Amazon EKS supports IAM Roles for Service Accounts. It mounts tokens files to /var/run/secrets/eks.amazonaws.com/serviceaccount/token. Unfortunately, external-dns runs as 'nobody' so it can...