| Resource | Purpose |
|---|---|
| ServiceAccount | Identity for pods to authenticate against the API server |
| Role / ClusterRole | A set of permissions (namespace-scoped or cluster-scoped) |
| RoleBinding / ClusterRoleBinding | Binds a Role to a ServiceAccount, user, or group |
| IRSA (EKS) | IAM Roles for Service Accounts — lets a pod assume an AWS IAM role |