IRSA to Pod Identity: notes from the migration

Tue, 02 Jun 2026 00:08:30 +0000

IRSA has been the way to give a Kubernetes pod an AWS identity since 2019, and it works. It also requires an OIDC provider per cluster, a trust policy per role that names a specific cluster’s OIDC issuer, and a mental model involving projected service account tokens that you re-derive from scratch every time something breaks.

EKS Pod Identity does the same job with less machinery. I’ve now moved a few clusters over and it’s mostly good news, with a couple of edges worth knowing before you start.

EKS Access Entries: one ARN, one cluster, no sharing

Tue, 21 Apr 2026 00:08:30 +0000

EKS Access Entries replaced the aws-auth ConfigMap and made cluster authorization a proper AWS API object instead of a YAML blob that you edited with trembling hands, hoping you wouldn’t lock yourself out. It’s a genuine improvement. But moving auth into the API surface also moves it into Terraform state, and that’s where it gets interesting.

The error that sent me down this road:

Error: creating EKS Access Entry (test-spain-001:arn:aws:iam::123456789012:role/PlatformAdmin):
ResourceInUseException: The specified access entry resource is already in use
on this cluster.

My first reaction was the wrong one: are access entries global? Did creating one for cluster A break cluster B?

Iam on DevOps & Rock'N'Roll

IRSA to Pod Identity: notes from the migration

EKS Access Entries: one ARN, one cluster, no sharing