[release-1.11] sync with upstream (#489)

* [release-1.11] fix securityContext for Knative Service Pod (user-container and queue-proxy) (knative#14378)

* add seccompProfile to queue container security context

* run as non root by default

* update tests to expect new default run as nonroot

---------

Co-authored-by: Clay Kauzlaric <ckauzlaric@vmware.com>

* Leave a comment which will trigger a new dot release (knative#14500)

* [release-1.11] bump x/net to v0.17 (knative#14516)

* [release-1.11] bump x/net to v1.17

* Re-generate test/config/tls/cert-secret.yaml (knative#14324)

* Run hack/update-codegen.sh --upgrade --release 1.11

* Bound buffer for reading stats (knative#14542)

Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>

---------

Co-authored-by: Knative Prow Robot <automation+prow-robot@knative.team>
Co-authored-by: Clay Kauzlaric <ckauzlaric@vmware.com>
Co-authored-by: Kenjiro Nakayama <nakayamakenjiro@gmail.com>
Co-authored-by: Evan Anderson <evan.k.anderson@gmail.com>

pkg/autoscaler/metrics/http_scrape_client.go

@@ -82,7 +82,9 @@ func statFromProto(body io.Reader) (Stat, error) {
 	b := pool.Get().(*bytes.Buffer)
 	b.Reset()
 	defer pool.Put(b)
-	_, err := b.ReadFrom(body)
+	// 6 8-byte fields (+2 bytes marshalling), one hostname, 20 bytes extra space
+	r := io.LimitedReader{R: body, N: 6*10 + 256 + 20}
+	_, err := b.ReadFrom(&r)
 	if err != nil {
 		return emptyStat, fmt.Errorf("reading body failed: %w", err)
 	}

pkg/autoscaler/metrics/http_scrape_client_test.go

@@ -95,6 +95,21 @@ func TestHTTPScrapeClientScrapeProtoErrorCases(t *testing.T) {
 		responseCode: http.StatusOK,
 		responseType: "text/html",
 		expectedErr:  errUnsupportedMetricType.Error(),
+	}, {
+		name:         "LongStat",
+		responseCode: http.StatusOK,
+		responseType: "application/protobuf",
+		stat: Stat{
+			// We don't expect PodName to be 600 characters long
+			PodName:                          strings.Repeat("a123456789", 60),
+			AverageConcurrentRequests:        1.1,
+			AverageProxiedConcurrentRequests: 1.1,
+			RequestCount:                     33.2,
+			ProxiedRequestCount:              33.2,
+			ProcessUptime:                    12345.678,
+			Timestamp:                        1697431278,
+		},
+		expectedErr: "unmarshalling failed: unexpected EOF",
 	}}
 
 	for _, test := range testCases {