fix(controlplane): address review comments, security checks, helm hooks, and add helm-lint target

Author: aojea

.github/workflows/test.yaml

@@ -54,3 +54,10 @@ jobs:
     - name: Install protoc
       run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
     - run: make verify
+
+  helm-lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+    - uses: azure/setup-helm@v4
+    - run: make helm-lint

Makefile

@@ -152,7 +152,20 @@ fmt:
 	go fmt ./...
 
 # code linters
-lint: fmt
+.PHONY: helm-lint
+helm-lint:
+	@HELM_BIN="helm"; \
+	if ! command -v helm >/dev/null 2>&1; then \
+		if [ -x "./bin/helm" ]; then \
+			HELM_BIN="./bin/helm"; \
+		else \
+			echo "helm not found; please install helm or place it in ./bin/helm" >&2; \
+			exit 1; \
+		fi; \
+	fi; \
+	$$HELM_BIN lint ./charts/sam-mesh
+
+lint: fmt helm-lint
 	hack/lint.sh
 
 .PHONY: verify

charts/sam-mesh/templates/bootstrap-job.yaml

@@ -35,6 +35,9 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "sam-mesh.fullname" . }}-bootstrap
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
   labels:
     {{- include "sam-mesh.labels" . | nindent 4 }}
 spec:

charts/sam-mesh/values.yaml

@@ -9,7 +9,7 @@ controlPlane:
   logLevel: info
   adminToken: super-secret-admin-token
   autoApproveEnrollment: true
-  insecureSkipTlsVerify: false
+  insecureSkipTlsVerify: true
   oidcIssuer: "http://dex:5556/dex"
   allowedAudiences: "sam-mesh-audience,sam-hub-audience"
   service:

internal/controlplane/server.go

@@ -363,7 +363,7 @@ func (s *Server) HandleRegister(w http.ResponseWriter, r *http.Request) {
 		resolvedMap[r] = true
 		if strings.HasPrefix(r, "sam:role:") {
 			hasCapabilityRoles = true
-		} else {
+		} else if r != req.RequestedRole {
 			customAccessRoles = append(customAccessRoles, r)
 		}
 	}
@@ -579,7 +579,7 @@ func (s *Server) HandleRefresh(w http.ResponseWriter, r *http.Request) {
 			resolvedMap[r] = true
 			if strings.HasPrefix(r, "sam:role:") {
 				hasCapabilityRoles = true
-			} else {
+			} else if r != nodeRecord.Role {
 				customAccessRoles = append(customAccessRoles, r)
 			}
 		}
@@ -804,9 +804,12 @@ func (s *Server) HandlePolicies(w http.ResponseWriter, r *http.Request) {
 						for _, k := range validKeys {
 							trustedKeys = append(trustedKeys, k.Public)
 						}
-						_, err := identity.VerifyAndExtractPeerID(trustedKeys, biscuitBytes)
+						peerID, err := identity.VerifyAndExtractPeerID(trustedKeys, biscuitBytes)
 						if err == nil {
-							isNode = true
+							nodeRecord, nodeErr := s.store.GetNode(r.Context(), peerID.String())
+							if nodeErr == nil && !nodeRecord.Banned {
+								isNode = true
+							}
 						}
 					}
 				}

internal/node/node.go

@@ -1133,6 +1133,13 @@ func (n *SamNode) listenForHubEvents(ctx context.Context) {
 		case api.MeshEvent_POLICY_UPDATE:
 			logger.Infof("[Mesh Event] Received POLICY_UPDATE event from %s, triggering sync", msg.ReceivedFrom)
 			go func() {
+				// Jitter delay (0-2s) to prevent thundering herd on Control Plane
+				jitter := time.Duration(rand.Intn(2000)) * time.Millisecond
+				select {
+				case <-time.After(jitter):
+				case <-ctx.Done():
+					return
+				}
 				if err := n.syncMeshPolicy(ctx); err != nil {
 					logger.Warnf("Failed to sync mesh policy after event: %v", err)
 				}

tests/e2e/find_remote_tools.bats

@@ -102,7 +102,7 @@ teardown() {
   mesh_start_node 2 \
     "--log-level debug" \
     "tests/e2e/docker/calc-mcp/sam-node-config.yaml"
-  mesh_wait_for_log "${MESH_PREFIX}-node-2" "SAM Node Online" 20
+  mesh_wait_for_log "${MESH_PREFIX}-node-2" "SAM Node Online" 60
   mesh_wait_for_mcp_ready 2 20
 
   local node2_peer_id

tests/e2e/lib/container_mesh.bash

@@ -277,6 +277,7 @@ if [[ -z "${MESH_HELPERS_LOADED:-}" ]]; then
       --set global.imageTag="local" \
       --set controlPlane.oidcIssuer="${ISSUERS//,/\\,}" \
       --set controlPlane.allowedAudiences="sam-mesh-audience\,sam-hub-audience" \
+      --set controlPlane.insecureSkipTlsVerify=true \
       --set controlPlane.replicaCount=2 \
       --set controlPlane.hostPort=8080 \
       --set router.useOidcToken=false \