- ServiceAccount for mas pod - ClusterRole with read-only permissions - ClusterRoleBinding - kubectl installed in Docker image - Now mas can query Kubernetes API!