diff --git a/aws-kubeflow-kserve/kserve-module/istio.tf b/aws-kubeflow-kserve/kserve-module/istio.tf
index 182db859..fb424a75 100644
--- a/aws-kubeflow-kserve/kserve-module/istio.tf
+++ b/aws-kubeflow-kserve/kserve-module/istio.tf
@@ -1,32 +1,32 @@
 # set up istio for kserve
 resource "null_resource" "create-istio-kserve" {
   provisioner "local-exec" {
-    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   # repeating the same command as a hack to prevent errors in subsequent commands
   # running it only once would have caused the next command to fail with no envoyfilter CRDs.
   provisioner "local-exec" {
-    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/net-istio.yaml"
+    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/net-istio.yaml"
   }
 
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl delete -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/net-istio.yaml"
+    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/net-istio.yaml --ignore-not-found"
   }
 
   depends_on = [
diff --git a/aws-kubeflow-kserve/kserve-module/knative_serving.tf b/aws-kubeflow-kserve/kserve-module/knative_serving.tf
index d031133b..5519c0fc 100644
--- a/aws-kubeflow-kserve/kserve-module/knative_serving.tf
+++ b/aws-kubeflow-kserve/kserve-module/knative_serving.tf
@@ -1,20 +1,20 @@
 # set up istio for kserve
 resource "null_resource" "create-knative-serving" {
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-crds.yaml"
+    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-crds.yaml"
   }
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-core.yaml"
+    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-core.yaml"
   }
 
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-crds.yaml"
+    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-crds.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-core.yaml"
+    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-core.yaml --ignore-not-found"
   }
 
 }
\ No newline at end of file
diff --git a/gcp-kubeflow-kserve/kserve-module/istio.tf b/gcp-kubeflow-kserve/kserve-module/istio.tf
index 182db859..fb424a75 100644
--- a/gcp-kubeflow-kserve/kserve-module/istio.tf
+++ b/gcp-kubeflow-kserve/kserve-module/istio.tf
@@ -1,32 +1,32 @@
 # set up istio for kserve
 resource "null_resource" "create-istio-kserve" {
   provisioner "local-exec" {
-    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   # repeating the same command as a hack to prevent errors in subsequent commands
   # running it only once would have caused the next command to fail with no envoyfilter CRDs.
   provisioner "local-exec" {
-    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl apply -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/net-istio.yaml"
+    command = "kubectl apply -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/net-istio.yaml"
   }
 
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl delete -l knative.dev/crd-install=true -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/istio.yaml"
+    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/istio.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.6.0/net-istio.yaml"
+    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v1.9.0/net-istio.yaml --ignore-not-found"
   }
 
   depends_on = [
diff --git a/gcp-kubeflow-kserve/kserve-module/knative_serving.tf b/gcp-kubeflow-kserve/kserve-module/knative_serving.tf
index d031133b..5519c0fc 100644
--- a/gcp-kubeflow-kserve/kserve-module/knative_serving.tf
+++ b/gcp-kubeflow-kserve/kserve-module/knative_serving.tf
@@ -1,20 +1,20 @@
 # set up istio for kserve
 resource "null_resource" "create-knative-serving" {
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-crds.yaml"
+    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-crds.yaml"
   }
   provisioner "local-exec" {
-    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-core.yaml"
+    command = "kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-core.yaml"
   }
 
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-crds.yaml"
+    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-crds.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.6.0/serving-core.yaml"
+    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v1.9.0/serving-core.yaml --ignore-not-found"
   }
 
 }
\ No newline at end of file
diff --git a/gcp-kubeflow-kserve/kserve-module/kserve.tf b/gcp-kubeflow-kserve/kserve-module/kserve.tf
index 3621fb73..a0c2d19f 100644
--- a/gcp-kubeflow-kserve/kserve-module/kserve.tf
+++ b/gcp-kubeflow-kserve/kserve-module/kserve.tf
@@ -10,11 +10,11 @@ resource "null_resource" "kserve" {
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v0.9.0/kserve.yaml"
+    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v0.9.0/kserve.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v0.9.0/kserve-runtimes.yaml"
+    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v0.9.0/kserve-runtimes.yaml --ignore-not-found"
   }
 
   depends_on = [
diff --git a/gcp-kubeflow-kserve/kubeflow.tf b/gcp-kubeflow-kserve/kubeflow.tf
index 4eb640b8..8958c119 100644
--- a/gcp-kubeflow-kserve/kubeflow.tf
+++ b/gcp-kubeflow-kserve/kubeflow.tf
@@ -30,4 +30,29 @@ resource "null_resource" "kubeflow" {
     null_resource.configure-local-kubectl,
     module.gke,
   ]
+}
+
+
+# allow the kubeflow kubernetes sa to access GKE's IAM role
+# the GKE IAM role should have access to Storage resources
+resource "google_service_account_iam_member" "kubeflow-storage-access" {
+  service_account_id = google_service_account.gke-service-account.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${local.project_id}.svc.id.goog[kubeflow/default]"
+  depends_on = [
+    null_resource.kubeflow
+  ]
+}
+  
+# add annotation to kubernetes sa pipeline-runner
+resource "kubernetes_annotations" "pipeline-runner" {
+  api_version = "v1"
+  kind        = "ServiceAccount"
+  metadata {
+    name      = "pipeline-runner"
+    namespace = "kubeflow"
+  }
+  annotations = {
+    "iam.gke.io/gcp-service-account" = "${google_service_account.gke-service-account.email}"
+  }
 }
\ No newline at end of file
diff --git a/modules/kserve-module/knative_serving.tf b/modules/kserve-module/knative_serving.tf
index 578d9325..19769e42 100644
--- a/modules/kserve-module/knative_serving.tf
+++ b/modules/kserve-module/knative_serving.tf
@@ -17,15 +17,15 @@ resource "null_resource" "knative-serving" {
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v${self.triggers.knative_version}/net-istio.yaml"
+    command = "kubectl delete -f https://github.com/knative/net-istio/releases/download/knative-v${self.triggers.knative_version}/net-istio.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v${self.triggers.knative_version}/serving-core.yaml"
+    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v${self.triggers.knative_version}/serving-core.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v${self.triggers.knative_version}/serving-crds.yaml"
+    command = "kubectl delete -f https://github.com/knative/serving/releases/download/knative-v${self.triggers.knative_version}/serving-crds.yaml --ignore-not-found"
   }
 
 }
diff --git a/modules/kserve-module/kserve.tf b/modules/kserve-module/kserve.tf
index d03ce5ca..1e800b66 100644
--- a/modules/kserve-module/kserve.tf
+++ b/modules/kserve-module/kserve.tf
@@ -13,11 +13,11 @@ resource "null_resource" "kserve" {
   # destroy-time provisioners
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v${self.triggers.kserve_version}/kserve-runtimes.yaml"
+    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v${self.triggers.kserve_version}/kserve-runtimes.yaml --ignore-not-found"
   }
   provisioner "local-exec" {
     when    = destroy
-    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v${self.triggers.kserve_version}/kserve.yaml"
+    command = "kubectl delete -f https://github.com/kserve/kserve/releases/download/v${self.triggers.kserve_version}/kserve.yaml --ignore-not-found"
   }
 
   depends_on = [