AWS shows how to wire up Argo CD with AWS Controllers for Kubernetes (ACK) to automate EKS Pod Identity for IAM roles - GitOps-style.
The catch? The Pod Identity API has a lag. So they bolt on a pre-deployment validation job to wait-and-confirm that the IAM role's actually bound before app pods come online. Smart move.
