My Scenario

• I have a vanilla ServiceAccount - very pure with nothing inside, no annotations etc.
• I don't have an IAM role.
• I wish for eksctl to create the IAM role for me and then "attach" the role to the ServiceAccount.

Things I Tried That Didn't Work

1. eksctl create iamserviceaccount does not work. I have tried all permutations of the --include / --exclude keywords as well as the --override-existing-serviceaccount flag and the --role-only flag. It is able to create the role but not annotate the serviceaccount.
2. eksctl update iamserviceaccount does not work - it declares that the serviceaccount has no annotation and therefore there is nothing to update.

Things I Tried That Did Work

1. I created the role manually with the standard Trust Relationship using Step 2 / AWS CLI tab of this doc
2. I manually annotated the Service Account using kubectl annotate

Residual Questions

1. After I did things manually eksctl get iamserviceaccount does not "register" this new mapping. It only shows the ones that eksctl did itself. Can I ignore this and just assume everything is ok now?
2. What is the procedure for attaching IAM to an existing vanilla SA? Since a pod can only have 1 SA, the intuitive path of users is that they might have created an SA via their own helm charts for other auth reasons, THEN they wish to attach the iam mapping on top.
3. When is PodIdentity coming to ASCP? I am only using IRSA because PodIdentity is not available for ASCP / CSI.

Thank you.