5 100644
--- a/pkg/reconciler/domainmapping/resources/certificate_test.go
+++ b/pkg/reconciler/domainmapping/resources/certificate_test.go
@@ -23,6 +23,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	"knative.dev/networking/pkg/apis/networking"
 	networkingv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
 	duckv1 "knative.dev/pkg/apis/duck/v1"
 	"knative.dev/pkg/kmeta"
@@ -55,7 +56,7 @@ func TestMakeCertificate(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name:        "mapping.com",
 				Namespace:   "the-namespace",
-				Annotations: map[string]string{"networking.knative.dev/certificate.class": certClass},
+				Annotations: map[string]string{networking.CertificateClassAnnotationKey: certClass},
 				Labels: map[string]string{
 					serving.DomainMappingUIDLabelKey: "mapping.com",
 				},
@@ -90,8 +91,8 @@ func TestMakeCertificate(t *testing.T) {
 				Name:      "mapping.com",
 				Namespace: "the-namespace",
 				Annotations: map[string]string{
-					"networking.knative.dev/certificate.class": certClass,
-					"others": "kept",
+					networking.CertificateClassAnnotationKey: certClass,
+					"others":                                 "kept",
 				},
 				Labels: map[string]string{
 					serving.DomainMappingUIDLabelKey: "mapping.com",
diff --git a/pkg/reconciler/domainmapping/resources/ingress_test.go b/pkg/reconciler/domainmapping/resources/ingress_test.go
index d82826a90..c9e32488f 100644
--- a/pkg/reconciler/domainmapping/resources/ingress_test.go
+++ b/pkg/reconciler/domainmapping/resources/ingress_test.go
@@ -25,6 +25,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	network "knative.dev/networking/pkg"
+	"knative.dev/networking/pkg/apis/networking"
 	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
 	"knative.dev/pkg/apis"
 	duckv1 "knative.dev/pkg/apis/duck/v1"
@@ -64,8 +65,8 @@ func TestMakeIngress(t *testing.T) {
 				Name:      "mapping.com",
 				Namespace: "the-namespace",
 				Annotations: map[string]string{
-					"networking.knative.dev/ingress.class": "the-ingress-class",
-					"some.annotation":                      "some.value",
+					networking.IngressClassAnnotationKey: "the-ingress-class",
+					"some.annotation":                    "some.value",
 				},
 			},
 			Spec: netv1alpha1.IngressSpec{
@@ -120,8 +121,8 @@ func TestMakeIngress(t *testing.T) {
 				Name:      "mapping.com",
 				Namespace: "the-namespace",
 				Annotations: map[string]string{
-					"networking.knative.dev/ingress.class": "the-ingress-class",
-					"some.annotation":                      "some.value",
+					networking.IngressClassAnnotationKey: "the-ingress-class",
+					"some.annotation":                    "some.value",
 				},
 			},
 			Spec: netv1alpha1.IngressSpec{
@@ -186,8 +187,8 @@ func TestMakeIngress(t *testing.T) {
 				Name:      "mapping.com",
 				Namespace: "the-namespace",
 				Annotations: map[string]string{
-					"networking.knative.dev/ingress.class": "the-ingress-class",
-					"some.annotation":                      "some.value",
+					networking.IngressClassAnnotationKey: "the-ingress-class",
+					"some.annotation":                    "some.value",
 				},
 			},
 			Spec: netv1alpha1.IngressSpec{
diff --git a/pkg/reconciler/nscert/nscert_test.go b/pkg/reconciler/nscert/nscert_test.go
index 465acae36..952ecc526 100644
--- a/pkg/reconciler/nscert/nscert_test.go
+++ b/pkg/reconciler/nscert/nscert_test.go
@@ -59,7 +59,10 @@ import (
 	. "knative.dev/serving/pkg/reconciler/testing/v1"
 )
 
-const testCertClass = "dns-01.rocks"
+const (
+	disableWildcardCertLabelKey = "networking.knative.dev/disableWildcardCert"
+	testCertClass               = "dns-01.rocks"
+)
 
 type key int
 
@@ -198,7 +201,7 @@ func TestReconcile(t *testing.T) {
 		Name:                    "create Knative certificate for namespace with explicitly enabled",
 		SkipNamespaceValidation: true,
 		Objects: []runtime.Object{
-			kubeNamespaceWithLabelValue("foo", map[string]string{networking.DisableWildcardCertLabelKey: "false"}),
+			kubeNamespaceWithLabelValue("foo", map[string]string{disableWildcardCertLabelKey: "false"}),
 		},
 		WantCreates: []runtime.Object{
 			knCert(kubeNamespace("foo")),
@@ -211,7 +214,7 @@ func TestReconcile(t *testing.T) {
 		Name:                    "create Knative certificate for namespace with explicitly enabled for internal label",
 		SkipNamespaceValidation: true,
 		Objects: []runtime.Object{
-			kubeNamespaceWithLabelValue("foo", map[string]string{networking.DisableWildcardCertLabelKey: "false"}),
+			kubeNamespaceWithLabelValue("foo", map[string]string{disableWildcardCertLabelKey: "false"}),
 		},
 		WantCreates: []runtime.Object{
 			knCert(kubeNamespace("foo")),
@@ -238,13 +241,13 @@ func TestReconcile(t *testing.T) {
 		Key:  "foo",
 		Objects: []runtime.Object{
 			kubeNamespaceWithLabelValue("foo", map[string]string{
-				networking.DisableWildcardCertLabelKey: "true",
+				disableWildcardCertLabelKey: "true",
 			}),
 		},
 		Ctx: context.WithValue(context.Background(), netConfigContextKey,
 			&metav1.LabelSelector{
 				MatchExpressions: []metav1.LabelSelectorRequirement{{
-					Key:      networking.DisableWildcardCertLabelKey,
+					Key:      disableWildcardCertLabelKey,
 					Operator: "NotIn",
 					Values:   []string{"true"},
 				}}}),
@@ -270,7 +273,7 @@ func TestReconcile(t *testing.T) {
 		Name: "disabling namespace cert feature deletes the cert",
 		Key:  "foo",
 		Objects: []runtime.Object{
-			kubeNamespaceWithLabelValue("foo", map[string]string{networking.DisableWildcardCertLabelKey: "true"}),
+			kubeNamespaceWithLabelValue("foo", map[string]string{disableWildcardCertLabelKey: "true"}),
 			knCert(kubeNamespace("foo")),
 		},
 		SkipNamespaceValidation: true,
@@ -288,7 +291,7 @@ func TestReconcile(t *testing.T) {
 		Ctx: context.WithValue(context.Background(), netConfigContextKey,
 			&metav1.LabelSelector{
 				MatchExpressions: []metav1.LabelSelectorRequirement{{
-					Key:      networking.DisableWildcardCertLabelKey,
+					Key:      disableWildcardCertLabelKey,
 					Operator: "NotIn",
 					Values:   []string{"true"},
 				}}}),
diff --git a/pkg/reconciler/route/reconcile_resources_test.go b/pkg/reconciler/route/reconcile_resources_test.go
index 521df64ee..7e8335bfb 100644
--- a/pkg/reconciler/route/reconcile_resources_test.go
+++ b/pkg/reconciler/route/reconcile_resources_test.go
@@ -608,7 +608,7 @@ func TestReconcileIngressClassAnnotation(t *testing.T) {
 	}
 
 	updated = getRouteIngressFromClient(ctx, t, r)
-	updatedClass := updated.Annotations[networking.IngressClassAnnotationKey]
+	updatedClass := networking.GetIngressClass(updated.Annotations)
 	if expClass != updatedClass {
 		t.Errorf("Unexpected annotation got %q want %q", expClass, updatedClass)
 	}
diff --git a/test/config/ytt/ingress/ambassador/ambassador-ingress-class.yaml b/test/config/ytt/ingress/ambassador/ambassador-ingress-class.yaml
deleted file mode 100644
index 7544ae23e..000000000
--- a/test/config/ytt/ingress/ambassador/ambassador-ingress-class.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-
-#@data/values
----
-serving:
-  ingress_class: ambassador.ingress.networking.knative.dev
diff --git a/test/config/ytt/ingress/ambassador/ambassador-replicas.yaml b/test/config/ytt/ingress/ambassador/ambassador-replicas.yaml
deleted file mode 100644
index c28335313..000000000
--- a/test/config/ytt/ingress/ambassador/ambassador-replicas.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-#@ load("helpers.lib.yaml", "subset")
-
-#@overlay/match by=subset(kind="Deployment", name="ambassador")
----
-spec:
-  #@overlay/match missing_ok=True
-  replicas: 6
diff --git a/test/config/ytt/ingress/kong/kong-ingress-class.yaml b/test/config/ytt/ingress/kong/kong-ingress-class.yaml
deleted file mode 100644
index c69698874..000000000
--- a/test/config/ytt/ingress/kong/kong-ingress-class.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-
-#@data/values
----
-serving:
-  ingress_class: kong
diff --git a/test/config/ytt/ingress/kong/kong-replicas.yaml b/test/config/ytt/ingress/kong/kong-replicas.yaml
deleted file mode 100644
index 22e5df51b..000000000
--- a/test/config/ytt/ingress/kong/kong-replicas.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-#@ load("helpers.lib.yaml", "subset")
-
-#@overlay/match by=subset(kind="Deployment", name="ingress-kong")
----
-spec:
-  #@overlay/match missing_ok=True
-  replicas: 6
diff --git a/test/config/ytt/kind/ingress/ambassador-kind.yaml b/test/config/ytt/kind/ingress/ambassador-kind.yaml
deleted file mode 100644
index 501ef81f1..000000000
--- a/test/config/ytt/kind/ingress/ambassador-kind.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-#@ load("helpers.lib.yaml", "subset")
-
-#@overlay/match by=subset(kind="Deployment", name="ambassador")
----
-spec:
-  #@overlay/match missing_ok=True
-  replicas: 1
diff --git a/test/config/ytt/kind/ingress/kong-kind.yaml b/test/config/ytt/kind/ingress/kong-kind.yaml
deleted file mode 100644
index 03c2b1717..000000000
--- a/test/config/ytt/kind/ingress/kong-kind.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-#@ load("helpers.lib.yaml", "subset")
-
-#@overlay/match by=subset(kind="Deployment", name="ingress-kong")
----
-spec:
-  #@overlay/match missing_ok=True
-  replicas: 1
diff --git a/test/e2e-common.sh b/test/e2e-common.sh
index 7f564936c..f872e5038 100644
--- a/test/e2e-common.sh
+++ b/test/e2e-common.sh
@@ -24,7 +24,6 @@ export CERT_MANAGER_VERSION="latest"
 export INGRESS_CLASS=${INGRESS_CLASS:-istio.ingress.networking.knative.dev}
 export ISTIO_VERSION="latest"
 export KOURIER_VERSION=""
-export AMBASSADOR_VERSION=""
 export CONTOUR_VERSION=""
 export CERTIFICATE_CLASS=""
 # Only build linux/amd64 bit images
@@ -143,13 +142,6 @@ function parse_flags() {
       readonly INGRESS_CLASS="kourier.ingress.networking.knative.dev"
       return 2
       ;;
-    --ambassador-version)
-      # currently, the value of --ambassador-version is ignored
-      # latest version of Ambassador pinned in third_party will be installed
-      readonly AMBASSADOR_VERSION=$2
-      readonly INGRESS_CLASS="ambassador.ingress.networking.knative.dev"
-      return 2
-      ;;
     --contour-version)
       # currently, the value of --contour-version is ignored
       # latest version of Contour pinned in third_party will be installed
@@ -157,13 +149,6 @@ function parse_flags() {
       readonly INGRESS_CLASS="contour.ingress.networking.knative.dev"
       return 2
       ;;
-    --kong-version)
-      # currently, the value of --kong-version is ignored
-      # latest version of Kong pinned in third_party will be installed
-      readonly KONG_VERSION=$2
-      readonly INGRESS_CLASS="kong"
-      return 2
-      ;;
     --system-namespace)
       [[ -z "$2" ]] || [[ $2 = --* ]] && fail_test "Missing argument to --system-namespace"
       export SYSTEM_NAMESPACE=$2
diff --git a/test/e2e-networking-library.sh b/test/e2e-networking-library.sh
index b0fc6efd6..35e0ecaca 100644
--- a/test/e2e-networking-library.sh
+++ b/test/e2e-networking-library.sh
@@ -101,17 +101,9 @@ function setup_ingress_env_vars() {
     export GATEWAY_OVERRIDE=kourier
     export GATEWAY_NAMESPACE_OVERRIDE=kourier-system
   fi
-  if is_ingress_class ambassador; then
-    export GATEWAY_OVERRIDE=ambassador
-    export GATEWAY_NAMESPACE_OVERRIDE=ambassador
-  fi
   if is_ingress_class contour; then
     export GATEWAY_OVERRIDE=envoy
     export GATEWAY_NAMESPACE_OVERRIDE=contour-external
   fi
-  if is_ingress_class kong; then
-    export GATEWAY_OVERRIDE=kong-proxy
-    export GATEWAY_NAMESPACE_OVERRIDE=kong
-  fi
 }
 
diff --git a/third_party/ambassador-latest/README.md b/third_party/ambassador-latest/README.md
deleted file mode 100644
index 231d690d7..000000000
--- a/third_party/ambassador-latest/README.md
+++ /dev/null
@@ -1,37 +0,0 @@
-### Ambassador
-
-`ambassador-rbac.yaml` and `ambassador-service.yaml` are required to install
-Ambassador. These need to be updated every time Ambassador's version is bumped.
-Detailed instructions on installing Ambassador are available
-[here](https://www.getambassador.io/user-guide/getting-started/).
-
-These files are hosted at:
-
-- https://www.getambassador.io/yaml/ambassador/ambassador-crds.yaml
-- https://www.getambassador.io/yaml/ambassador/ambassador-rbac.yaml
-
-After updating the files, make sure any other modifications required to run
-Knative with Ambassador are made as well. For instance:
-
-- Set the environment variable `AMBASSADOR_KNATIVE_SUPPORT` to `true` in the
-  deployment `ambassador`.
-- Update the namespace in the ClusterRoleBinding `ambassador` to `ambassador`.
-  It should look like:
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: ambassador
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ambassador
-subjects:
-  - kind: ServiceAccount
-    name: ambassador
-    namespace: ambassador
-```
-
-Make sure the modifications are done as per the
-[installation documentation](https://knative.dev/docs/install/).
diff --git a/third_party/ambassador-latest/ambassador-crds.yaml b/third_party/ambassador-latest/ambassador-crds.yaml
deleted file mode 100644
index ee1df7316..000000000
--- a/third_party/ambassador-latest/ambassador-crds.yaml
+++ /dev/null
@@ -1,293 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: authservices.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: AuthService
-    plural: authservices
-    singular: authservice
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: consulresolvers.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: ConsulResolver
-    plural: consulresolvers
-    singular: consulresolver
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: hosts.getambassador.io
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .spec.hostname
-    name: Hostname
-    type: string
-  - JSONPath: .status.state
-    name: State
-    type: string
-  - JSONPath: .status.phaseCompleted
-    name: Phase Completed
-    type: string
-  - JSONPath: .status.phasePending
-    name: Phase Pending
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    name: Age
-    type: date
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: Host
-    plural: hosts
-    singular: host
-  scope: Namespaced
-  subresources:
-    status: {}
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kubernetesendpointresolvers.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: KubernetesEndpointResolver
-    plural: kubernetesendpointresolvers
-    singular: kubernetesendpointresolver
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kubernetesserviceresolvers.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: KubernetesServiceResolver
-    plural: kubernetesserviceresolvers
-    singular: kubernetesserviceresolver
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: logservices.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: LogService
-    plural: logservices
-    singular: logservice
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: mappings.getambassador.io
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .spec.prefix
-    name: Prefix
-    type: string
-  - JSONPath: .spec.service
-    name: Service
-    type: string
-  - JSONPath: .status.state
-    name: State
-    type: string
-  - JSONPath: .status.reason
-    name: Reason
-    type: string
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: Mapping
-    plural: mappings
-    singular: mapping
-  scope: Namespaced
-  subresources:
-    status: {}
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: modules.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: Module
-    plural: modules
-    singular: module
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: ratelimitservices.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: RateLimitService
-    plural: ratelimitservices
-    singular: ratelimitservice
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: tcpmappings.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: TCPMapping
-    plural: tcpmappings
-    singular: tcpmapping
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: tlscontexts.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: TLSContext
-    plural: tlscontexts
-    singular: tlscontext
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: tracingservices.getambassador.io
-spec:
-  group: getambassador.io
-  names:
-    categories:
-    - ambassador-crds
-    kind: TracingService
-    plural: tracingservices
-    singular: tracingservice
-  scope: Namespaced
-  version: v2
-  versions:
-  - name: v2
-    served: true
-    storage: true
-  - name: v1
-    served: true
-    storage: false
diff --git a/third_party/ambassador-latest/ambassador-namespace.yaml b/third_party/ambassador-latest/ambassador-namespace.yaml
deleted file mode 100644
index ece11b279..000000000
--- a/third_party/ambassador-latest/ambassador-namespace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ambassador
diff --git a/third_party/ambassador-latest/ambassador-rbac.yaml b/third_party/ambassador-latest/ambassador-rbac.yaml
deleted file mode 100644
index 8f112fc7e..000000000
--- a/third_party/ambassador-latest/ambassador-rbac.yaml
+++ /dev/null
@@ -1,145 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    service: ambassador-admin
-    app.kubernetes.io/managed-by: getambassador.io
-  name: ambassador-admin
-  namespace: ambassador
-spec:
-  type: NodePort
-  ports:
-  - name: ambassador-admin
-    port: 8877
-    targetPort: 8877
-  selector:
-    service: ambassador
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: ambassador
-rules:
-- apiGroups: [""]
-  resources: [ "endpoints", "namespaces", "secrets", "services" ]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [ "getambassador.io" ]
-  resources: [ "*" ]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [ "getambassador.io" ]
-  resources: [ "mappings/status" ]
-  verbs: ["update"]
-- apiGroups: [ "apiextensions.k8s.io" ]
-  resources: [ "customresourcedefinitions" ]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [ "networking.internal.knative.dev" ]
-  resources: [ "clusteringresses", "ingresses" ]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [ "networking.internal.knative.dev" ]
-  resources: [ "ingresses/status", "clusteringresses/status" ]
-  verbs: ["update"]
-- apiGroups: [ "extensions", "networking.k8s.io" ]
-  resources: [ "ingresses", "ingressclasses" ]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [ "extensions", "networking.k8s.io" ]
-  resources: [ "ingresses/status" ]
-  verbs: ["update"]
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ambassador
-  namespace: ambassador
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: ambassador
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ambassador
-subjects:
-- kind: ServiceAccount
-  name: ambassador
-  namespace: ambassador
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ambassador
-  namespace: ambassador
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      service: ambassador
-  template:
-    metadata:
-      annotations:
-        consul.hashicorp.com/connect-inject: 'false'
-        sidecar.istio.io/inject: 'false'
-      labels:
-        service: ambassador
-        app.kubernetes.io/managed-by: getambassador.io
-    spec:
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchLabels:
-                  service: ambassador
-              topologyKey: kubernetes.io/hostname
-            weight: 100
-      containers:
-      - env:
-        - name: AMBASSADOR_KNATIVE_SUPPORT
-          value: "true"
-        - name: AMBASSADOR_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        image: quay.io/datawire/ambassador:1.4.2
-        livenessProbe:
-          httpGet:
-            path: /ambassador/v0/check_alive
-            port: 8877
-          initialDelaySeconds: 30
-          periodSeconds: 3
-        name: ambassador
-        ports:
-        - containerPort: 8080
-          name: http
-        - containerPort: 8443
-          name: https
-        - containerPort: 8877
-          name: admin
-        readinessProbe:
-          httpGet:
-            path: /ambassador/v0/check_ready
-            port: 8877
-          initialDelaySeconds: 30
-          periodSeconds: 3
-        resources:
-          limits:
-            cpu: 1
-            memory: 400Mi
-          requests:
-            cpu: 200m
-            memory: 100Mi
-        volumeMounts:
-        - mountPath: /tmp/ambassador-pod-info
-          name: ambassador-pod-info
-      restartPolicy: Always
-      securityContext:
-        runAsUser: 8888
-      serviceAccountName: ambassador
-      volumes:
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-        name: ambassador-pod-info
diff --git a/third_party/ambassador-latest/ambassador-service.yaml b/third_party/ambassador-latest/ambassador-service.yaml
deleted file mode 100644
index 21550677e..000000000
--- a/third_party/ambassador-latest/ambassador-service.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ambassador
-  namespace: ambassador
-  labels:
-    app.kubernetes.io/component: ambassador-service
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  ports:
-   - port: 80
-     targetPort: 8080
-     name: http
-   - port: 443
-     targetPort: 8443
-     name: https
-  selector:
-    service: ambassador
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index fb5f70711..37b8f0dff 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,9 +19,9 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -53,9 +53,9 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
   - admissionReviewVersions:
@@ -95,9 +95,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
 
 ---
@@ -122,9 +122,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -172,9 +172,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -187,16 +187,16 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20211112-fb971861"
+        app.kubernetes.io/version: "20211117-680fe929"
         app.kubernetes.io/name: knative-serving
-        serving.knative.dev/release: "v20211112-fb971861"
+        serving.knative.dev/release: "v20211117-680fe929"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:e5fc03d9841280b484329ff0180c363e8a4e7ada32216ecee89d89e41862b0c8
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:6f75591bf78b73a074eb73437e55458c76835e3ae81557f0c818b6eb4fd9a730
           resources:
             requests:
               cpu: 30m
@@ -235,9 +235,9 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
   namespace: knative-serving
@@ -275,9 +275,9 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -291,17 +291,17 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20211112-fb971861"
+        app.kubernetes.io/version: "20211117-680fe929"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20211112-fb971861"
+        serving.knative.dev/release: "v20211117-680fe929"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:e9082549f98c748c3a68b39aa0ea79d3b495b57655ab01b60abea2159ea07910
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:1c2e54173658bfa4a1550501f3dc070efb8b11be8552a01a46ae354b608ec135
           resources:
             requests:
               cpu: 20m
@@ -361,9 +361,9 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20211112-fb971861"
+    app.kubernetes.io/version: "20211117-680fe929"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211112-fb971861"
+    serving.knative.dev/release: "v20211117-680fe929"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   ports:
diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index d89c9ee98..f1a7a4bb4 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -1904,7 +1904,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -2155,7 +2155,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2244,7 +2244,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2340,7 +2340,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -2619,7 +2619,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -2731,7 +2731,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2820,7 +2820,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2916,7 +2916,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:5512e1d089e2974aa32a609a0185293b65dac8118115859cb6c947d58d7f5201
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:89e6e7bf27078258ae426ae27a1a1102a1ae7570bdacb6eb56ed29d13abaf0dc
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 9c7511cbf..622d76883 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211115-ceb06401"
+    app.kubernetes.io/version: "20211118-49f0a37a"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,8 +38,8 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211115-ceb06401"
-    serving.knative.dev/release: "v20211115-ceb06401"
+    app.kubernetes.io/version: "20211118-49f0a37a"
+    serving.knative.dev/release: "v20211118-49f0a37a"
 data:
   _example: |
     ################################
@@ -105,14 +105,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20211115-ceb06401"
+        app.kubernetes.io/version: "20211118-49f0a37a"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:f0ee1d73869036ef4f9b034769d75e5f8bcd4559f20d345101a57537de97e20f
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:a0c077668d6f40ea1074ff875ee7542c210d479242afed4f9c7ec0a34520ee0c
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 5a09ba2cf..e74f8c514 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was b499a26fdf9ec4cfc1d42a6700ce22c3307172de
+# Generated when HEAD was 572f531e1a5faee3ff035817df545c84b35d6871
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,8 +22,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -55,8 +55,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -95,8 +95,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -117,8 +117,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -153,8 +153,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -220,8 +220,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -239,8 +239,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -258,8 +258,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -292,8 +292,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -311,15 +311,15 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20211114-b499a26f"
-        serving.knative.dev/release: "v20211114-b499a26f"
+        app.kubernetes.io/version: "20211118-572f531e"
+        serving.knative.dev/release: "v20211118-572f531e"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:29a2f8913d5e7c1d6775da32efa1a17b4c1d1d6f7792c674494e196c435bd9ee
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:15a668db401fc4281991fca4183d7f2fb39ac6682529e6561b2ed3d9aa63f79f
           resources:
             requests:
               cpu: 30m
@@ -378,8 +378,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -395,15 +395,15 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20211114-b499a26f"
-        serving.knative.dev/release: "v20211114-b499a26f"
+        app.kubernetes.io/version: "20211118-572f531e"
+        serving.knative.dev/release: "v20211118-572f531e"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:ba31ddd8b94b40eef34c8336bb8594f7363b84a84ac1bdcafd813e24ebda1338
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:63a15c401708e931f09e6209013ee5e8dddb89e4916b7a047cd6841db7c72b86
           resources:
             requests:
               cpu: 20m
@@ -458,8 +458,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -486,8 +486,8 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -526,8 +526,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -566,8 +566,8 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20211114-b499a26f"
-    serving.knative.dev/release: "v20211114-b499a26f"
+    app.kubernetes.io/version: "20211118-572f531e"
+    serving.knative.dev/release: "v20211118-572f531e"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
diff --git a/third_party/kong-latest/README.md b/third_party/kong-latest/README.md
deleted file mode 100644
index d2852885e..000000000
--- a/third_party/kong-latest/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-The kong.yaml file is generated by running
-
-```
-./download-kong.sh
-```
diff --git a/third_party/kong-latest/download-kong.sh b/third_party/kong-latest/download-kong.sh
deleted file mode 100755
index 42e685f37..000000000
--- a/third_party/kong-latest/download-kong.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2019 The Knative Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -ex
-
-# Download Kong
-KONG_VERSION=0.9.x
-KONG_YAML=all-in-one-dbless.yaml
-DOWNLOAD_URL=https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/${KONG_VERSION}/deploy/single/${KONG_YAML}
-
-wget -O kong.yaml ${DOWNLOAD_URL}
diff --git a/third_party/kong-latest/kong.yaml b/third_party/kong-latest/kong.yaml
deleted file mode 100644
index ab54e2e3c..000000000
--- a/third_party/kong-latest/kong.yaml
+++ /dev/null
@@ -1,750 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kong
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongclusterplugins.configuration.konghq.com
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .plugin
-    description: Name of the plugin
-    name: Plugin-Type
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    description: Age
-    name: Age
-    type: date
-  - JSONPath: .disabled
-    description: Indicates if the plugin is disabled
-    name: Disabled
-    priority: 1
-    type: boolean
-  - JSONPath: .config
-    description: Configuration of the plugin
-    name: Config
-    priority: 1
-    type: string
-  group: configuration.konghq.com
-  names:
-    kind: KongClusterPlugin
-    plural: kongclusterplugins
-    shortNames:
-    - kcp
-  scope: Cluster
-  validation:
-    openAPIV3Schema:
-      properties:
-        config:
-          type: object
-        configFrom:
-          properties:
-            secretKeyRef:
-              properties:
-                key:
-                  type: string
-                name:
-                  type: string
-                namespace:
-                  type: string
-              required:
-              - name
-              - namespace
-              - key
-              type: object
-          type: object
-        disabled:
-          type: boolean
-        plugin:
-          type: string
-        protocols:
-          items:
-            enum:
-            - http
-            - https
-            - grpc
-            - grpcs
-            - tcp
-            - tls
-            type: string
-          type: array
-        run_on:
-          enum:
-          - first
-          - second
-          - all
-          type: string
-      required:
-      - plugin
-  version: v1
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongconsumers.configuration.konghq.com
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .username
-    description: Username of a Kong Consumer
-    name: Username
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    description: Age
-    name: Age
-    type: date
-  group: configuration.konghq.com
-  names:
-    kind: KongConsumer
-    plural: kongconsumers
-    shortNames:
-    - kc
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        credentials:
-          items:
-            type: string
-          type: array
-        custom_id:
-          type: string
-        username:
-          type: string
-  version: v1
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongcredentials.configuration.konghq.com
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .type
-    description: Type of credential
-    name: Credential-type
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    description: Age
-    name: Age
-    type: date
-  - JSONPath: .consumerRef
-    description: Owner of the credential
-    name: Consumer-Ref
-    type: string
-  group: configuration.konghq.com
-  names:
-    kind: KongCredential
-    plural: kongcredentials
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        consumerRef:
-          type: string
-        type:
-          type: string
-      required:
-      - consumerRef
-      - type
-  version: v1
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongingresses.configuration.konghq.com
-spec:
-  group: configuration.konghq.com
-  names:
-    kind: KongIngress
-    plural: kongingresses
-    shortNames:
-    - ki
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        proxy:
-          properties:
-            connect_timeout:
-              minimum: 0
-              type: integer
-            path:
-              pattern: ^/.*$
-              type: string
-            protocol:
-              enum:
-              - http
-              - https
-              - grpc
-              - grpcs
-              - tcp
-              - tls
-              type: string
-            read_timeout:
-              minimum: 0
-              type: integer
-            retries:
-              minimum: 0
-              type: integer
-            write_timeout:
-              minimum: 0
-              type: integer
-          type: object
-        route:
-          properties:
-            headers:
-              additionalProperties:
-                items:
-                  type: string
-                type: array
-              type: object
-            https_redirect_status_code:
-              type: integer
-            methods:
-              items:
-                type: string
-              type: array
-            path_handling:
-              enum:
-              - v0
-              - v1
-              type: string
-            preserve_host:
-              type: boolean
-            protocols:
-              items:
-                enum:
-                - http
-                - https
-                - grpc
-                - grpcs
-                - tcp
-                - tls
-                type: string
-              type: array
-            regex_priority:
-              type: integer
-            strip_path:
-              type: boolean
-        upstream:
-          properties:
-            algorithm:
-              enum:
-              - round-robin
-              - consistent-hashing
-              - least-connections
-              type: string
-            hash_fallback:
-              type: string
-            hash_fallback_header:
-              type: string
-            hash_on:
-              type: string
-            hash_on_cookie:
-              type: string
-            hash_on_cookie_path:
-              type: string
-            hash_on_header:
-              type: string
-            healthchecks:
-              properties:
-                active:
-                  properties:
-                    concurrency:
-                      minimum: 1
-                      type: integer
-                    healthy:
-                      properties:
-                        http_statuses:
-                          items:
-                            type: integer
-                          type: array
-                        interval:
-                          minimum: 0
-                          type: integer
-                        successes:
-                          minimum: 0
-                          type: integer
-                      type: object
-                    http_path:
-                      pattern: ^/.*$
-                      type: string
-                    timeout:
-                      minimum: 0
-                      type: integer
-                    unhealthy:
-                      properties:
-                        http_failures:
-                          minimum: 0
-                          type: integer
-                        http_statuses:
-                          items:
-                            type: integer
-                          type: array
-                        interval:
-                          minimum: 0
-                          type: integer
-                        tcp_failures:
-                          minimum: 0
-                          type: integer
-                        timeout:
-                          minimum: 0
-                          type: integer
-                      type: object
-                  type: object
-                passive:
-                  properties:
-                    healthy:
-                      properties:
-                        http_statuses:
-                          items:
-                            type: integer
-                          type: array
-                        interval:
-                          minimum: 0
-                          type: integer
-                        successes:
-                          minimum: 0
-                          type: integer
-                      type: object
-                    unhealthy:
-                      properties:
-                        http_failures:
-                          minimum: 0
-                          type: integer
-                        http_statuses:
-                          items:
-                            type: integer
-                          type: array
-                        interval:
-                          minimum: 0
-                          type: integer
-                        tcp_failures:
-                          minimum: 0
-                          type: integer
-                        timeout:
-                          minimum: 0
-                          type: integer
-                      type: object
-                  type: object
-                threshold:
-                  type: integer
-              type: object
-            host_header:
-              type: string
-            slots:
-              minimum: 10
-              type: integer
-          type: object
-  version: v1
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongplugins.configuration.konghq.com
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .plugin
-    description: Name of the plugin
-    name: Plugin-Type
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    description: Age
-    name: Age
-    type: date
-  - JSONPath: .disabled
-    description: Indicates if the plugin is disabled
-    name: Disabled
-    priority: 1
-    type: boolean
-  - JSONPath: .config
-    description: Configuration of the plugin
-    name: Config
-    priority: 1
-    type: string
-  group: configuration.konghq.com
-  names:
-    kind: KongPlugin
-    plural: kongplugins
-    shortNames:
-    - kp
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        config:
-          type: object
-        configFrom:
-          properties:
-            secretKeyRef:
-              properties:
-                key:
-                  type: string
-                name:
-                  type: string
-              required:
-              - name
-              - key
-              type: object
-          type: object
-        disabled:
-          type: boolean
-        plugin:
-          type: string
-        protocols:
-          items:
-            enum:
-            - http
-            - https
-            - grpc
-            - grpcs
-            - tcp
-            - tls
-            type: string
-          type: array
-        run_on:
-          enum:
-          - first
-          - second
-          - all
-          type: string
-      required:
-      - plugin
-  version: v1
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: tcpingresses.configuration.konghq.com
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .status.loadBalancer.ingress[*].ip
-    description: Address of the load balancer
-    name: Address
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    description: Age
-    name: Age
-    type: date
-  group: configuration.konghq.com
-  names:
-    kind: TCPIngress
-    plural: tcpingresses
-  scope: Namespaced
-  subresources:
-    status: {}
-  validation:
-    openAPIV3Schema:
-      properties:
-        apiVersion:
-          type: string
-        kind:
-          type: string
-        metadata:
-          type: object
-        spec:
-          properties:
-            rules:
-              items:
-                properties:
-                  backend:
-                    properties:
-                      serviceName:
-                        type: string
-                      servicePort:
-                        format: int32
-                        type: integer
-                    type: object
-                  host:
-                    type: string
-                  port:
-                    format: int32
-                    type: integer
-                type: object
-              type: array
-            tls:
-              items:
-                properties:
-                  hosts:
-                    items:
-                      type: string
-                    type: array
-                  secretName:
-                    type: string
-                type: object
-              type: array
-          type: object
-        status:
-          type: object
-  version: v1beta1
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kong-serviceaccount
-  namespace: kong
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: kong-ingress-clusterrole
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - endpoints
-  - nodes
-  - pods
-  - secrets
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - networking.k8s.io
-  - extensions
-  - networking.internal.knative.dev
-  resources:
-  - ingresses
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
-- apiGroups:
-  - networking.k8s.io
-  - extensions
-  - networking.internal.knative.dev
-  resources:
-  - ingresses/status
-  verbs:
-  - update
-- apiGroups:
-  - configuration.konghq.com
-  resources:
-  - tcpingresses/status
-  verbs:
-  - update
-- apiGroups:
-  - configuration.konghq.com
-  resources:
-  - kongplugins
-  - kongclusterplugins
-  - kongcredentials
-  - kongconsumers
-  - kongingresses
-  - tcpingresses
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - get
-  - update
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: kong-ingress-clusterrole-nisa-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kong-ingress-clusterrole
-subjects:
-- kind: ServiceAccount
-  name: kong-serviceaccount
-  namespace: kong
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
-    service.beta.kubernetes.io/aws-load-balancer-type: nlb
-  name: kong-proxy
-  namespace: kong
-spec:
-  ports:
-  - name: proxy
-    port: 80
-    protocol: TCP
-    targetPort: 8000
-  - name: proxy-ssl
-    port: 443
-    protocol: TCP
-    targetPort: 8443
-  selector:
-    app: ingress-kong
-  type: LoadBalancer
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kong-validation-webhook
-  namespace: kong
-spec:
-  ports:
-  - name: webhook
-    port: 443
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: ingress-kong
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: ingress-kong
-  name: ingress-kong
-  namespace: kong
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ingress-kong
-  template:
-    metadata:
-      annotations:
-        kuma.io/gateway: enabled
-        prometheus.io/port: "8100"
-        prometheus.io/scrape: "true"
-        traffic.sidecar.istio.io/includeInboundPorts: ""
-      labels:
-        app: ingress-kong
-    spec:
-      containers:
-      - env:
-        - name: KONG_PROXY_LISTEN
-          value: 0.0.0.0:8000, 0.0.0.0:8443 ssl http2
-        - name: KONG_ADMIN_LISTEN
-          value: 127.0.0.1:8444 ssl
-        - name: KONG_STATUS_LISTEN
-          value: 0.0.0.0:8100
-        - name: KONG_DATABASE
-          value: "off"
-        - name: KONG_NGINX_WORKER_PROCESSES
-          value: "1"
-        - name: KONG_ADMIN_ACCESS_LOG
-          value: /dev/stdout
-        - name: KONG_ADMIN_ERROR_LOG
-          value: /dev/stderr
-        - name: KONG_PROXY_ERROR_LOG
-          value: /dev/stderr
-        image: kong:2.0
-        lifecycle:
-          preStop:
-            exec:
-              command:
-              - /bin/sh
-              - -c
-              - kong quit
-        livenessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /status
-            port: 8100
-            scheme: HTTP
-          initialDelaySeconds: 5
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        name: proxy
-        ports:
-        - containerPort: 8000
-          name: proxy
-          protocol: TCP
-        - containerPort: 8443
-          name: proxy-ssl
-          protocol: TCP
-        - containerPort: 8100
-          name: metrics
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /status
-            port: 8100
-            scheme: HTTP
-          initialDelaySeconds: 5
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          runAsUser: 1000
-      - env:
-        - name: CONTROLLER_KONG_ADMIN_URL
-          value: https://127.0.0.1:8444
-        - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
-          value: "true"
-        - name: CONTROLLER_PUBLISH_SERVICE
-          value: kong/kong-proxy
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.namespace
-        image: kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller:0.9.1
-        imagePullPolicy: IfNotPresent
-        livenessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /healthz
-            port: 10254
-            scheme: HTTP
-          initialDelaySeconds: 5
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        name: ingress-controller
-        ports:
-        - containerPort: 8080
-          name: webhook
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /healthz
-            port: 10254
-            scheme: HTTP
-          initialDelaySeconds: 5
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-      serviceAccountName: kong-serviceaccount
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index 0887a1bee..38f795288 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -20,8 +20,8 @@ metadata:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
+    serving.knative.dev/release: "v20211119-c5a44467"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -46,9 +46,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 data:
   envoy-bootstrap.yaml: |
     dynamic_resources:
@@ -152,9 +152,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 data:
   _example: |
     ################################
@@ -200,9 +200,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -212,9 +212,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 rules:
   - apiGroups: [""]
     resources: ["events"]
@@ -242,9 +242,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -277,9 +277,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 spec:
   replicas: 1
   selector:
@@ -291,7 +291,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:9455d00896dcda6b7c8c665f4ee8617666b5327e3e76aa0c3af5d6a67aa874ef
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:4548935e2157ac2bb9c56a37cefd4a25030e78c794ff14dc9210e34326fb183f
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -331,9 +331,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 spec:
   ports:
     - name: grpc-xds
@@ -367,9 +367,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 spec:
   strategy:
     type: RollingUpdate
@@ -445,9 +445,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 spec:
   ports:
     - name: http2
@@ -470,9 +470,9 @@ metadata:
   labels:
     networking.knative.dev/ingress-provider: kourier
     app.kubernetes.io/component: net-kourier
-    app.kubernetes.io/version: "20211115-d89a91a9"
+    app.kubernetes.io/version: "20211119-c5a44467"
     app.kubernetes.io/name: knative-serving
-    serving.knative.dev/release: "v20211115-d89a91a9"
+    serving.knative.dev/release: "v20211119-c5a44467"
 spec:
   ports:
     - name: http2
diff --git a/vendor/knative.dev/pkg/test/spoof/error_checks.go b/vendor/knative.dev/pkg/test/spoof/error_checks.go
index 378bf5824..b0638ad34 100644
--- a/vendor/knative.dev/pkg/test/spoof/error_checks.go
+++ b/vendor/knative.dev/pkg/test/spoof/error_checks.go
@@ -21,6 +21,7 @@ package spoof
 import (
 	"errors"
 	"net"
+	"net/http"
 	"strings"
 )
 
@@ -62,3 +63,8 @@ func isConnectionReset(err error) bool {
 func isNoRouteToHostError(err error) bool {
 	return err != nil && strings.Contains(err.Error(), "connect: no route to host")
 }
+
+func isResponseDNSError(resp *Response) bool {
+	// no such host with 502 is sent back from istio-ingressgateway when it fails to resolve domain.
+	return resp.StatusCode == http.StatusBadGateway && strings.Contains(string(resp.Body), "no such host")
+}
diff --git a/vendor/knative.dev/pkg/test/spoof/spoof.go b/vendor/knative.dev/pkg/test/spoof/spoof.go
index f2baa4edf..147a64adc 100644
--- a/vendor/knative.dev/pkg/test/spoof/spoof.go
+++ b/vendor/knative.dev/pkg/test/spoof/spoof.go
@@ -164,7 +164,7 @@ func (sc *SpoofingClient) Do(req *http.Request, errorRetryCheckers ...interface{
 // If no retry checkers are specified `DefaultErrorRetryChecker` will be used.
 func (sc *SpoofingClient) Poll(req *http.Request, inState ResponseChecker, checkers ...interface{}) (*Response, error) {
 	if len(checkers) == 0 {
-		checkers = []interface{}{ErrorRetryChecker(DefaultErrorRetryChecker)}
+		checkers = []interface{}{ErrorRetryChecker(DefaultErrorRetryChecker), ResponseRetryChecker(DefaultResponseRetryChecker)}
 	}
 
 	var resp *Response
@@ -255,6 +255,14 @@ func DefaultErrorRetryChecker(err error) (bool, error) {
 	return false, err
 }
 
+// DefaultResponseRetryChecker implements the defaults for retrying on response.
+func DefaultResponseRetryChecker(resp *Response) (bool, error) {
+	if isResponseDNSError(resp) {
+		return true, fmt.Errorf("retrying for DNS related failure response: %v", resp)
+	}
+	return false, nil
+}
+
 // logZipkinTrace provides support to log Zipkin Trace for param: spoofResponse
 // We only log Zipkin trace for HTTP server errors i.e for HTTP status codes between 500 to 600
 func (sc *SpoofingClient) logZipkinTrace(spoofResp *Response) {