Repository: knative/serving
Pull request #10314 (2020-12-09 11:19:02)

[Automated] Update net-istio nightly
Produced via:
```shell
for x in net-istio.yaml; do
  curl https://storage.googleapis.com/knative-nightly/net-istio/latest/$x > ${GITHUB_WORKSPACE}/./third_party/istio-latest/$x
done
```
/assign @knative/networking-wg-leads
/cc @knative/networking-wg-leads

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10314#" title="Author self-approved">knative-automation</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **vagababov** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @vagababov` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

<details open>
Needs approval from an approver in each of these files:

- **[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["vagababov"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=h1) Report
> Merging [#10314](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=desc) (e31d2f2) into [master](https://codecov.io/gh/knative/serving/commit/01c4fccd269e089edd3982920e2234f8fad26f0d?el=desc) (01c4fcc) will **decrease** coverage by `0.04%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/knative/serving/pull/10314/graphs/tree.svg?width=650&height=150&src=pr&token=MPpDfAj4Ui)](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master   #10314      +/-   ##
==========================================
- Coverage   88.24%   88.19%   -0.05%     
==========================================
  Files         184      184              
  Lines        8676     8676              
==========================================
- Hits         7656     7652       -4     
- Misses        786      788       +2     
- Partials      234      236       +2     
```


| [Impacted Files](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/reconciler/revision/reconcile\_resources.go](https://codecov.io/gh/knative/serving/pull/10314/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvcmV2aXNpb24vcmVjb25jaWxlX3Jlc291cmNlcy5nbw==) | `80.72% <0.00%> (-2.41%)` | :arrow_down: |
| [pkg/reconciler/autoscaling/kpa/scaler.go](https://codecov.io/gh/knative/serving/pull/10314/diff?src=pr&el=tree#diff-cGtnL3JlY29uY2lsZXIvYXV0b3NjYWxpbmcva3BhL3NjYWxlci5nbw==) | `88.57% <0.00%> (-1.43%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=footer). Last update [01c4fcc...1ac70ae](https://codecov.io/gh/knative/serving/pull/10314?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

knative-prow-robot: @knative-automation: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-knative-serving-istio-stable-no-mesh | 1ac70ae2b4c3b20c37e3d2f2e4892feda3a2f493 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative_serving/10314/pull-knative-serving-istio-stable-no-mesh/1336631471510654976) | `/test pull-knative-serving-istio-stable-no-mesh`

[Full PR test history](https://gubernator.knative.dev/pr/knative_serving/10314). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-automation).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
vagababov: /lgtm
/approve
/retest
knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/serving/pull/10314#" title="Author self-approved">knative-automation</a>*, *<a href="https://github.com/knative/serving/pull/10314#issuecomment-741836377" title="Approved">vagababov</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fserving).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[third_party/OWNERS](https://github.com/knative/serving/blob/master/third_party/OWNERS)~~ [vagababov]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/go.mod b/go.mod
index 56fb7a444..6eac9dd7a 100644
--- a/go.mod
+++ b/go.mod
@@ -36,6 +36,6 @@ require (
 	k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29
 	knative.dev/caching v0.0.0-20201208013740-3ca9791186ed
 	knative.dev/hack v0.0.0-20201201234937-fddbf732e450
-	knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626
-	knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80
+	knative.dev/networking v0.0.0-20201209014241-22a7e22628fc
+	knative.dev/pkg v0.0.0-20201209172941-9b9407a76df1
 )
diff --git a/go.sum b/go.sum
index 7c081bb47..2f036d511 100644
--- a/go.sum
+++ b/go.sum
@@ -1220,11 +1220,13 @@ knative.dev/caching v0.0.0-20201208013740-3ca9791186ed h1:Hl6jZZFVPRv++MDHtD9hy8
 knative.dev/caching v0.0.0-20201208013740-3ca9791186ed/go.mod h1:i+e4gaoBB34anvKMMiQDV86N7HbFYN6m+Op1IRhXXY8=
 knative.dev/hack v0.0.0-20201201234937-fddbf732e450 h1:IyitWF7OzfunCgE4b9ZsJAeIRoQ6JOyqDrz/19X4iS4=
 knative.dev/hack v0.0.0-20201201234937-fddbf732e450/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
-knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626 h1:e8IIJxggzVD7kMNf+4mYY421vcWpD2U1jXXIRDWy7bg=
-knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626/go.mod h1:V4CU4mLLkWboLw3NOVmPHHOCL5nrUO3/vsRDUjsnJUQ=
+knative.dev/networking v0.0.0-20201209014241-22a7e22628fc h1:Zav6xAGiSKddU2ra70oVgYkB3KjJUpiTqi7A5iAaUoE=
+knative.dev/networking v0.0.0-20201209014241-22a7e22628fc/go.mod h1:NPlekJSE5w2vw5mcu8zCBdHsiBq9U/waDbFXrEvpw6Q=
 knative.dev/pkg v0.0.0-20201207225040-7e918163fc4f/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
 knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80 h1:wBRwTtE3saOiXsS/eh4FYDAC/Gj+djH8ZNkvd0OgtmE=
 knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
+knative.dev/pkg v0.0.0-20201209172941-9b9407a76df1 h1:whfizV9at+XvlOK66xm1WfiiPhybrRa9LbZa4uXbWIs=
+knative.dev/pkg v0.0.0-20201209172941-9b9407a76df1/go.mod h1:Jtbz2/1gB8EZgZA4VvabTxM+AcDt2WL2P0RaFnKcOX8=
 modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
 modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
diff --git a/pkg/autoscaler/statforwarder/forwarder.go b/pkg/autoscaler/statforwarder/forwarder.go
index 15f0527d0..1d3ed2216 100644
--- a/pkg/autoscaler/statforwarder/forwarder.go
+++ b/pkg/autoscaler/statforwarder/forwarder.go
@@ -85,7 +85,7 @@ type Forwarder struct {
 	bs *hash.BucketSet
 	// processorsLock is the lock for processors.
 	processorsLock sync.RWMutex
-	processors     map[string]*bucketProcessor
+	processors     map[string]bucketProcessor
 	// Used to capture asynchronous processes for re-enqueuing to be waited
 	// on when shutting down.
 	retryWg sync.WaitGroup
@@ -112,7 +112,7 @@ func New(ctx context.Context, logger *zap.SugaredLogger, kc kubernetes.Interface
 		kc:              kc,
 		endpointsLister: endpointsInformer.Lister(),
 		bs:              bs,
-		processors:      make(map[string]*bucketProcessor, len(bkts)),
+		processors:      make(map[string]bucketProcessor, len(bkts)),
 		accept:          accept,
 		id2ip:           make(map[string]string),
 		statCh:          make(chan stat, 1000),
@@ -169,11 +169,10 @@ func (f *Forwarder) filterFunc(namespace string) func(interface{}) bool {
 		holder := *l.Spec.HolderIdentity
 		_, err := f.extractIP(holder)
 		if err != nil {
-			f.logger.Warn("Found invalid Lease holder identify ", *l.Spec.HolderIdentity)
+			f.logger.Warn("Found invalid Lease holder identify ", holder)
 			return false
 		}
-		if p := f.getProcessor(l.Name); p != nil && p.holder == holder {
-			// Already up-to-date.
+		if p := f.getProcessor(l.Name); p != nil && p.is(holder) {
 			return false
 		}
 
@@ -323,24 +322,24 @@ func (f *Forwarder) createOrUpdateEndpoints(ctx context.Context, ns, n string) e
 	return nil
 }
 
-func (f *Forwarder) getProcessor(bkt string) *bucketProcessor {
+func (f *Forwarder) getProcessor(bkt string) bucketProcessor {
 	f.processorsLock.RLock()
 	defer f.processorsLock.RUnlock()
 	return f.processors[bkt]
 }
 
-func (f *Forwarder) setProcessor(bkt string, p *bucketProcessor) {
+func (f *Forwarder) setProcessor(bkt string, p bucketProcessor) {
 	f.processorsLock.Lock()
 	defer f.processorsLock.Unlock()
 	f.processors[bkt] = p
 }
 
-func (f *Forwarder) createProcessor(ns, bkt, ip, holder string) *bucketProcessor {
+func (f *Forwarder) createProcessor(ns, bkt, ip, holder string) bucketProcessor {
 	if ip == f.selfIP {
-		return &bucketProcessor{
+		return &localProcessor{
 			bkt:    bkt,
-			logger: f.logger.With(zap.String("bucket", bkt)),
 			holder: holder,
+			logger: f.logger.With(zap.String("bucket", bkt)),
 			accept: f.accept,
 		}
 	}
@@ -404,8 +403,8 @@ func (f *Forwarder) maybeRetry(logger *zap.SugaredLogger, s stat) {
 	}()
 }
 
-func (f *Forwarder) shutdown(p *bucketProcessor) {
-	if p != nil && p.accept == nil {
+func (f *Forwarder) shutdown(p bucketProcessor) {
+	if p != nil {
 		p.shutdown()
 	}
 }
@@ -427,7 +426,6 @@ func (f *Forwarder) Cancel() {
 
 // IsBucketOwner returns true if this Autoscaler pod is the owner of the given bucket.
 func (f *Forwarder) IsBucketOwner(bkt string) bool {
-	p := f.getProcessor(bkt)
-	// The accept func is not nil iif this Autoscaler is the owner.
-	return p != nil && p.accept != nil
+	_, owned := f.getProcessor(bkt).(*localProcessor)
+	return owned
 }
diff --git a/pkg/autoscaler/statforwarder/processor.go b/pkg/autoscaler/statforwarder/processor.go
index a2f6402a0..3f2ab18b4 100644
--- a/pkg/autoscaler/statforwarder/processor.go
+++ b/pkg/autoscaler/statforwarder/processor.go
@@ -33,9 +33,43 @@ import (
 // accessed by IP address directly due to the network mesh.
 const establishTimeout = 500 * time.Millisecond
 
-// bucketProcessor includes the information about how to process
-// the StatMessage owned by a bucket.
-type bucketProcessor struct {
+type bucketProcessor interface {
+	process(asmetrics.StatMessage) error
+
+	// is returns whether the current processor *is* the specified holder.
+	is(holder string) bool
+
+	shutdown()
+}
+
+// localProcessor implements bucketProcessor for an owned bucket.
+type localProcessor struct {
+	logger *zap.SugaredLogger
+	// The name of the bucket
+	bkt    string
+	holder string
+	// `accept` is the function to process a StatMessage which doesn't need
+	// to be forwarded.
+	accept statProcessor
+}
+
+var _ bucketProcessor = (*localProcessor)(nil)
+
+func (p *localProcessor) is(holder string) bool {
+	return p.holder == holder
+}
+
+func (p *localProcessor) process(sm asmetrics.StatMessage) error {
+	l := p.logger.With(zap.String(logkey.Key, sm.Key.String()))
+	l.Debug("Accept stat as owner of bucket ", p.bkt)
+	p.accept(sm)
+	return nil
+}
+
+func (p *localProcessor) shutdown() {}
+
+// remoteProcessor implements bucketProcessor for an unowned bucket.
+type remoteProcessor struct {
 	logger *zap.SugaredLogger
 	// The name of the bucket
 	bkt string
@@ -45,12 +79,11 @@ type bucketProcessor struct {
 	connLock sync.RWMutex
 	// conn is the WebSocket connection to the holder pod.
 	conn *websocket.ManagedConnection
-	// `accept` is the function to process a StatMessage which doesn't need
-	// to be forwarded.
-	accept statProcessor
 }
 
-func newForwardProcessor(logger *zap.SugaredLogger, bkt, holder, podDNS, svcDNS string) *bucketProcessor {
+var _ bucketProcessor = (*remoteProcessor)(nil)
+
+func newForwardProcessor(logger *zap.SugaredLogger, bkt, holder, podDNS, svcDNS string) *remoteProcessor {
 	// First try to connect via Pod IP address synchronously. If the connection can
 	// not be established within `establishTimeout`, we assume the pods can not be
 	// accessed by IP address. Then try to connect via Pod IP address synchronously.
@@ -60,7 +93,7 @@ func newForwardProcessor(logger *zap.SugaredLogger, bkt, holder, podDNS, svcDNS
 		logger.Info("Autoscaler pods can't be accessed by IP address. Connecting to Autoscaler bucket at ", svcDNS)
 		c, _ = websocket.NewDurableSendingConnectionGuaranteed(svcDNS, establishTimeout, logger)
 	}
-	return &bucketProcessor{
+	return &remoteProcessor{
 		logger: logger,
 		bkt:    bkt,
 		holder: holder,
@@ -69,25 +102,24 @@ func newForwardProcessor(logger *zap.SugaredLogger, bkt, holder, podDNS, svcDNS
 	}
 }
 
-func (p *bucketProcessor) getConn() *websocket.ManagedConnection {
+func (p *remoteProcessor) is(holder string) bool {
+	return p.holder == holder
+}
+
+func (p *remoteProcessor) getConn() *websocket.ManagedConnection {
 	p.connLock.RLock()
 	defer p.connLock.RUnlock()
 	return p.conn
 }
 
-func (p *bucketProcessor) setConn(conn *websocket.ManagedConnection) {
+func (p *remoteProcessor) setConn(conn *websocket.ManagedConnection) {
 	p.connLock.Lock()
 	defer p.connLock.Unlock()
 	p.conn = conn
 }
 
-func (p *bucketProcessor) process(sm asmetrics.StatMessage) error {
+func (p *remoteProcessor) process(sm asmetrics.StatMessage) error {
 	l := p.logger.With(zap.String(logkey.Key, sm.Key.String()))
-	if p.accept != nil {
-		l.Debug("Accept stat as owner of bucket ", p.bkt)
-		p.accept(sm)
-		return nil
-	}
 
 	l.Debugf("Forward stat of bucket %s to the holder %s", p.bkt, p.holder)
 	wsms := asmetrics.ToWireStatMessages([]asmetrics.StatMessage{sm})
@@ -108,7 +140,7 @@ func (p *bucketProcessor) process(sm asmetrics.StatMessage) error {
 	return c.SendRaw(gorillawebsocket.BinaryMessage, b)
 }
 
-func (p *bucketProcessor) shutdown() {
+func (p *remoteProcessor) shutdown() {
 	if c := p.getConn(); c != nil {
 		c.Shutdown()
 	}
diff --git a/pkg/reconciler/route/traffic/rollout.go b/pkg/reconciler/route/traffic/rollout.go
index c9ac44c38..333b34be9 100644
--- a/pkg/reconciler/route/traffic/rollout.go
+++ b/pkg/reconciler/route/traffic/rollout.go
@@ -58,10 +58,13 @@ type ConfigurationRollout struct {
 	// Note: that it is not 100% of the route traffic, in more complex cases.
 	Revisions []RevisionRollout `json:"revisions,omitempty"`
 
-	// Deadline is the Unix timestamp by when (+/- reconcile precision)
-	// the Rollout shoud be complete.
-	Deadline int `json:"deadline,omitempty"`
+	// StepParams describes rollout params for the configuration.
+	StepParams RolloutParams `json:"stepParams"`
+}
 
+// RolloutParams contains the timing and sizing parameters for the
+// ConfigurationRollout.
+type RolloutParams struct {
 	// StartTime is the Unix timestamp by when (+/- reconcile precision)
 	// the Rollout has started.
 	// This is required to compute step time and deadline.
@@ -128,10 +131,10 @@ const durationSecs = 120.0
 func (cur *Rollout) ObserveReady(nowTS int) {
 	for i := range cur.Configurations {
 		c := &cur.Configurations[i]
-		if c.StepDuration == 0 && c.StartTime > 0 {
-			// In really ceil(nowTS-c.StartTime) should always give 1s, but
+		if c.StepParams.StepDuration == 0 && c.StepParams.StartTime > 0 {
+			// In really ceil(nowTS-params.StartTime) should always give 1s, but
 			// given possible time drift, we'll ensure that at least 1s is returned.
-			minStepSec := math.Max(1, math.Ceil(time.Duration(nowTS-c.StartTime).Seconds()))
+			minStepSec := math.Max(1, math.Ceil(time.Duration(nowTS-c.StepParams.StartTime).Seconds()))
 			c.computeProperties(float64(nowTS), minStepSec, durationSecs)
 		}
 	}
@@ -248,12 +251,12 @@ func adjustPercentage(goal int, cr *ConfigurationRollout) {
 func stepRevisions(goal *ConfigurationRollout, nowTS int) {
 	// Not yet ready to adjust the steps or we're done
 	// (shouldn't really be here, but better be defensive).
-	if nowTS < goal.NextStepTime || len(goal.Revisions) < 2 {
+	if nowTS < goal.StepParams.NextStepTime || len(goal.Revisions) < 2 {
 		return
 	}
 
 	revLen := len(goal.Revisions)
-	remaining := goal.StepSize
+	remaining := goal.StepParams.StepSize
 	writePos := revLen - 1
 	// readPos is guaranteed to be >= 0, due to the check above.
 	readPos := revLen - 2
@@ -283,7 +286,7 @@ func stepRevisions(goal *ConfigurationRollout, nowTS int) {
 	// Copy the last one to the write pos
 	goal.Revisions[writePos] = goal.Revisions[revLen-1]
 
-	goal.Revisions[writePos].Percent += goal.StepSize
+	goal.Revisions[writePos].Percent += goal.StepParams.StepSize
 	// This can happen if step is now larger than total allocation, see the
 	// note above.
 	// E.g. with example above R2 = 20, and ro we have to cap it at 15.
@@ -294,11 +297,10 @@ func stepRevisions(goal *ConfigurationRollout, nowTS int) {
 	goal.Revisions = goal.Revisions[:writePos+1]
 	// Also set the next time.
 	if len(goal.Revisions) > 1 {
-		goal.NextStepTime = nowTS + goal.StepDuration
+		goal.StepParams.NextStepTime = nowTS + goal.StepParams.StepDuration
 	} else {
-		// This is the last step, we're done!
-		goal.NextStepTime = 0
-		goal.StartTime = 0
+		// This is the last step, we're done! Clear the params out.
+		goal.StepParams = RolloutParams{}
 	}
 }
 
@@ -334,14 +336,10 @@ func stepConfig(goal, prev *ConfigurationRollout, nowTS int) *ConfigurationRollo
 
 			// Copy various rollout stats from the previous when no new revision
 			// has been created.
-			ret.StartTime = prev.StartTime
-			ret.Deadline = prev.Deadline
-			ret.NextStepTime = prev.NextStepTime
-			ret.StepDuration = prev.StepDuration
-			ret.StepSize = prev.StepSize
+			ret.StepParams = prev.StepParams
 			// We might end up here before `ObserveReady` is called.
 			// In that case don't step individual revisions just yet.
-			if ret.StepSize > 0 {
+			if ret.StepParams.StepSize > 0 {
 				// adjustPercentage above would've already accounted if target for the
 				// whole Configuration changed up or down. So here we should just redistribute
 				// the existing values.
@@ -354,7 +352,7 @@ func stepConfig(goal, prev *ConfigurationRollout, nowTS int) *ConfigurationRollo
 	// Otherwise we start a rollout, which means we need to stamp the starttime,
 	// the rest of the fields will remain unset and `ObserveReady` will
 	// compute them when the ingress becomes ready.
-	ret.StartTime = nowTS
+	ret.StepParams.StartTime = nowTS
 
 	// Go backwards and find first revision with traffic assignment > 0.
 	// Reduce it by one, so we can give that 1% to the new revision.
@@ -417,9 +415,9 @@ func (cur *ConfigurationRollout) computeProperties(nowTS, minStepSec, durationSe
 	// than slightly shorter.
 	stepDuration := math.Ceil(durationSecs / numSteps)
 
-	cur.StepDuration = int(stepDuration)
-	cur.StepSize = int(stepSize)
-	cur.NextStepTime = int(nowTS + stepDuration*float64(time.Second))
+	cur.StepParams.StepDuration = int(stepDuration)
+	cur.StepParams.StepSize = int(stepSize)
+	cur.StepParams.NextStepTime = int(nowTS + stepDuration*float64(time.Second))
 }
 
 // sortRollout sorts the rollout based on tag so it's consistent
diff --git a/vendor/knative.dev/pkg/leaderelection/context.go b/vendor/knative.dev/pkg/leaderelection/context.go
index 17a7a1b1f..d30ecd462 100644
--- a/vendor/knative.dev/pkg/leaderelection/context.go
+++ b/vendor/knative.dev/pkg/leaderelection/context.go
@@ -41,7 +41,7 @@ func WithDynamicLeaderElectorBuilder(ctx context.Context, kc kubernetes.Interfac
 	b, _, err := NewStatefulSetBucketAndSet(int(cc.Buckets))
 	if err == nil {
 		logger.Info("Running with StatefulSet leader election")
-		return withStatefulSetElectorBuilder(ctx, cc, b)
+		return WithStatefulSetElectorBuilder(ctx, cc, b)
 	}
 	logger.Info("Running with Standard leader election")
 	return WithStandardLeaderElectorBuilder(ctx, kc, cc)
@@ -57,10 +57,10 @@ func WithStandardLeaderElectorBuilder(ctx context.Context, kc kubernetes.Interfa
 	})
 }
 
-// withStatefulSetElectorBuilder infuses a context with the ability to build
+// WithStatefulSetElectorBuilder infuses a context with the ability to build
 // Electors which are assigned leadership based on the StatefulSet ordinal from
 // the provided component configuration.
-func withStatefulSetElectorBuilder(ctx context.Context, cc ComponentConfig, bkt reconciler.Bucket) context.Context {
+func WithStatefulSetElectorBuilder(ctx context.Context, cc ComponentConfig, bkt reconciler.Bucket) context.Context {
 	return context.WithValue(ctx, builderKey{}, &statefulSetBuilder{
 		lec: cc,
 		bkt: bkt,
diff --git a/vendor/knative.dev/pkg/webhook/helper.go b/vendor/knative.dev/pkg/webhook/helper.go
new file mode 100644
index 000000000..cbcbb58c7
--- /dev/null
+++ b/vendor/knative.dev/pkg/webhook/helper.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2020 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhook
+
+import (
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EnsureLabelSelectorExpressions merges the current label selector's MatchExpressions
+// with the ones wanted.
+// It keeps all non-knative keys intact, removes all knative-keys no longer wanted and
+// adds all knative-keys not yet there.
+func EnsureLabelSelectorExpressions(
+	current *metav1.LabelSelector,
+	want *metav1.LabelSelector) *metav1.LabelSelector {
+
+	if current == nil {
+		return want
+	}
+
+	if len(current.MatchExpressions) == 0 {
+		return want
+	}
+
+	var wantExpressions []metav1.LabelSelectorRequirement
+	if want != nil {
+		wantExpressions = want.MatchExpressions
+	}
+
+	return &metav1.LabelSelector{
+		MatchExpressions: ensureLabelSelectorRequirements(
+			current.MatchExpressions, wantExpressions),
+	}
+}
+
+func ensureLabelSelectorRequirements(
+	current []metav1.LabelSelectorRequirement,
+	want []metav1.LabelSelectorRequirement) []metav1.LabelSelectorRequirement {
+
+	nonKnative := make([]metav1.LabelSelectorRequirement, 0, len(current))
+	for _, r := range current {
+		if !strings.Contains(r.Key, "knative.dev") {
+			nonKnative = append(nonKnative, r)
+		}
+	}
+
+	return append(want, nonKnative...)
+}
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/defaulting.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/defaulting.go
index 69d0e9ae8..acdc6f33d 100644
--- a/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/defaulting.go
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/defaulting/defaulting.go
@@ -171,41 +171,42 @@ func (ac *reconciler) reconcileMutatingWebhook(ctx context.Context, caCert []byt
 		return fmt.Errorf("error retrieving webhook: %w", err)
 	}
 
-	webhook := configuredWebhook.DeepCopy()
+	current := configuredWebhook.DeepCopy()
 
 	// Clear out any previous (bad) OwnerReferences.
 	// See: https://github.com/knative/serving/issues/5845
-	webhook.OwnerReferences = nil
+	current.OwnerReferences = nil
 
-	for i, wh := range webhook.Webhooks {
-		if wh.Name != webhook.Name {
+	for i, wh := range current.Webhooks {
+		if wh.Name != current.Name {
 			continue
 		}
-		webhook.Webhooks[i].Rules = rules
-		webhook.Webhooks[i].NamespaceSelector = &metav1.LabelSelector{
-			MatchExpressions: []metav1.LabelSelectorRequirement{{
-				Key:      "webhooks.knative.dev/exclude",
-				Operator: metav1.LabelSelectorOpDoesNotExist,
-			}, {
-				// "control-plane" is added to support Azure's AKS, otherwise the controllers fight.
-				// See knative/pkg#1590 for details.
-				Key:      "control-plane",
-				Operator: metav1.LabelSelectorOpDoesNotExist,
-			}},
-		}
-		webhook.Webhooks[i].ClientConfig.CABundle = caCert
-		if webhook.Webhooks[i].ClientConfig.Service == nil {
+
+		cur := &current.Webhooks[i]
+		cur.Rules = rules
+
+		cur.NamespaceSelector = webhook.EnsureLabelSelectorExpressions(
+			cur.NamespaceSelector,
+			&metav1.LabelSelector{
+				MatchExpressions: []metav1.LabelSelectorRequirement{{
+					Key:      "webhooks.knative.dev/exclude",
+					Operator: metav1.LabelSelectorOpDoesNotExist,
+				}},
+			})
+
+		cur.ClientConfig.CABundle = caCert
+		if cur.ClientConfig.Service == nil {
 			return fmt.Errorf("missing service reference for webhook: %s", wh.Name)
 		}
-		webhook.Webhooks[i].ClientConfig.Service.Path = ptr.String(ac.Path())
+		cur.ClientConfig.Service.Path = ptr.String(ac.Path())
 	}
 
-	if ok, err := kmp.SafeEqual(configuredWebhook, webhook); err != nil {
+	if ok, err := kmp.SafeEqual(configuredWebhook, current); err != nil {
 		return fmt.Errorf("error diffing webhooks: %w", err)
 	} else if !ok {
 		logger.Info("Updating webhook")
 		mwhclient := ac.client.AdmissionregistrationV1().MutatingWebhookConfigurations()
-		if _, err := mwhclient.Update(ctx, webhook, metav1.UpdateOptions{}); err != nil {
+		if _, err := mwhclient.Update(ctx, current, metav1.UpdateOptions{}); err != nil {
 			return fmt.Errorf("failed to update webhook: %w", err)
 		}
 	} else {
diff --git a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/reconcile_config.go b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/reconcile_config.go
index 281a12e43..3abe55e16 100644
--- a/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/reconcile_config.go
+++ b/vendor/knative.dev/pkg/webhook/resourcesemantics/validation/reconcile_config.go
@@ -134,41 +134,41 @@ func (ac *reconciler) reconcileValidatingWebhook(ctx context.Context, caCert []b
 		return fmt.Errorf("error retrieving webhook: %w", err)
 	}
 
-	webhook := configuredWebhook.DeepCopy()
+	current := configuredWebhook.DeepCopy()
 
 	// Clear out any previous (bad) OwnerReferences.
 	// See: https://github.com/knative/serving/issues/5845
-	webhook.OwnerReferences = nil
+	current.OwnerReferences = nil
 
-	for i, wh := range webhook.Webhooks {
-		if wh.Name != webhook.Name {
+	for i, wh := range current.Webhooks {
+		if wh.Name != current.Name {
 			continue
 		}
-		webhook.Webhooks[i].Rules = rules
-		webhook.Webhooks[i].NamespaceSelector = &metav1.LabelSelector{
-			MatchExpressions: []metav1.LabelSelectorRequirement{{
-				Key:      "webhooks.knative.dev/exclude",
-				Operator: metav1.LabelSelectorOpDoesNotExist,
-			}, {
-				// "control-plane" is added to support Azure's AKS, otherwise the controllers fight.
-				// See knative/pkg#1590 for details.
-				Key:      "control-plane",
-				Operator: metav1.LabelSelectorOpDoesNotExist,
-			}},
-		}
-		webhook.Webhooks[i].ClientConfig.CABundle = caCert
-		if webhook.Webhooks[i].ClientConfig.Service == nil {
+		cur := &current.Webhooks[i]
+		cur.Rules = rules
+
+		cur.NamespaceSelector = webhook.EnsureLabelSelectorExpressions(
+			cur.NamespaceSelector,
+			&metav1.LabelSelector{
+				MatchExpressions: []metav1.LabelSelectorRequirement{{
+					Key:      "webhooks.knative.dev/exclude",
+					Operator: metav1.LabelSelectorOpDoesNotExist,
+				}},
+			})
+
+		cur.ClientConfig.CABundle = caCert
+		if cur.ClientConfig.Service == nil {
 			return fmt.Errorf("missing service reference for webhook: %s", wh.Name)
 		}
-		webhook.Webhooks[i].ClientConfig.Service.Path = ptr.String(ac.Path())
+		cur.ClientConfig.Service.Path = ptr.String(ac.Path())
 	}
 
-	if ok, err := kmp.SafeEqual(configuredWebhook, webhook); err != nil {
+	if ok, err := kmp.SafeEqual(configuredWebhook, current); err != nil {
 		return fmt.Errorf("error diffing webhooks: %w", err)
 	} else if !ok {
 		logger.Info("Updating webhook")
 		vwhclient := ac.client.AdmissionregistrationV1().ValidatingWebhookConfigurations()
-		if _, err := vwhclient.Update(ctx, webhook, metav1.UpdateOptions{}); err != nil {
+		if _, err := vwhclient.Update(ctx, current, metav1.UpdateOptions{}); err != nil {
 			return fmt.Errorf("failed to update webhook: %w", err)
 		}
 	} else {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index fc16696b4..12fff9c67 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -978,7 +978,7 @@ knative.dev/caching/pkg/client/listers/caching/v1alpha1
 # knative.dev/hack v0.0.0-20201201234937-fddbf732e450
 ## explicit
 knative.dev/hack
-# knative.dev/networking v0.0.0-20201208014140-4d1d53eb0626
+# knative.dev/networking v0.0.0-20201209014241-22a7e22628fc
 ## explicit
 knative.dev/networking/config
 knative.dev/networking/pkg
@@ -1012,7 +1012,7 @@ knative.dev/networking/test/conformance/ingress
 knative.dev/networking/test/defaultsystem
 knative.dev/networking/test/test_images/grpc-ping/proto
 knative.dev/networking/test/types
-# knative.dev/pkg v0.0.0-20201209011241-b1ac587fdd80
+# knative.dev/pkg v0.0.0-20201209172941-9b9407a76df1
 ## explicit
 knative.dev/pkg/apiextensions/storageversion
 knative.dev/pkg/apiextensions/storageversion/cmd/migrate


Test patch:
diff --git a/pkg/autoscaler/statforwarder/forwarder_test.go b/pkg/autoscaler/statforwarder/forwarder_test.go
index 4d7fb930b..41cb44daf 100644
--- a/pkg/autoscaler/statforwarder/forwarder_test.go
+++ b/pkg/autoscaler/statforwarder/forwarder_test.go
@@ -435,11 +435,10 @@ func TestProcess(t *testing.T) {
 	kubeClient.CoordinationV1().Leases(testNs).Create(ctx, anotherLease, metav1.CreateOptions{})
 	lease.Informer().GetIndexer().Add(anotherLease)
 
-	// Wait for the forwarder to become the leader for bucket1.
 	if err := wait.PollImmediate(10*time.Millisecond, 10*time.Second, func() (bool, error) {
-		p1 := f.getProcessor(bucket1)
-		p2 := f.getProcessor(bucket2)
-		return p1 != nil && p2 != nil && p1.holder == testHolder1 && p2.holder == testHolder2, nil
+		_, p1owned := f.getProcessor(bucket1).(*localProcessor)
+		_, p2notowned := f.getProcessor(bucket2).(*remoteProcessor)
+		return p1owned && p2notowned, nil
 	}); err != nil {
 		t.Fatalf("Timeout waiting f.processors got updated")
 	}
@@ -464,12 +463,12 @@ func TestProcess(t *testing.T) {
 
 func TestIsBucketOwner(t *testing.T) {
 	f := Forwarder{
-		processors: map[string]*bucketProcessor{
-			bucket1: {
+		processors: map[string]bucketProcessor{
+			bucket1: &localProcessor{
 				bkt:    bucket1,
 				accept: noOp,
 			},
-			bucket2: {
+			bucket2: &remoteProcessor{
 				bkt: bucket2,
 			},
 		},
diff --git a/pkg/reconciler/route/resources/ingress_test.go b/pkg/reconciler/route/resources/ingress_test.go
index ac1339e87..03a9db11c 100644
--- a/pkg/reconciler/route/resources/ingress_test.go
+++ b/pkg/reconciler/route/resources/ingress_test.go
@@ -141,7 +141,7 @@ func TestMakeIngressWithRollout(t *testing.T) {
 		Annotations: map[string]string{
 			// Make sure to get passdownIngressClass instead of ingressClass
 			networking.IngressClassAnnotationKey: passdownIngressClass,
-			networking.RolloutAnnotationKey:      `{"configurations":[{"configurationName":"valhalla","percent":100,"revisions":[{"revisionName":"valhalla-01982","percent":100}]},{"configurationName":"thor","tag":"tagged","percent":100,"revisions":[{"revisionName":"thor-02020","percent":100}]}]}`,
+			networking.RolloutAnnotationKey:      `{"configurations":[{"configurationName":"valhalla","percent":100,"revisions":[{"revisionName":"valhalla-01982","percent":100}],"stepParams":{}},{"configurationName":"thor","tag":"tagged","percent":100,"revisions":[{"revisionName":"thor-02020","percent":100}],"stepParams":{}}]}`,
 			"test-annotation":                    "bar",
 		},
 		OwnerReferences: []metav1.OwnerReference{*kmeta.NewControllerRef(r)},
diff --git a/pkg/reconciler/route/table_test.go b/pkg/reconciler/route/table_test.go
index ecc4b304b..b8ca78975 100644
--- a/pkg/reconciler/route/table_test.go
+++ b/pkg/reconciler/route/table_test.go
@@ -436,11 +436,11 @@ func TestReconcile(t *testing.T) {
 				}}, fakeCurTime.Add(-3*time.Second),
 					func(r *traffic.Rollout) {
 						// Step duration is 3s (now - (now-3s)).
-						r.Configurations[0].StepDuration = 3
+						r.Configurations[0].StepParams.StepDuration = 3
 						// 120 / 3 = 40 steps. floor(100/40) = 2.
-						r.Configurations[0].StepSize = 2
+						r.Configurations[0].StepParams.StepSize = 2
 						// StepDuration is 3, and so next step is `now` + 3.
-						r.Configurations[0].NextStepTime = int(fakeCurTime.Add(3 * time.Second).UnixNano())
+						r.Configurations[0].StepParams.NextStepTime = int(fakeCurTime.Add(3 * time.Second).UnixNano())
 					},
 				)),
 		}, {
@@ -2694,9 +2694,11 @@ func simpleRollout(cfg string, revs []traffic.RevisionRollout,
 		r := &traffic.Rollout{
 			Configurations: []traffic.ConfigurationRollout{{
 				ConfigurationName: cfg,
-				StartTime:         int(now.UnixNano()),
-				Percent:           100,
-				Revisions:         revs,
+				StepParams: traffic.RolloutParams{
+					StartTime: int(now.UnixNano()),
+				},
+				Percent:   100,
+				Revisions: revs,
 			}},
 		}
 		for _, ro := range ros {
diff --git a/pkg/reconciler/route/traffic/rollout_test.go b/pkg/reconciler/route/traffic/rollout_test.go
index 8927d5143..d0df53810 100644
--- a/pkg/reconciler/route/traffic/rollout_test.go
+++ b/pkg/reconciler/route/traffic/rollout_test.go
@@ -78,11 +78,12 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     2006, // <- Those should be kept.
-				NextStepTime: 2009,
-				StepDuration: 2020,
-				StartTime:    2004,
-				StepSize:     14,
+				StepParams: RolloutParams{ // <- Those should be kept.
+					NextStepTime: 2009,
+					StepDuration: 2020,
+					StartTime:    2004,
+					StepSize:     14,
+				},
 			}},
 		},
 		prev: &Rollout{
@@ -115,20 +116,24 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				NextStepTime: 2009,
-				StepDuration: 2020,
-				StartTime:    2004,
-				StepSize:     14,
+				StepParams: RolloutParams{
+					NextStepTime: 2009,
+					StepDuration: 2020,
+					StartTime:    2004,
+					StepSize:     14,
+				},
 			}},
 		},
 		prev: &Rollout{
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           100,
-				NextStepTime:      2019,
-				StepDuration:      5,
-				StartTime:         2004,
-				StepSize:          3,
+				StepParams: RolloutParams{
+					NextStepTime: 2019,
+					StepDuration: 5,
+					StartTime:    2004,
+					StepSize:     3,
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "their-satanic-majesties-request",
 					Percent:      95,
@@ -149,10 +154,12 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      8, // +3
 				}},
-				NextStepTime: 2020 + 5, // now + duration.
-				StepDuration: 5,
-				StartTime:    2004,
-				StepSize:     3,
+				StepParams: RolloutParams{
+					NextStepTime: 2020 + 5, // now + duration.
+					StepDuration: 5,
+					StartTime:    2004,
+					StepSize:     3,
+				},
 			}},
 		},
 	}, {
@@ -165,21 +172,24 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      100,
 				}},
-				Deadline:     2006,
-				NextStepTime: 2009,
-				StepDuration: 2020,
-				StartTime:    2004,
-				StepSize:     14,
+				StepParams: RolloutParams{
+					NextStepTime: 2009,
+					StepDuration: 2020,
+					StartTime:    2004,
+					StepSize:     14,
+				},
 			}},
 		},
 		prev: &Rollout{
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           100,
-				NextStepTime:      2019, // <- Those should be reset and/or updated.
-				StartTime:         2004,
-				StepDuration:      5,
-				StepSize:          0,
+				StepParams: RolloutParams{
+					NextStepTime: 2019, // <- Those should be reset and/or updated.
+					StartTime:    2004,
+					StepDuration: 5,
+					StepSize:     0,
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "their-satanic-majesties-request",
 					Percent:      95,
@@ -200,10 +210,12 @@ func TestStep(t *testing.T) {
 					RevisionName: "let-it-bleed",
 					Percent:      5,
 				}},
-				NextStepTime: 2019,
-				StartTime:    2004,
-				StepDuration: 5,
-				StepSize:     0,
+				StepParams: RolloutParams{
+					NextStepTime: 2019,
+					StartTime:    2004,
+					StepDuration: 5,
+					StepSize:     0,
+				},
 			}},
 		},
 	}, {
@@ -288,17 +300,20 @@ func TestStep(t *testing.T) {
 					RevisionName: "goat-head-soup",
 					Percent:      100,
 				}},
-				Deadline:     1982, // <- Those should be thrown out.
-				NextStepTime: 1984,
-				StepDuration: 1988,
-				StepSize:     11,
+				StepParams: RolloutParams{ // <- Those should be thrown out.
+					NextStepTime: 1984,
+					StepDuration: 1988,
+					StepSize:     11,
+				},
 			}},
 		},
 		want: &Rollout{
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           100,
-				StartTime:         now,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      99,
@@ -337,7 +352,9 @@ func TestStep(t *testing.T) {
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           33,
-				StartTime:         now,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      2,
@@ -378,8 +395,10 @@ func TestStep(t *testing.T) {
 		want: &Rollout{
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
-				StartTime:         now,
-				Percent:           75,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
+				Percent: 75,
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      11,
@@ -418,7 +437,9 @@ func TestStep(t *testing.T) {
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "brian",
 				Percent:           70,
-				StartTime:         now,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "exile-on-main-st",
 					Percent:      69,
@@ -444,7 +465,9 @@ func TestStep(t *testing.T) {
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           100,
-				StartTime:         now - 1982, // A rollout in progress, this would be set.
+				StepParams: RolloutParams{
+					StartTime: now - 1982, // A rollout in progress, this would be set.
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      95,
@@ -458,7 +481,9 @@ func TestStep(t *testing.T) {
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           100,
-				StartTime:         now,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      95,
@@ -487,7 +512,9 @@ func TestStep(t *testing.T) {
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
 				Percent:           100,
-				StartTime:         now - 1984, // A rollout in progress, this would be set.
+				StepParams: RolloutParams{
+					StartTime: now - 1984, // A rollout in progress, this would be set.
+				},
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      99,
@@ -500,8 +527,10 @@ func TestStep(t *testing.T) {
 		want: &Rollout{
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "mick",
-				StartTime:         now,
-				Percent:           100,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
+				Percent: 100,
 				Revisions: []RevisionRollout{{
 					RevisionName: "goat-head-soup",
 					Percent:      99,
@@ -670,7 +699,9 @@ func TestStep(t *testing.T) {
 			Configurations: []ConfigurationRollout{{
 				ConfigurationName: "keith",
 				Percent:           99,
-				StartTime:         now,
+				StepParams: RolloutParams{
+					StartTime: now,
+				},
 				Revisions: []RevisionRollout{{ // <-- note this one actually rolls.
 					RevisionName: "can't-get-no-satisfaction",
 					Percent:      98,
@@ -803,22 +834,30 @@ func TestObserveReady(t *testing.T) {
 		Configurations: []ConfigurationRollout{{
 			Percent:           100,
 			ConfigurationName: "has-step",
-			StepDuration:      11,
+			StepParams: RolloutParams{
+				StepDuration: 11,
+			},
 		}, {
 			ConfigurationName: "no-step-no-begin",
 			Percent:           100,
 		}, {
 			ConfigurationName: "step-begin < 1s",
-			StartTime:         200620092020,
-			Percent:           100,
+			StepParams: RolloutParams{
+				StartTime: 200620092020,
+			},
+			Percent: 100,
 		}, {
 			ConfigurationName: "step-begin > 1s",
-			StartTime:         oldenDays,
-			Percent:           100,
+			StepParams: RolloutParams{
+				StartTime: oldenDays,
+			},
+			Percent: 100,
 		}, {
 			ConfigurationName: "Percent not 100%",
-			StartTime:         oldenDays,
-			Percent:           50,
+			StepParams: RolloutParams{
+				StartTime: oldenDays,
+			},
+			Percent: 50,
 		}},
 	}
 
@@ -826,31 +865,39 @@ func TestObserveReady(t *testing.T) {
 		Configurations: []ConfigurationRollout{{
 			Percent:           100,
 			ConfigurationName: "has-step",
-			StepDuration:      11,
+			StepParams: RolloutParams{
+				StepDuration: 11,
+			},
 		}, {
 			ConfigurationName: "no-step-no-begin",
 			Percent:           100,
 		}, {
 			ConfigurationName: "step-begin < 1s",
 			Percent:           100,
-			StartTime:         200620092020,
-			StepDuration:      2,
-			StepSize:          1,
-			NextStepTime:      now + int(2*time.Second),
+			StepParams: RolloutParams{
+				StartTime:    200620092020,
+				StepDuration: 2,
+				StepSize:     1,
+				NextStepTime: now + int(2*time.Second),
+			},
 		}, {
 			ConfigurationName: "step-begin > 1s",
 			Percent:           100,
-			StartTime:         oldenDays,
-			StepDuration:      3,
-			StepSize:          100 / 40,
-			NextStepTime:      now + 3*int(time.Second),
+			StepParams: RolloutParams{
+				StartTime:    oldenDays,
+				StepDuration: 3,
+				StepSize:     100 / 40,
+				NextStepTime: now + 3*int(time.Second),
+			},
 		}, {
 			ConfigurationName: "Percent not 100%",
 			Percent:           50,
-			StartTime:         oldenDays,
-			StepDuration:      3,
-			StepSize:          50 / 40,
-			NextStepTime:      now + 3*int(time.Second),
+			StepParams: RolloutParams{
+				StartTime:    oldenDays,
+				StepDuration: 3,
+				StepSize:     50 / 40,
+				NextStepTime: now + 3*int(time.Second),
+			},
 		}},
 	}
 
@@ -1110,10 +1157,11 @@ func TestJSONRoundtrip(t *testing.T) {
 				RevisionName: "roy",
 				Percent:      100,
 			}},
-			StartTime:    1955,
-			Deadline:     2006,
-			NextStepTime: 1988,
-			StepDuration: 1984,
+			StepParams: RolloutParams{
+				StartTime:    1955,
+				NextStepTime: 1988,
+				StepDuration: 1984,
+			},
 		}, {
 			ConfigurationName: "no",
 			Percent:           0,
@@ -1156,8 +1204,10 @@ func TestStepRevisions(t *testing.T) {
 		name: "noop (1): too soon",
 		now:  1982,
 		cfg: &ConfigurationRollout{
-			NextStepTime: 1984,
-			StepSize:     10,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepSize:     10,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 10,
 			}, {
@@ -1167,8 +1217,10 @@ func TestStepRevisions(t *testing.T) {
 			}},
 		},
 		want: &ConfigurationRollout{
-			NextStepTime: 1984,
-			StepSize:     10,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepSize:     10,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 10,
 			}, {
@@ -1181,17 +1233,21 @@ func TestStepRevisions(t *testing.T) {
 		name: "noop (2): done",
 		now:  1982,
 		cfg: &ConfigurationRollout{
-			NextStepTime: 1984,
-			StepDuration: 10,
-			StepSize:     10,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepDuration: 10,
+				StepSize:     10,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 10,
 			}},
 		},
 		want: &ConfigurationRollout{
-			NextStepTime: 1984,
-			StepDuration: 10,
-			StepSize:     10,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepDuration: 10,
+				StepSize:     10,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 10,
 			}},
@@ -1200,10 +1256,12 @@ func TestStepRevisions(t *testing.T) {
 		name: "step last, exact time",
 		now:  1984,
 		cfg: &ConfigurationRollout{
-			NextStepTime: 1984,
-			StepSize:     10,
-			StepDuration: 55,
-			Percent:      90,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepSize:     10,
+				StepDuration: 55,
+			},
+			Percent: 90,
 			Revisions: []RevisionRollout{{
 				Percent: 30,
 			}, {
@@ -1211,10 +1269,12 @@ func TestStepRevisions(t *testing.T) {
 			}},
 		},
 		want: &ConfigurationRollout{
-			Percent:      90,
-			NextStepTime: 1984 + 55,
-			StepDuration: 55,
-			StepSize:     10,
+			Percent: 90,
+			StepParams: RolloutParams{
+				NextStepTime: 1984 + 55,
+				StepDuration: 55,
+				StepSize:     10,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 20,
 			}, {
@@ -1225,10 +1285,12 @@ func TestStepRevisions(t *testing.T) {
 		name: "step last, delete some",
 		now:  1988,
 		cfg: &ConfigurationRollout{
-			Percent:      90,
-			NextStepTime: 1984,
-			StepSize:     10,
-			StepDuration: 55,
+			Percent: 90,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepSize:     10,
+				StepDuration: 55,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 22,
 			}, {
@@ -1240,10 +1302,12 @@ func TestStepRevisions(t *testing.T) {
 			}},
 		},
 		want: &ConfigurationRollout{
-			Percent:      90,
-			NextStepTime: 1988 + 55,
-			StepDuration: 55,
-			StepSize:     10,
+			Percent: 90,
+			StepParams: RolloutParams{
+				NextStepTime: 1988 + 55,
+				StepDuration: 55,
+				StepSize:     10,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 20,
 			}, {
@@ -1254,10 +1318,12 @@ func TestStepRevisions(t *testing.T) {
 		name: "over target now",
 		now:  1988,
 		cfg: &ConfigurationRollout{
-			Percent:      15,
-			NextStepTime: 1984,
-			StepSize:     10,
-			StepDuration: 77,
+			Percent: 15,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StepSize:     10,
+				StepDuration: 77,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 5,
 			}, {
@@ -1269,10 +1335,10 @@ func TestStepRevisions(t *testing.T) {
 			}},
 		},
 		want: &ConfigurationRollout{
-			Percent:      15,
-			NextStepTime: 0,
-			StepDuration: 77,
-			StepSize:     10,
+			Percent:    15,
+			StepParams: RolloutParams{
+				// we reset rollout params, since we're done now.
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 15,
 			}},
@@ -1281,11 +1347,13 @@ func TestStepRevisions(t *testing.T) {
 		name: "the very last step",
 		now:  2006,
 		cfg: &ConfigurationRollout{
-			NextStepTime: 1984,
-			Percent:      15,
-			StartTime:    1977,
-			StepDuration: 77,
-			StepSize:     8,
+			Percent: 15,
+			StepParams: RolloutParams{
+				NextStepTime: 1984,
+				StartTime:    1977,
+				StepDuration: 77,
+				StepSize:     8,
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 5,
 			}, {
@@ -1297,11 +1365,10 @@ func TestStepRevisions(t *testing.T) {
 			}},
 		},
 		want: &ConfigurationRollout{
-			NextStepTime: 0,
-			Percent:      15,
-			StartTime:    0,
-			StepDuration: 77,
-			StepSize:     8,
+			Percent:    15,
+			StepParams: RolloutParams{
+				// we reset rollout params, since we're done now.
+			},
 			Revisions: []RevisionRollout{{
 				Percent: 15,
 			}},
diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 4e51baf1c..a5573acfd 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
 webhooks:
   - admissionReviewVersions:
       - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,14 +168,14 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20201208-3a1ba61"
+        serving.knative.dev/release: "v20201209-6f63cff"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-certmanager
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:b9d86275283f61cec2a2c8d0433b3389f59742a45a47de7f2456caad4cea418b
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:11784f4f46e8c9ff5e7fd48375b85601341840cf7ece6ca7473beca3f40f000e
           resources:
             requests:
               cpu: 30m
@@ -213,7 +213,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -250,7 +250,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
 spec:
   selector:
     matchLabels:
@@ -263,14 +263,14 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20201208-3a1ba61"
+        serving.knative.dev/release: "v20201209-6f63cff"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:255ac94c18a903babea3161e7faf506f5113fab96cd42c564811fd1ae7be1fa3
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:b6b07249e8a79cf901b572883f80d38b5a112c1ae14ecb333996a88e01be3e6c
           resources:
             requests:
               cpu: 20m
@@ -329,7 +329,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20201208-3a1ba61"
+    serving.knative.dev/release: "v20201209-6f63cff"
 spec:
   ports:
     # Define metrics and profiling for them to be accessible within service meshes.
diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index b6c49c1ee..9dd7a610e 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -1482,7 +1482,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: Always
           command:
             - contour
@@ -1709,7 +1709,7 @@ spec:
             - --contour-key-file=/certs/tls.key
             - --config-path=/config/contour.yaml
           command: ["contour"]
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -1798,7 +1798,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -1875,7 +1875,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -2097,7 +2097,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: Always
           command:
             - contour
@@ -2217,7 +2217,7 @@ spec:
             - --contour-key-file=/certs/tls.key
             - --config-path=/config/contour.yaml
           command: ["contour"]
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -2306,7 +2306,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -2383,7 +2383,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:7b2750d1799d4abe14347170d1237382d266125b3a482eeadfba9cd907191702
+          image: gcr.io/knative-nightly/github.com/projectcontour/contour/cmd/contour@sha256:9b20a0066c28f91b9c4fa6619d340c60656b4df6f3b6c9eccdca18fa61f63744
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 29a78bddf..1a1ff210f 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -33,7 +33,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: contour
-    serving.knative.dev/release: "v20201208-1b117ce1"
+    serving.knative.dev/release: "v20201209-5920ed46"
 data:
   _example: |
     ################################
@@ -103,7 +103,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:75a52252dc2ca97373045dbb91de57cea540e647c6f3bd599ec2f530e29617e5
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:a89aa5a5b560e1a8466d0b314dd468a68fde3138c5bc6c75f5cb5b93c30400a0
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 5412614a3..ace60a975 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was e87b1c73e380aa7798c73cd0a38ec32734af353a
+# Generated when HEAD was b7fe1983bd4d1f1764f7dd83e93157020b0a1dbc
 #
 # Copyright 2019 The Knative Authors
 #
@@ -20,7 +20,7 @@ metadata:
   # These are the permissions needed by the Istio Ingress implementation.
   name: knative-serving-istio
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -50,7 +50,7 @@ metadata:
   name: knative-ingress-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -87,7 +87,7 @@ metadata:
   name: knative-local-gateway
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -106,7 +106,7 @@ metadata:
   name: knative-local-gateway
   namespace: istio-system
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   type: ClusterIP
@@ -126,7 +126,7 @@ metadata:
   name: "webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -141,7 +141,7 @@ metadata:
   name: "istio-webhook"
   namespace: "knative-serving"
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -170,7 +170,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -206,7 +206,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.istio.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -244,7 +244,7 @@ metadata:
   name: istio-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -268,7 +268,7 @@ metadata:
   name: config-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 data:
   _example: |
@@ -338,7 +338,7 @@ metadata:
   name: networking-istio
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -354,14 +354,14 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: networking-istio
-        serving.knative.dev/release: "v20201208-e87b1c73"
+        serving.knative.dev/release: "v20201209-b7fe1983"
     spec:
       serviceAccountName: controller
       containers:
         - name: networking-istio
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:39fde178bac6f7994fe76871fae2c294bce5971627d3874be85176b421749233
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:d4481e081c6ec6862e0a7cd7cd4c40f5f2021e5488a5e3589063c82be51f8abd
           resources:
             requests:
               cpu: 30m
@@ -418,7 +418,7 @@ metadata:
   name: istio-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -432,14 +432,14 @@ spec:
       labels:
         app: istio-webhook
         role: istio-webhook
-        serving.knative.dev/release: "v20201208-e87b1c73"
+        serving.knative.dev/release: "v20201209-b7fe1983"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:38dd61407135120cb3a452914e566e19bdc2fd90499ed1a9f32b824efa605710
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:3e873c4895fb1ae766f5d35e9a699fd9612fecca232029f2d453ffc17c8f608f
           resources:
             requests:
               cpu: 20m
@@ -493,7 +493,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: istio-webhook
-    serving.knative.dev/release: "v20201208-e87b1c73"
+    serving.knative.dev/release: "v20201209-b7fe1983"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index 866d513c8..4401aa244 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -18,7 +18,7 @@ metadata:
   name: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -42,7 +42,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -51,7 +51,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 rules:
   - apiGroups: [""]
     resources: ["events"]
@@ -78,7 +78,7 @@ metadata:
   name: 3scale-kourier
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -110,7 +110,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 spec:
   replicas: 1
   selector:
@@ -122,7 +122,7 @@ spec:
         app: 3scale-kourier-control
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:54167f3d5b79c5401c59e0747563940b9cf5d31f357bf8ed242d3955a2cd0b4a
+        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:b98121b90c318402093c36506d28063077f6e7d42e3e39b32ad15b93d40b30c6
           name: kourier-control
           env:
             - name: CERTS_SECRET_NAMESPACE
@@ -158,7 +158,7 @@ metadata:
   namespace: knative-serving
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 spec:
   ports:
     - name: grpc-xds
@@ -191,7 +191,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 spec:
   selector:
     matchLabels:
@@ -257,7 +257,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 spec:
   ports:
     - name: http2
@@ -279,7 +279,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 spec:
   ports:
     - name: http2
@@ -297,7 +297,7 @@ metadata:
   namespace: kourier-system
   labels:
     networking.knative.dev/ingress-provider: kourier
-    serving.knative.dev/release: "v20201208-105c052d"
+    serving.knative.dev/release: "v20201209-a876478c"
 data:
   envoy-bootstrap.yaml: |
     dynamic_resources: