Eliminate the need for activator restart when the certs update of internal encryption

[nak3]

Describe the feature

Currently activator must be restarted when certs are updated. The requirement should be eliminated.

[davidhadas]

Fixes: 13754

[dprotaso]

/triage accepted
/milestone Icebox

#13754 highlights that if you don't restart the activator it will start serving 503s

[nak3]

Just a quick note for this:

• ingress -> activator

It would be possible to support by using GetCertificate() like #13695.
However, it causes a performance degradation especially TestActivatorOverload test always fail.

• activator -> QP

Golang does not have the feature to reload root certificate and some requests are alrady opened like golang/go#41888 golang/go#35887

[ReToCode]

However, it causes a performance degradation especially TestActivatorOverload test always fail.

I'm wondering if we could do something like this: https://github.com/ReToCode/serving/blob/803b9f9d232a8e202df6edabe276f512279697b3/pkg/activator/certificate/resolver.go to improve the performance issue?

[nak3]

Great! Yes, CertResolver caches the certificates so it should improve the performance. I would like to see if it will pass the CI result.