From f9743c49befa5641d82bddb8de5471ba2ba3c036 Mon Sep 17 00:00:00 2001 From: Jet Chiang Date: Fri, 4 Sep 2026 16:58:33 -0400 Subject: [PATCH] add cluster-scoped read rule for sandboxconfigs to atelet cluster role Signed-off-by: Jet Chiang --- charts/substrate/templates/atelet.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/charts/substrate/templates/atelet.yaml b/charts/substrate/templates/atelet.yaml index 916915dc42..e2b4b52fb1 100644 --- a/charts/substrate/templates/atelet.yaml +++ b/charts/substrate/templates/atelet.yaml @@ -38,6 +38,11 @@ rules: - apiGroups: ["certificates.k8s.io"] resources: ["clustertrustbundles"] verbs: ["get", "watch", "list"] +# SandboxConfigs are watched to pre-download sandbox assets into the node's +# cache before the first actor needs them (see cmd/atelet/sandbox_prewarm.go). +- apiGroups: ["ate.dev"] + resources: ["sandboxconfigs"] + verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding