feat(security): transition from static policies.yaml to dynamic relat…

.github/k8s/sam-control-plane-template.yaml

@@ -123,7 +123,6 @@ spec:
         - "--db-dsn=postgres://sam:sam-secret-password@sam-db-${ENV_NAME}:5432/sam_mesh?sslmode=disable"
         - "--issuer=https://auth.sam-mesh.dev,https://container.googleapis.com/v1/projects/${GCP_PROJECT_ID}/locations/${CLUSTER_REGION}/clusters/${CLUSTER_NAME}"
         - "--allowed-audiences=sam-mesh-audience,sam-hub-audience"
-        - "--policy-file=/etc/sam/policies/policies.yaml"
         - "--admin-token=$(ADMIN_TOKEN)"
         - "--auto-approve-enrollment"
         resources:
@@ -133,53 +132,6 @@ spec:
           limits:
             cpu: 500m
             memory: 512Mi
-        volumeMounts:
-        - name: policies-volume
-          mountPath: /etc/sam/policies
-          readOnly: true
-      volumes:
-      - name: policies-volume
-        configMap:
-          name: sam-control-plane-policies-${ENV_NAME}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: sam-control-plane-policies-${ENV_NAME}
-  namespace: ${NAMESPACE}
-data:
-  policies.yaml: |
-    version: "v1alpha1"
-    bindings:
-      - members: ["user:system:serviceaccount:sam-canary-${ENV_NAME}:sam-node-sa"]
-        role: "sam-canary"
-      - members: ["user:system:serviceaccount:sam-canary-${ENV_NAME}:sam-box-sa"]
-        role: "sam:role:sambox"
-      - members: ["group:routers", "user:system:serviceaccount:${NAMESPACE}:sam-router-sa"]
-        role: "sam:role:router"
-      - members: ["sam:system:authenticated"]
-        role: "public-mesh"
-    roles:
-      sam-canary:
-        allowed_services:
-          - "*"
-        allowed_targets:
-          - "*"
-      "sam:role:sambox":
-        allowed_services:
-          - "*"
-        allowed_targets:
-          - "*"
-      "sam:role:router":
-        allowed_services:
-          - "*"
-        allowed_targets:
-          - "*"
-      public-mesh:
-        allowed_services:
-          - "*"
-        allowed_targets:
-          - "*"
 ---
 apiVersion: networking.gke.io/v1
 kind: HealthCheckPolicy

.github/workflows/deploy-github-pages.yml

@@ -17,8 +17,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 env:
   REPO_NAME: ${{ github.event.repository.name }}
@@ -28,18 +26,19 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0         # Fetch all history for .GitInfo and .Lastmod
           submodules: recursive  # Fetch any git submodules if configured
+          persist-credentials: false
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
         with:
           hugo-version: '0.136.5' # Matching local Hugo version
           extended: true
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '20'
           check-latest: true
@@ -58,13 +57,17 @@ jobs:
         run: echo "sam-mesh.dev" > ./site/public/CNAME
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: ./site/public
 
   deploy:
     needs: build
     if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'pull_request' }}
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
@@ -74,4 +77,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5