FEAT(app): add rbac and kubectl for mcp tools

- ServiceAccount for mas pod
- ClusterRole with read-only permissions
- ClusterRoleBinding
- kubectl installed in Docker image
- Now mas can query Kubernetes API!

deploy/docker/Dockerfile

@@ -2,15 +2,21 @@ FROM python:3.11-slim
 
 WORKDIR /app
 
-# 시스템 의존성 설치
+# 시스템 의존성 설치 (kubectl 포함)
 RUN apt-get update && apt-get install -y \
     build-essential \
     curl \
     git \
     libpq-dev \
     postgresql-client \
+    wget \
     && rm -rf /var/lib/apt/lists/*
 
+# kubectl 설치
+RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+    && install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl \
+    && rm kubectl
+
 # pip 업그레이드
 RUN pip install --no-cache-dir --upgrade pip setuptools wheel
 

deploy/k8s/base/deployment.yaml

@@ -15,6 +15,7 @@ spec:
       labels:
         app: mas
     spec:
+      serviceAccountName: mas
       containers:
       - name: mas
         image: gitea0213.kro.kr/bluemayne/mas:latest

deploy/k8s/overlays/prod/serviceaccount.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mas
+  namespace: mas
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mas-viewer
+rules:
+  # Read-only access to most resources
+  - apiGroups: [""]
+    resources:
+      - pods
+      - pods/log
+      - services
+      - endpoints
+      - namespaces
+      - nodes
+      - persistentvolumeclaims
+      - configmaps
+    verbs: ["get", "list", "watch"]
+  
+  - apiGroups: ["apps"]
+    resources:
+      - deployments
+      - statefulsets
+      - daemonsets
+      - replicasets
+    verbs: ["get", "list", "watch"]
+  
+  - apiGroups: ["batch"]
+    resources:
+      - jobs
+      - cronjobs
+    verbs: ["get", "list", "watch"]
+  
+  - apiGroups: ["networking.k8s.io"]
+    resources:
+      - ingresses
+    verbs: ["get", "list", "watch"]
+  
+  - apiGroups: ["argoproj.io"]
+    resources:
+      - applications
+    verbs: ["get", "list", "watch"]
+  
+  # Describe resources
+  - apiGroups: [""]
+    resources:
+      - pods/status
+      - services/status
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mas-viewer-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mas-viewer
+subjects:
+  - kind: ServiceAccount
+    name: mas
+    namespace: mas
+