run update-deps

go.sum

@@ -68,8 +68,6 @@ github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBp
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ReToCode/networking v0.0.0-20230922054024-0ad79f254634 h1:mM/83eiu9VRn3HcyJJq31Dy4sjjVzGYG4sBw+kYhhUM=
-github.com/ReToCode/networking v0.0.0-20230922054024-0ad79f254634/go.mod h1:t5rGgqqJ55N1KdGcaT/S/3mVJfttqQx0xa/wxcLC09w=
 github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
 github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
 github.com/ahmetb/gen-crd-api-reference-docs v0.3.1-0.20210609063737-0067dc6dcea2 h1:t/ces1/q8tuApSb+T5ajsu3wqkofUT43U1gpDYTPYME=
@@ -927,6 +925,8 @@ knative.dev/caching v0.0.0-20230920131814-94468139a072 h1:IstfPsvNrNYLN/pqYkCeEi
 knative.dev/caching v0.0.0-20230920131814-94468139a072/go.mod h1:qD/ScmVr6Z7v23FL1JL8rCrPdvAN2WokwVGLdqGLSmc=
 knative.dev/hack v0.0.0-20230921145603-c4a34c34512e h1:6Va+yK7+Sjtnck9dsCDsgk/1k+K0Hx9HPZ2ZJ7mRJFs=
 knative.dev/hack v0.0.0-20230921145603-c4a34c34512e/go.mod h1:dx0YG3YWqJu653e9tjcT0Q1ZdS9JJXLKbUhzr4EB0g8=
+knative.dev/networking v0.0.0-20230921070414-6aa88055400d h1:avwL7zSaTNm9rdi0gVKLYLQ71iYmM7LKP71xrQV/AH4=
+knative.dev/networking v0.0.0-20230921070414-6aa88055400d/go.mod h1:5MM0oDUBDW1Y6pqxr3FPSpHL07ajdKSzHGtjV+j0BZw=
 knative.dev/pkg v0.0.0-20230920131713-8761ceb9297f h1:ZapGIwjj8yUNfXhLo6f/DuDnNGV4UrqTIwVgxRir9HI=
 knative.dev/pkg v0.0.0-20230920131713-8761ceb9297f/go.mod h1:a133faJchgmFZIJyOOcFq34NbWnrUcOvwVKgK6hfrHE=
 pgregory.net/rapid v1.0.0 h1:iQaM2w5PZ6xvt6x7hbd7tiDS+nk7YPp5uCaEba+T/F4=

vendor/knative.dev/networking/config/config-network.yaml

@@ -22,7 +22,7 @@ metadata:
     app.kubernetes.io/component: networking
     app.kubernetes.io/version: devel
   annotations:
-    knative.dev/example-checksum: "b2698fe8"
+    knative.dev/example-checksum: "cfad3b9a"
 data:
   _example: |
     ################################
@@ -73,7 +73,7 @@ data:
     #   namespace-wildcard-cert-selector: {}
     #
     # Useful labels include the "kubernetes.io/metadata.name" label to
-    # avoid provisioning a certificate for the "kube-system" namespaces.
+    # avoid provisioning a certifcate for the "kube-system" namespaces.
     # Use the following selector to match pre-1.0 behavior of using
     # "networking.knative.dev/disableWildcardCert" to exclude namespaces:
     #
@@ -114,45 +114,16 @@ data:
     # domain-template above to determine the full URL for the tag.
     tag-template: "{{.Tag}}-{{.Name}}"
 
-    # auto-tls is deprecated and replaced by external-domain-tls
-    auto-tls: "Disabled"
-
     # Controls whether TLS certificates are automatically provisioned and
-    # installed in the Knative ingress to terminate TLS connections
-    # for cluster external domains (like: app.example.com)
-    # - Enabled: enables the TLS certificate provisioning feature for cluster external domains.
-    # - Disabled: disables the TLS certificate provisioning feature for cluster external domains.
-    external-domain-tls: "Disabled"
-
-    # Controls weather TLS certificates are automatically provisioned and
-    # installed in the Knative ingress to terminate TLS connections
-    # for cluster local domains (like: app.namespace.svc.cluster.local)
-    # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.
-    # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.
-    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
-    #       for now. Use with caution.
-    cluster-local-domain-tls: "Disabled"
-
-    # internal-encryption is deprecated and replaced by system-internal-tls
-    internal-encryption: "false"
-
-    # system-internal-tls controls weather TLS encryption is used for connections between
-    # the internal components of Knative:
-    # - ingress to activator
-    # - ingress to queue-proxy
-    # - activator to queue-proxy
-    #
-    # Possible values for this flag are:
-    # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.
-    # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.
-    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
-    #       for now. Use with caution.
-    system-internal-tls: "Disabled"
+    # installed in the Knative ingress to terminate external TLS connection.
+    # 1. Enabled: enabling auto-TLS feature.
+    # 2. Disabled: disabling auto-TLS feature.
+    auto-tls: "Disabled"
 
     # Controls the behavior of the HTTP endpoint for the Knative ingress.
     # It requires auto-tls to be enabled.
-    # - Enabled: The Knative ingress will be able to serve HTTP connection.
-    # - Redirected: The Knative ingress will send a 301 redirect for all
+    # 1. Enabled: The Knative ingress will be able to serve HTTP connection.
+    # 2. Redirected: The Knative ingress will send a 301 redirect for all
     # http connections, asking the clients to use HTTPS.
     #
     # "Disabled" option is deprecated.
@@ -201,3 +172,35 @@ data:
     # fronting Knative with an external loadbalancer that deals with TLS termination and
     # Knative doesn't know about that otherwise.
     default-external-scheme: "http"
+
+    # internal-encryption is deprecated and replaced by dataplane-trust and controlplane-trust
+    # internal-encryption indicates whether internal traffic is encrypted or not.
+    #
+    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
+    #       for now. Use with caution.
+    internal-encryption: "false"
+
+    # dataplane-trust indicates the level of trust established in the knative data-plane.
+    # dataplane-trust = "disabled" (the default) - uses no encryption for internal data plane traffic
+    # Using any other value ensures that the following traffic is encrypted using TLS:
+    #  - ingress to activator
+    #  - ingress to queue-proxy
+    #  - activator to queue-proxy
+    #
+    # dataplane-trust = "minimal" ensures data messages are encrypted, Kingress authenticate that the receiver is a Ksvc
+    # dataplane-trust = "enabled" same as "minimal" and in addition, Kingress authenticate that Ksvc is at the correct namespace
+    # dataplane-trust = "mutual" same as "enabled" and in addition, Ksvc authenticate that the messages come from the Kingress
+    # dataplane-trust = "identity" same as "mutual" with Kingress adding a trusted sender identity to the message
+    #
+    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing for now. Use with caution.
+    dataplane-trust: "disabled"
+
+    # controlplane-trust indicates the level of trust established in the knative control-plane.
+    # controlplane-trust = "disabled" (the default) - uses no encryption for internal control plane traffic
+    # Using any other value ensures that control traffic is encrypted using TLS.
+    #
+    # controlplane-trust = "enabled" ensures control messages are encrypted using TLS (client authenticate the server)
+    # controlplane-trust = "mutual" ensures control messages are encrypted using mTLS (client and server authenticate each other)
+    #
+    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing for now. Use with caution.
+    controlplane-trust: "disabled"

vendor/knative.dev/networking/pkg/apis/networking/metadata_validation.go

@@ -29,7 +29,6 @@ var (
 		IngressClassAnnotationKey,
 		CertificateClassAnnotationKey,
 		DisableAutoTLSAnnotationKey,
-		DisableExternalDomainTLSAnnotationKey,
 		HTTPOptionAnnotationKey,
 
 		IngressClassAnnotationAltKey,

vendor/knative.dev/networking/pkg/apis/networking/register.go

@@ -70,17 +70,11 @@ const (
 
 	// DisableAutoTLSAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
 	// to indicate that AutoTLS should not be enabled for it.
-	// Deprecated: use DisableExternalDomainTLSAnnotationKey instead.
 	DisableAutoTLSAnnotationKey = PublicGroupName + "/disableAutoTLS"
 
 	// DisableAutoTLSAnnotationAltKey is an alternative casing to DisableAutoTLSAnnotationKey
-	// Deprecated: use DisableExternalDomainTLSAnnotationKey instead.
 	DisableAutoTLSAnnotationAltKey = PublicGroupName + "/disable-auto-tls"
 
-	// DisableExternalDomainTLSAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
-	// to indicate that external-domain-tls should not be enabled for it.
-	DisableExternalDomainTLSAnnotationKey = PublicGroupName + "/disable-external-domain-tls"
-
 	// HTTPOptionAnnotationKey is the annotation key attached to a Knative Service/DomainMapping
 	// to indicate the HTTP option of it.
 	HTTPOptionAnnotationKey = PublicGroupName + "/httpOption"
@@ -136,15 +130,9 @@ var (
 		CertificateClassAnnotationAltKey,
 	}
 
-	// Deprecated: use DisableExternalDomainTLSAnnotation instead.
-	DisableAutoTLSAnnotation = DisableExternalDomainTLSAnnotation
-
-	DisableExternalDomainTLSAnnotation = kmap.KeyPriority{
-		// backward compatibility
+	DisableAutoTLSAnnotation = kmap.KeyPriority{
 		DisableAutoTLSAnnotationKey,
 		DisableAutoTLSAnnotationAltKey,
-
-		DisableExternalDomainTLSAnnotationKey,
 	}
 
 	HTTPProtocolAnnotation = kmap.KeyPriority{
@@ -165,9 +153,6 @@ func GetHTTPProtocol(annotations map[string]string) (val string) {
 	return HTTPProtocolAnnotation.Value(annotations)
 }
 
-// Deprecated: use GetDisableExternalDomainTLS instead.
-var GetDisableAutoTLS = GetDisableExternalDomainTLS
-
-func GetDisableExternalDomainTLS(annotations map[string]string) (val string) {
-	return DisableExternalDomainTLSAnnotation.Value(annotations)
+func GetDisableAutoTLS(annotations map[string]string) (val string) {
+	return DisableAutoTLSAnnotation.Value(annotations)
 }