upgrade to latest dependencies

bumping knative.dev/hack 7d81248...5b7907f:%0A  > 5b7907f Update actions (# 289)%0A  > c133d5d Install Istio for tests (# 291)%0A  > 5812c57 Update community files (# 292)%0Abumping knative.dev/eventing 4b9fdef...df08b49:%0A  > df08b49 Eventing TLS: verify APIServerSource and PingSource sinkURI is https (# 6987)%0A  > d21c1aa [main] Upgrade to latest dependencies (# 6989)%0A  > 70113e8 Deprecate broker field and use KReference for the broker instead (# 6870)%0A  > 4e4647f test update to newest version (# 6990)%0A  > 870ac6b Update MessageDispatcher and FanoutMessageHandler to support sending events to TLS endpoints (# 6983)%0A  > 6dd5d58 Test PingSource with eventshub TLS receiver as sink (# 6965)%0A  > 55f4f28 [main] Upgrade to latest dependencies (# 6982)%0A  > 2a5a9a5 Add more items in the development getting started documentation (# 6978)%0A  > 59118a0 imc-dispatcher starts a TLS server, accepts host based routing on http receiver and path based routing on https receiver (# 6954)%0A  > ee49ada Rework kncloudevents library to support multiple clients (# 6975)%0A  > ee88094 Make ServerManager independent from kncloudevents package (# 6980)%0A  > 6a11c5f [main] Upgrade to latest dependencies (# 6969)%0A  > 8a9a532 Updated DEVELOPMENT.md to provide better instructions on setting up kubernetes (# 6977)%0A  > 390a0c8 Eventing TLS: Test ContainerSource with eventshub TLS receiver as sink (# 6957)%0A  > 5e245ac Fix flaky PingSource TLS unit test (# 6970)%0A  > f9f27c9 Use random names in Channel tests (# 6967)%0A  > d4609a5 Do not parse flags in InitializeEventingFlags (# 6966)%0A  > ef68a0a [main] Update community files (# 6968)%0A  > 4adc287 Add transport-encryption prerequisite for Addressable tests (# 6964)%0A  > deb0ef4 Add field for subscribers & replys CA certs to `SubscriberSpec` and `SubscriptionStatusPhysicalSubscription` (# 6959)%0A  > b81082c Eventing TLS: Test ApiServerSource with eventshub TLS receiver as sink (# 6956)%0A  > cdff269 Adding source duck type to v1b2 (# 6962)%0A  > b47b4ec [main] Upgrade to latest dependencies (# 6958)%0A  > 3315c20 Provide Channels CACerts in Brokers status annotation (# 6952)%0Abumping knative.dev/client-pkg e5c405e...83c91f4:%0A  > 83c91f4 Update community files (# 103)%0Abumping knative.dev/pkg dfb4bf0...5671699:%0A  > 5671699 drop the dynamic type (# 2750)%0A  > 9bda38b Fix some webhook testing tech debt (# 2751)%0A  > ec20442 Update community files (# 2747)%0A  > 05bfcf6 bump k8s dependencies and update min version to v1.25 (# 2745)%0A  > 52ff2ac drop dynamic client wrappers (# 2744)%0A  > a170a07 Eventing TLS: validate that Destination.CACerts is a PEM encoded cert (# 2743)%0Abumping knative.dev/serving 99800ed...349b2d6:%0A  > 349b2d6 Change minimum TLS version to 1.3 for internal encryption (between activator and queue-proxy) (# 13887)%0A  > d07bf78 Update net-contour nightly (# 14049)%0A  > aa023e8 Update net-istio nightly (# 14048)%0A  > 8fc4bb9 Update net-gateway-api nightly (# 14047)%0A  > 135be30 Update net-certmanager nightly (# 14046)%0A  > 8da71b5 Update net-kourier nightly (# 14042)%0A  > 13a4e46 poll until timeout - don't error out if the deployment can't be found (# 14027)%0A  > 31c2b7e upgrade to latest dependencies (# 14043)%0A  > 6a6e417 Update net-istio nightly (# 14041)%0A  > 807fc2c Update net-certmanager nightly (# 14040)%0A  > 3c23945 drop safe to evict annotations (# 14035)%0A  > fca5c14 Update net-gateway-api nightly (# 14033)%0A  > c12c917 Update net-contour nightly (# 14034)%0A  > 2da856d Update net-kourier nightly (# 14032)%0A  > d7c8779 Update net-certmanager nightly (# 14031)%0A  > aaf01dc Update net-istio nightly (# 14030)%0A  > bdaa436 RandomChoice 2 policy wasn't random when the number of targets is 2 (with equal weight) (# 14028)%0A  > c91f8c4 Fix metrics reporting period (# 14019)%0A  > 9f60969 Update net-kourier nightly (# 14004)%0A  > 6020cec Update net-istio nightly (# 14025)%0A  > 88cae7f Update net-gateway-api nightly (# 14016)%0A  > a143bf8 Update net-contour nightly (# 14015)%0A  > c2be582 Update net-certmanager nightly (# 14014)%0A  > 3450f0a upgrade to latest dependencies (# 14013)%0A  > 35cfd8f [Automated] Update net-gateway-api nightly (# 14003)%0A  > 08a9708 Update net-istio nightly (# 14009)%0A  > 5074b4c Update net-contour nightly (# 14010)%0A  > e8cb343 upgrade to latest dependencies (# 13999)%0A  > 1261074 Update net-certmanager nightly (# 14002)%0A  > f987ca6 Bump kind to 0.19 (# 14008)%0A  > fbb7fa1 Update community files (# 13998)%0A  > bff1d80 Remove 1.24 kind version (# 14007)%0A  > a657321 Update net-kourier nightly (# 13993)%0A  > d75b0f0 Update net-contour nightly (# 13990)%0A  > 6d26f54 upgrade to latest dependencies (# 13991)%0A  > df5001f Update net-certmanager nightly (# 13992)%0A  > 2594084 upgrade to latest dependencies (# 13989)%0A  > 7c303fa Update cluster-version to 1.25 (# 13988)%0A  > 9e751a2 Update net-certmanager nightly (# 13974)%0A  > 7b35cfb upgrade to latest dependencies (# 13987)%0Abumping knative.dev/networking 33636d9...2a2f7d2:%0A  > 2a2f7d2 upgrade to latest dependencies (# 810)%0A  > fcbedad Update community files (# 809)%0A  > a44b093 upgrade to latest dependencies (# 808)%0A  > 7c2f7ac upgrade to latest dependencies (# 807)%0Abumping k8s.io/apiextensions-apiserver e8bd314...52c998e:%0A  > 52c998e Update dependencies to v0.26.5 tag%0A  > 186ff9b Merge pull request # 117274 from jkh52/release-1.26-knp-0.0.37%0A  > b7b18f5 Merge pull request # 117691 from dims/re-do-of-117242-on-release-1.26%0A  > ee5015a Bump konnectivity-client to 0.0.37%0A  > 9ce75f3 Bump runc go module v1.1.4 -> v1.1.6%0A  > e9d194a Merge pull request # 115599 from jkh52/release-1.26-knp-0.0.36%0A  > d7df0be Merge pull request # 115787 from liggitt/net-0.7.0-1.26%0A  > 9152c67 Bump konnectivity-client to v0.0.36%0A  > 89cec57 Update golang.org/x/net to v0.7.0%0A  > f72cc5c Merge pull request # 115642 from nckturner/pin-golang.org/x/net-to-v0.4.0-in-1.26%0A  > 28eb995 Pin golang.org/x/net to v0.4.0 in 1.26

Signed-off-by: Knative Automation <[email protected]>

go.mod

@@ -43,14 +43,14 @@ require (
 	golang.org/x/term v0.8.0
 	gopkg.in/yaml.v2 v2.4.0
 	gotest.tools/v3 v3.4.0
-	k8s.io/api v0.26.4
-	k8s.io/apimachinery v0.26.4
+	k8s.io/api v0.26.5
+	k8s.io/apimachinery v0.26.5
 	k8s.io/client-go v1.5.2
-	knative.dev/client-pkg v0.0.0-20230501131754-e5c405e16e90
-	knative.dev/eventing v0.37.1-0.20230518094712-4b9fdefe36a3
-	knative.dev/hack v0.0.0-20230501013555-7d81248b4638
-	knative.dev/pkg v0.0.0-20230518105712-dfb4bf04635d
-	knative.dev/serving v0.37.1-0.20230515180909-99800edf6260
+	knative.dev/client-pkg v0.0.0-20230524014834-83c91f47f64f
+	knative.dev/eventing v0.37.1-0.20230601130337-df08b49b7477
+	knative.dev/hack v0.0.0-20230530201435-5b7907fbe350
+	knative.dev/pkg v0.0.0-20230531073936-5671699f23d9
+	knative.dev/serving v0.37.1-0.20230603021539-349b2d61b0e8
 )
 
 require (
@@ -235,12 +235,12 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.26.1 // indirect
+	k8s.io/apiextensions-apiserver v0.26.5 // indirect
 	k8s.io/cli-runtime v0.25.9 // indirect
 	k8s.io/klog/v2 v2.90.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230308215209-15aac26d736a // indirect
 	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
-	knative.dev/networking v0.0.0-20230511122402-33636d99d870 // indirect
+	knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kustomize/api v0.12.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect

go.sum

@@ -2477,8 +2477,8 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.5/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.25.4 h1:3YO8J4RtmG7elEgaWMb4HgmpS2CfY1QlaOz9nwB+ZSs=
 k8s.io/api v0.25.4/go.mod h1:IG2+RzyPQLllQxnhzD8KQNEu4c4YvyDTpSMztf4A0OQ=
-k8s.io/apiextensions-apiserver v0.26.1 h1:cB8h1SRk6e/+i3NOrQgSFij1B2S0Y0wDoNl66bn8RMI=
-k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM=
+k8s.io/apiextensions-apiserver v0.26.5 h1:VJ946z9RjyCPn3qiz4Kus/UYjCRrdn1xUvEsJFvN5Yo=
+k8s.io/apiextensions-apiserver v0.26.5/go.mod h1:Olsde7ZNWnyz9rsL13iXYXmL1h7kWujtKeC3yWVCDPo=
 k8s.io/apimachinery v0.25.4 h1:CtXsuaitMESSu339tfhVXhQrPET+EiWnIY1rcurKnAc=
 k8s.io/apimachinery v0.25.4/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo=
 k8s.io/apiserver v0.17.4/go.mod h1:5ZDQ6Xr5MNBxyi3iUZXS84QOhZl+W7Oq2us/29c0j9I=
@@ -2524,18 +2524,18 @@ k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
 k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/client-pkg v0.0.0-20230501131754-e5c405e16e90 h1:1QBZWaLkXsKD2RR0WlEHNt26v7NJt0qLXBJk0/EPlKg=
-knative.dev/client-pkg v0.0.0-20230501131754-e5c405e16e90/go.mod h1:oYnznlTBCj/bVEHo5vUSM/VS3oDFNJKDmH5+k1aC9/8=
-knative.dev/eventing v0.37.1-0.20230518094712-4b9fdefe36a3 h1:jjy1VqCqM80el9xPaNbMfvR/spKPfvJV80RCEuBh8Pw=
-knative.dev/eventing v0.37.1-0.20230518094712-4b9fdefe36a3/go.mod h1:i7vY9K8kDhDwFqMoNXnc2DBr9YGoHiLMx04zkrYoEAA=
-knative.dev/hack v0.0.0-20230501013555-7d81248b4638 h1:9IuXHdwp5jNmIg+0LVTQr8o4u0FYD99uCfynM9tS0XY=
-knative.dev/hack v0.0.0-20230501013555-7d81248b4638/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
-knative.dev/networking v0.0.0-20230511122402-33636d99d870 h1:OmpaXjgdpF6GNW5S6OV6JN19gbiDCzfkEQQb9TQp9gU=
-knative.dev/networking v0.0.0-20230511122402-33636d99d870/go.mod h1:OG9AEepHd3dofzrkzb0IelqN5uzu10RjbSdhl5UruSE=
-knative.dev/pkg v0.0.0-20230518105712-dfb4bf04635d h1:jGvqcYwyh7O1V2PZfd0poheaOOvy6x0z+KQxHXOgskc=
-knative.dev/pkg v0.0.0-20230518105712-dfb4bf04635d/go.mod h1:WLTHHHc/dhrDmhx03nm5F8AeqpNx3RQGggMI2N0/oks=
-knative.dev/serving v0.37.1-0.20230515180909-99800edf6260 h1:A6gakCIlzqFLNEZWhVTpsE89eZ5BkNANQm6O8rYm9J0=
-knative.dev/serving v0.37.1-0.20230515180909-99800edf6260/go.mod h1:5yvsSpmUK3hnIDHE8mA2S8ri0K6mkpecinBuqXBHPPY=
+knative.dev/client-pkg v0.0.0-20230524014834-83c91f47f64f h1:hlLa78gxH9gkgLC/fmsnh9+x/8zCpPS40q0c8K065aQ=
+knative.dev/client-pkg v0.0.0-20230524014834-83c91f47f64f/go.mod h1:oYnznlTBCj/bVEHo5vUSM/VS3oDFNJKDmH5+k1aC9/8=
+knative.dev/eventing v0.37.1-0.20230601130337-df08b49b7477 h1:yTdDWJMFVroD2EGFkXEy5MueqafC/Px25zh50W0B8+E=
+knative.dev/eventing v0.37.1-0.20230601130337-df08b49b7477/go.mod h1:00ZmViqsuF5wC8D9XvPGxfrT3Fb3JIaRvIzjk+3ppHo=
+knative.dev/hack v0.0.0-20230530201435-5b7907fbe350 h1:lSV9uFTohrQd7i5OUhLnR87PwUHJplQKJSEiZgzP/VY=
+knative.dev/hack v0.0.0-20230530201435-5b7907fbe350/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
+knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60 h1:vErunGWa8pZNriLFaE4UbgdqNECKF7gJTYZE+DdOuOE=
+knative.dev/networking v0.0.0-20230524170920-2a2f7d2d7c60/go.mod h1:ieNknBTSWl441656hZF1JNHbTXbab138w8qPEwuwC0Q=
+knative.dev/pkg v0.0.0-20230531073936-5671699f23d9 h1:xd7E2nuQ358cXR4jB7Y5+FH88Mm+SQTZty5pXa1TSfs=
+knative.dev/pkg v0.0.0-20230531073936-5671699f23d9/go.mod h1:dqC6IrvyBE7E+oZocs5PkVhq1G59pDTA7r8U17EAKMk=
+knative.dev/serving v0.37.1-0.20230603021539-349b2d61b0e8 h1:eTTTvVA2ACpnVf9yWT0+vHb0nssHTQIm3N7bh09hDIY=
+knative.dev/serving v0.37.1-0.20230603021539-349b2d61b0e8/go.mod h1:GvvhPpKFkidelYBzmsiYQO2KubaQzNo/hJf67f5tKaA=
 modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
 modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=

vendor/knative.dev/eventing/pkg/apis/duck/v1/subscribable_types.go

@@ -42,9 +42,19 @@ type SubscriberSpec struct {
 	// SubscriberURI is the endpoint for the subscriber
 	// +optional
 	SubscriberURI *apis.URL `json:"subscriberUri,omitempty"`
+	// SubscriberCACerts is the Certification Authority (CA) certificates in PEM
+	// format according to https://www.rfc-editor.org/rfc/rfc7468 for the
+	// subscriberUri
+	// +optional
+	SubscriberCACerts *string `json:"subscriberCACerts,omitempty"`
 	// ReplyURI is the endpoint for the reply
 	// +optional
 	ReplyURI *apis.URL `json:"replyUri,omitempty"`
+	// ReplyCACerts is the Certification Authority (CA) certificates in PEM
+	// format according to https://www.rfc-editor.org/rfc/rfc7468 for the
+	// replyUri.
+	// +optional
+	ReplyCACerts *string `json:"replyCACerts,omitempty"`
 	// +optional
 	// DeliverySpec contains options controlling the event delivery
 	// +optional

vendor/knative.dev/eventing/pkg/apis/eventing/register.go

@@ -60,6 +60,12 @@ const (
 	// annotation key used to specify the address of its channel.
 	BrokerChannelAddressStatusAnnotationKey = "knative.dev/channelAddress"
 
+	// BrokerChannelCACertsStatusAnnotationKey is the broker status annotation
+	// key used to specify the channels Certification Authority (CA)
+	// certificates in PEM format according to
+	// https://www.rfc-editor.org/rfc/rfc7468
+	BrokerChannelCACertsStatusAnnotationKey = "knative.dev/channelCACerts"
+
 	// BrokerChannelAPIVersionStatusAnnotationKey is the broker status
 	// annotation key used to specify the APIVersion of the channel for
 	// the triggers to subscribe to.

vendor/knative.dev/eventing/pkg/apis/eventing/v1beta1/eventtype_conversion.go

@@ -19,6 +19,8 @@ package v1beta1
 import (
 	"context"
 
+	duckv1 "knative.dev/pkg/apis/duck/v1"
+
 	"knative.dev/eventing/pkg/apis/eventing/v1beta2"
 
 	"knative.dev/pkg/apis"
@@ -33,11 +35,15 @@ func (source *EventType) ConvertTo(ctx context.Context, obj apis.Convertible) er
 			Status: source.Status.Status,
 		}
 		sink.Spec = v1beta2.EventTypeSpec{
-			Type:        source.Spec.Type,
-			Source:      source.Spec.Source,
-			Schema:      source.Spec.Schema,
-			SchemaData:  source.Spec.SchemaData,
-			Broker:      source.Spec.Broker,
+			Type:       source.Spec.Type,
+			Source:     source.Spec.Source,
+			Schema:     source.Spec.Schema,
+			SchemaData: source.Spec.SchemaData,
+			Reference: &duckv1.KReference{
+				APIVersion: "eventing.knative.dev/v1",
+				Kind:       "Broker",
+				Name:       source.Spec.Broker,
+			},
 			Description: source.Spec.Description,
 		}
 
@@ -61,7 +67,7 @@ func (sink *EventType) ConvertFrom(ctx context.Context, obj apis.Convertible) er
 			Source:      source.Spec.Source,
 			Schema:      source.Spec.Schema,
 			SchemaData:  source.Spec.SchemaData,
-			Broker:      source.Spec.Broker,
+			Broker:      source.Spec.Reference.Name,
 			Description: source.Spec.Description,
 		}
 

vendor/knative.dev/eventing/pkg/apis/eventing/v1beta1/eventtype_types.go

@@ -41,7 +41,6 @@ type EventType struct {
 	// Status represents the current state of the EventType.
 	// This data may be out of date.
 	// +optional
-	// TODO might be removed https://github.com/knative/eventing/issues/2750
 	Status EventTypeStatus `json:"status,omitempty"`
 }
 
@@ -77,7 +76,6 @@ type EventTypeSpec struct {
 	// The contents are not validated or manipulated by the system.
 	// +optional
 	SchemaData string `json:"schemaData,omitempty"`
-	// TODO remove https://github.com/knative/eventing/issues/2750
 	// Broker refers to the Broker that can provide the EventType.
 	// +optional
 	Broker string `json:"broker,omitempty"`

vendor/knative.dev/eventing/pkg/apis/eventing/v1beta2/eventtype_defaults.go

@@ -16,14 +16,22 @@ limitations under the License.
 
 package v1beta2
 
-import "context"
+import (
+	"context"
+
+	duckv1 "knative.dev/pkg/apis/duck/v1"
+)
 
 func (et *EventType) SetDefaults(ctx context.Context) {
 	et.Spec.SetDefaults(ctx)
 }
 
 func (ets *EventTypeSpec) SetDefaults(ctx context.Context) {
-	if ets.Broker == "" {
-		ets.Broker = "default"
+	if ets.Reference == nil {
+		ets.Reference = &duckv1.KReference{
+			APIVersion: "eventing.knative.dev/v1",
+			Kind:       "Broker",
+			Name:       "default",
+		}
 	}
 }

vendor/knative.dev/eventing/pkg/apis/eventing/v1beta2/eventtype_types.go

@@ -41,7 +41,6 @@ type EventType struct {
 	// Status represents the current state of the EventType.
 	// This data may be out of date.
 	// +optional
-	// TODO might be removed https://github.com/knative/eventing/issues/2750
 	Status EventTypeStatus `json:"status,omitempty"`
 }
 
@@ -77,10 +76,14 @@ type EventTypeSpec struct {
 	// The contents are not validated or manipulated by the system.
 	// +optional
 	SchemaData string `json:"schemaData,omitempty"`
-	// TODO remove https://github.com/knative/eventing/issues/2750
 	// Broker refers to the Broker that can provide the EventType.
+	// Deprecated: This field is deprecated and will be removed in a future release.
 	// +optional
 	Broker string `json:"broker,omitempty"`
+	// Reference is a KReference to the belonging addressable.
+	//For example, this could be a pointer to a Broker.
+	// +optional
+	Reference *duckv1.KReference `json:"reference,omitempty"`
 	// Description is an optional field used to describe the EventType, in any meaningful way.
 	// +optional
 	Description string `json:"description,omitempty"`

vendor/knative.dev/eventing/pkg/apis/feature/features.go

@@ -76,6 +76,10 @@ func (e Flags) IsDisabledTransportEncryption() bool {
 	return e != nil && e[TransportEncryption] == Disabled
 }
 
+func (e Flags) String() string {
+	return fmt.Sprintf("%+v", map[string]Flag(e))
+}
+
 // NewFlagsConfigFromMap creates a Flags from the supplied Map
 func NewFlagsConfigFromMap(data map[string]string) (Flags, error) {
 	flags := Flags{}

vendor/knative.dev/eventing/pkg/apis/messaging/v1/subscription_types.go

@@ -123,10 +123,22 @@ type SubscriptionStatusPhysicalSubscription struct {
 	// +optional
 	SubscriberURI *apis.URL `json:"subscriberUri,omitempty"`
 
+	// SubscriberCACerts is the Certification Authority (CA) certificates in PEM
+	// format according to https://www.rfc-editor.org/rfc/rfc7468 for the
+	// resolved URI for spec.subscriber.
+	// +optional
+	SubscriberCACerts *string `json:"subscriberCACerts,omitempty"`
+
 	// ReplyURI is the fully resolved URI for the spec.reply.
 	// +optional
 	ReplyURI *apis.URL `json:"replyUri,omitempty"`
 
+	// ReplyCACerts is the Certification Authority (CA) certificates in PEM
+	// format according to https://www.rfc-editor.org/rfc/rfc7468 for the
+	// resolved URI for the spec.reply.
+	// +optional
+	ReplyCACerts *string `json:"replyCACerts,omitempty"`
+
 	// DeliveryStatus contains a resolved URL to the dead letter sink address, and any other
 	// resolved delivery options.
 	eventingduckv1.DeliveryStatus `json:",inline"`

vendor/knative.dev/eventing/pkg/apis/sources/v1/apiserver_lifecycle.go

@@ -20,6 +20,7 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	duckv1 "knative.dev/pkg/apis/duck/v1"
 
 	"knative.dev/pkg/apis"
 )
@@ -75,9 +76,10 @@ func (s *ApiServerSourceStatus) InitializeConditions() {
 }
 
 // MarkSink sets the condition that the source has a sink configured.
-func (s *ApiServerSourceStatus) MarkSink(uri *apis.URL) {
-	s.SinkURI = uri
-	if uri != nil {
+func (s *ApiServerSourceStatus) MarkSink(addr *duckv1.Addressable) {
+	if addr != nil {
+		s.SinkURI = addr.URL
+		s.SinkCACerts = addr.CACerts
 		apiserverCondSet.Manage(s).MarkTrue(ApiServerConditionSinkProvided)
 	} else {
 		apiserverCondSet.Manage(s).MarkFalse(ApiServerConditionSinkProvided, "SinkEmpty", "Sink has resolved to empty.%s", "")

vendor/knative.dev/pkg/apis/duck/v1/destination.go

@@ -18,6 +18,8 @@ package v1
 
 import (
 	"context"
+	"crypto/x509"
+	"encoding/pem"
 
 	"knative.dev/pkg/apis"
 )
@@ -53,6 +55,7 @@ func (d *Destination) Validate(ctx context.Context) *apis.FieldError {
 func ValidateDestination(ctx context.Context, dest Destination) *apis.FieldError {
 	ref := dest.Ref
 	uri := dest.URI
+	caCerts := dest.CACerts
 	if ref == nil && uri == nil {
 		return apis.ErrGeneric("expected at least one, got none", "ref", "uri")
 	}
@@ -67,6 +70,9 @@ func ValidateDestination(ctx context.Context, dest Destination) *apis.FieldError
 	if ref != nil && uri == nil {
 		return ref.Validate(ctx).ViaField("ref")
 	}
+	if caCerts != nil {
+		return validateCACerts(caCerts)
+	}
 	return nil
 }
 
@@ -88,3 +94,20 @@ func (d *Destination) SetDefaults(ctx context.Context) {
 		d.Ref.Namespace = apis.ParentMeta(ctx).Namespace
 	}
 }
+
+func validateCACerts(CACert *string) *apis.FieldError {
+	// Check the object.
+	var errs *apis.FieldError
+
+	block, err := pem.Decode([]byte(*CACert))
+	if err != nil && block == nil {
+		errs = errs.Also(apis.ErrInvalidValue("CA Cert provided is invalid", "caCert"))
+		return errs
+	}
+	if block.Type != "CERTIFICATE" {
+		errs = errs.Also(apis.ErrInvalidValue("CA Cert provided is not a certificate", "caCert"))
+	} else if _, err := x509.ParseCertificate(block.Bytes); err != nil {
+		errs = errs.Also(apis.ErrInvalidValue("CA Cert provided is invalid", "caCert"))
+	}
+	return errs
+}