An EKS workload reaches AWS APIs and still fails one secret fetch

IRSA mostly works, yet one controller integration fails because the projected token audience and controller expectation differ between cluster templates.