Question 1

What is EKS Pod Identity and how does it relate to Domino?

Accepted Answer

EKS Pod Identity is an AWS mechanism that allows Kubernetes pods to assume IAM roles using identity mapping. Domino leverages this to securely propagate credentials to workloads without requiring trust policy updates for each cluster.

Question 2

When should I use EKS Pod Identity instead of IRSA in Domino?

Accepted Answer

Use EKS Pod Identity when your EKS clusters change frequently or your IAM roles are managed by a separate team. It simplifies credential updates during Domino upgrades and avoids direct OIDC trust policy changes.

Question 3

Can I use both IRSA and EKS Pod Identity with Domino?

Accepted Answer

Yes, IRSA and EKS Pod Identity are not mutually exclusive. Domino supports IRSA for users and EKS Pod Identity for service accounts, allowing flexible credential propagation strategies across workloads.

Question 4

Why is credential propagation for Domino Service Accounts different?

Accepted Answer

Domino Service Accounts don’t authenticate via SAML, so they can’t use traditional credential propagation. Instead, EKS Pod Identity provides a secure method for assigning IAM roles directly to service accounts running jobs.

Question 5

What are the operational benefits of using EKS Pod Identity?

Accepted Answer

EKS Pod Identity reduces the overhead of IAM trust policy updates during cluster upgrades, enables centralized control, and simplifies mapping between service accounts and IAM roles — especially in large-scale deployments.