✓ Human-authored analysis; AI used for formatting and proofreading. When a user's kubectl command authenticates to an Amazon EKS cluster, three components cooperate to turn an AWS identity into a Kubernetes user: The aws-iam-authenticator client signs an STS GetCallerIdentity request and sends the URL to the cluster as a presigned bearer token. The cluster's webhook authenticator parses the URL, verifies the signature, and extracts the AWS principal's identity. A configured ...