I have setup an IAM OIDC provider in my EKS cluster, and have used it to manually assign IAM roles to Kubernetes Pods.

For the pipeline for my Kubernetes pod however, I want to have it automatically create and update the IAM role for the pod as part of the normal application pipeline. This makes it easy to update the IAM permissions as your application needs to interact with more services over time.

Does anyone know of a way to create an IAM role with a service operator and associate with a pod in a manifest file? I've searched all day and it doesn't look like it can be done.

The only alternative I can think of is creating the IAM role in a different pipeline/workflow, which would work but would make updating the IAM role with new permissions frustrating, as you would have to coordinate the ordering of deployment between the two pipelines.