In 1.28 the annotation `serverless.openshift.io/enable-secret-informer-filtering` on the Serving CR is deprecated. The annotation is not valid for Kourier, it is only used for Istio. In 1.28 Serverless operator allows injecting the env var ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID for both net-istio and net-kourier. In future releases Serverless operator will enable secret filtering via env var injection by default for both Kourier and Istio. Users MUST start annotating their secrets with networking.internal.knative.dev/certificate-uid:some_cuid so they don’t face issues when they upgrade from 1.28 to some future release.