From ee3697df5d3646eb3b15275e8f408c00d424b039 Mon Sep 17 00:00:00 2001
From: Bharat Kathi <bharat.kathi@withpersona.com>
Date: Wed, 26 Aug 2026 02:03:29 -0700
Subject: [PATCH] fix(foundry): route sentinel service-account and analytics
 paths to core

---
 .../manifests/sentinel/configmap-kerbecs.yaml | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/kubernetes/gr-foundry/manifests/sentinel/configmap-kerbecs.yaml b/kubernetes/gr-foundry/manifests/sentinel/configmap-kerbecs.yaml
index 3525624..ebb6429 100644
--- a/kubernetes/gr-foundry/manifests/sentinel/configmap-kerbecs.yaml
+++ b/kubernetes/gr-foundry/manifests/sentinel/configmap-kerbecs.yaml
@@ -122,6 +122,26 @@ data:
           strip_prefix: /api
         envelope: passthrough
 
+      # Service-account management (reveal / rotate / delete a bearer token).
+      # Without this route the paths fall through to web-frontend below and
+      # nginx answers 200 + index.html, so the SPA silently renders an empty
+      # token instead of erroring.
+      - name: core-service-accounts
+        match:
+          path: /api/service-accounts/*
+        upstream: core
+        rewrite:
+          strip_prefix: /api
+        envelope: passthrough
+
+      - name: core-analytics
+        match:
+          path: /api/analytics/*
+        upstream: core
+        rewrite:
+          strip_prefix: /api
+        envelope: passthrough
+
       - name: oauth
         match:
           path: /api/oauth/*