- Create ServiceAccount, ClusterRole, ClusterRoleBinding - Grant permissions for mas agent to access K8s resources