EKS Pod Identity vs IRSA: A Practical Migration Guide and the Gotchas Nobody Mentions
If you're running workloads on EKS, your IAM strategy was probably built around IRSA. At re:Invent 2023, AWS introduced EKS Pod Identity as a simpler alternative to it. This post walks through the practical migration path, and, more importantly, five gotchas I hit that aren't covered in the official docs. Quick context (skip if you already know this) IRSA relies on OIDC federation. You create a…
AWS announced EKS Pod Identity at re:Invent 2023 as a simplified alternative to IRSA. This report outlines a migration path and highlights five hidden challenges not covered in official documentation.
IRSA operates on OIDC federation. It requires creating a cluster-level identity provider, crafting trust policies with sub/aud conditions, and annotating the service account with the desired role ARN. A mutating webhook then injects a projected OIDC token into the pod. AWS SDK exchanges this token for temporary credentials via sts:AssumeRoleWithWebIdentity.
Pod Identity, conversely, adopts an EKS Pod Identity Agent daemonset on every node. It also relies on a PodIdentityAssociation resource that maps a (cluster, namespace, service account) trio to an IAM role. The trust relationship is established through pods.eks.amazonaws.com service principal instead of per-cluster OIDC conditions. No OIDC provider setup, rotation, or tracking is necessary, and there's no per-role trust-policy complexity.
Benefits of migrating include:
1. No per-cluster OIDC provider lifecycle management.
2. One fewer resource to create, rotate certificates for, and synchronize across clusters.
3. Uniform trust policy shape across all roles.
4. Simplified auditing and policy-as-code checks.
5. Easier cross-account and cross-cluster role reuse.
6. Faster credential rotation through the agent's proactive credential fetching.
The migration process involves several steps:
1. Enable the EKS Pod Identity Agent add-on on your cluster using the console, eksctl, or Terraform's aws_eks_addon.
2. Update your role trust policies to incorporate the Pod Identity principal. This coexistence with the existing OIDC trust condition is possible during migration, so a hard cutover isn't required.
3. Create a PodIdentityAssociation for each (cluster, namespace, service account) combination, linking it to the target IAM role ARN. Verify empirically - don't rely solely on the console. Check CloudTrail's userIdentity field or application logs to confirm the pod is assuming the new role via the new path.
4. Remove the old eks.amazonaws.com/role-arn annotation only after thorough verification for each workload.
Recommendation: Run both trust paths concurrently for at least one deployment cycle per workload. This approach incurs no cost and provides an instant rollback option if issues arise.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
