FIX(app): add ServiceAccount and RBAC configuration

- Create ServiceAccount, ClusterRole, ClusterRoleBinding
- Grant permissions for mas agent to access K8s resources

deploy/k8s/base/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
+  - serviceaccount.yaml
 
 commonLabels:
   app.kubernetes.io/name: mas

deploy/k8s/base/serviceaccount.yaml

@@ -0,0 +1,50 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mas
+  namespace: mas
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mas-viewer
+rules:
+  - apiGroups: ["", "apps", "batch", "networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mas-writer
+rules:
+  - apiGroups: ["", "apps", "batch", "networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mas-viewer-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mas-viewer
+subjects:
+  - kind: ServiceAccount
+    name: mas
+    namespace: mas
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mas-writer-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mas-writer
+subjects:
+  - kind: ServiceAccount
+    name: mas
+    namespace: mas
+

deploy/k8s/overlays/prod/kustomization.yaml

@@ -14,5 +14,5 @@ commonLabels:
 # 이미지 태그 설정 (ArgoCD Image Updater가 자동으로 업데이트)
 images:
   - name: gitea0213.kro.kr/bluemayne/mas
-    newTag: main-sha-e9a2e6b6eb654c38c415e9250635016b5b413ff9
+    newTag: main-sha-4fbb4262e0d1298b169627b959098dfef2aff666