The EKS cluster runs pods whose images are in ECR. Node IAM role permissions for Pod Identity have already been updated. What else is required to provide Pod Identity access for pods running in the cluster?

To enable Pod Identity for pods in an EKS cluster, beyond updating the node IAM role, two key components are required. First, the nodes need network access to the EKS Auth API endpoint to facilitate communication for identity resolution. Second, the EKS Pod Identity Agent add-on must be installed and configured on the cluster. This add-on is responsible for intercepting IAM role requests from pods and exchanging them for temporary AWS credentials using the EKS Auth API. Creating an IAM OIDC provider is necessary for IAM Roles for Service Accounts (IRSA), but Pod Identity is a separate, newer mechanism. Creating an EKS access entry is for granting Kubernetes API access to IAM principals, not for providing AWS credentials to pods. Configuring the AWS STS endpoint for a Kubernetes service account is not a direct step for enabling EKS Pod Identity; the Pod Identity Agent handles the interaction with STS via the EKS Auth API.