Substrate

.github/k8s/sam-box-canary-template.yaml

@@ -16,6 +16,12 @@ data:
       kind: Bearer
       value: real-upstream-secret-123
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sam-box-sa
+  namespace: sam-canary-${ENV_NAME}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -31,11 +37,11 @@ spec:
       labels:
         app: box-canary-${ENV_NAME}
     spec:
-      serviceAccountName: sam-node-sa
+      serviceAccountName: sam-box-sa
       initContainers:
       - name: init-nano-init
         image: ghcr.io/google/sam-nano-init:${IMAGE_TAG}
-        command: ["cp", "/nano-init", "/shared-bin/nano-init"]
+        command: ["/nano-init", "copy", "/shared-bin/nano-init"]
         volumeMounts:
         - name: shared-bin
           mountPath: /shared-bin
@@ -44,6 +50,7 @@ spec:
         image: alpine/curl:8.12.1
         command:
           - "/shared-bin/nano-init"
+          - "run"
           - "/var/run/sam/sam-box.sock"
           - "sh"
           - "-c"

.github/k8s/sam-control-plane-template.yaml

@@ -153,6 +153,8 @@ data:
     bindings:
       - members: ["user:system:serviceaccount:sam-canary-${ENV_NAME}:sam-node-sa"]
         role: "sam-canary"
+      - members: ["user:system:serviceaccount:sam-canary-${ENV_NAME}:sam-box-sa"]
+        role: "sam:role:sambox"
       - members: ["group:routers", "user:system:serviceaccount:${NAMESPACE}:sam-router-sa"]
         role: "sam:role:router"
       - members: ["sam:system:authenticated"]
@@ -163,6 +165,11 @@ data:
           - "*"
         allowed_targets:
           - "*"
+      "sam:role:sambox":
+        allowed_services:
+          - "*"
+        allowed_targets:
+          - "*"
       "sam:role:router":
         allowed_services:
           - "*"

api/datalog.go

@@ -94,6 +94,7 @@ const (
 	// Standard role values
 	RoleRouter = "sam:role:router"
 	RoleNode   = "sam:role:node"
+	RoleSamBox = "sam:role:sambox"
 
 	// FactUser defines the subject (username/userID) claim extracted from the OIDC token.
 	// Contains: biscuit.String(username)