{
  "slug": "eksctl-create-update-pod-identity-associations-accept-policy-98d07f0db30b",
  "title": "eksctl create/update pod identity associations accept --policy",
  "tools": [
    "eksctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-02-14T06:49:12.000Z",
  "announced_at": "2026-02-14T06:49:12.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating or updating a pod identity association with an additional policy, pass it with `--policy` and disable session tags. The policy adds restrictions beyond the IAM policies attached to the role.",
    "examples": [
      "eksctl create podidentityassociation --cluster <cluster> --namespace <namespace> --service-account-name <service-account> --policy '<policy-document>' --disable-session-tags",
      "eksctl update podidentityassociation --cluster <cluster> --namespace <namespace> --service-account-name <service-account> --policy '<policy-document>' --disable-session-tags"
    ],
    "gotchas": [
      "Version: v0.223.0",
      "--cluster <cluster> (required): Name of the target cluster.",
      "--namespace <namespace> (required): Namespace of the service account or association.",
      "--service-account-name <service-account> (required): Name of the service account for the association.",
      "--policy <policy-document>: Optional policy adding restrictions beyond the IAM policies attached to the role. The docs do not specify the CLI document format.",
      "--disable-session-tags: Disable EKS Pod Identity session tags; required when passing `--policy`.",
      "Prerequisite: The `eks-pod-identity-agent` add-on must be installed on the cluster before creating an association; EKS Auto Mode clusters have it pre-installed."
    ]
  },
  "why_it_matters": "Create or update a pod identity association with an additional policy.",
  "sources": [
    "https://github.com/eksctl-io/eksctl/releases/tag/v0.223.0",
    "https://github.com/eksctl-io/eksctl/pull/8674",
    "https://github.com/eksctl-io/eksctl/blob/v0.223.0/pkg/ctl/create/pod_identity_association.go",
    "https://github.com/eksctl-io/eksctl/blob/v0.223.0/pkg/ctl/update/pod_identity_association.go",
    "https://docs.aws.amazon.com/eks/latest/eksctl/pod-identity-associations.html"
  ],
  "rank": 0.95018,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-f97ba3c0d15b5ec1-0:gate",
    "evidence_hash": "cd1c5c4f026517e6e28c5df94e6120775e8b323c0cf04be5bc3fbd8f000d1fe2"
  },
  "review": {
    "draft_hash": "a04ec6dca96eccac5098f0cf538d2b6a03c9e68f89f4a2c6095ae05638fb7254",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.95 >= 0.9; 2 needed) and Jev gave 0.77 (>= 0.6 needed)."
  }
}