Grant atelet cluster-wide read access to sandbox configs

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: supreme-gg-gg

charts/substrate/templates/atelet.yaml

@@ -38,6 +38,11 @@ rules:
 - apiGroups: ["certificates.k8s.io"]
   resources: ["clustertrustbundles"]
   verbs: ["get", "watch", "list"]
+# SandboxConfigs are watched to pre-download sandbox assets into the node's
+# cache before the first actor needs them (see cmd/atelet/sandbox_prewarm.go).
+- apiGroups: ["ate.dev"]
+  resources: ["sandboxconfigs"]
+  verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding