From 2c1ddea1240c5fa7fbb694933bb105ba24182bc1 Mon Sep 17 00:00:00 2001
From: joshsiv-mulga <mrk@mulgadc.com>
Date: Wed, 8 Jul 2026 15:17:26 +1000
Subject: [PATCH] Remove backed-in creds for eks addon sync - prefer IMDS

---
 scripts/images/eks-node/mulga-eks-addon-sync.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/images/eks-node/mulga-eks-addon-sync.sh b/scripts/images/eks-node/mulga-eks-addon-sync.sh
index 284d14e7a..d1e02cab4 100644
--- a/scripts/images/eks-node/mulga-eks-addon-sync.sh
+++ b/scripts/images/eks-node/mulga-eks-addon-sync.sh
@@ -25,10 +25,10 @@ set -a
 . "${ENVFILE}"
 set +a
 
+# EKS_ACCESS_KEY/EKS_SECRET_KEY are intentionally not required: when absent,
+# eks-gateway-{fetch,publish} sign with IMDS instance-role creds via the SDK chain.
 : "${EKS_GATEWAY_URL:?}"
 : "${EKS_ADDON_GATEWAY_URL:?}"
-: "${EKS_ACCESS_KEY:?}"
-: "${EKS_SECRET_KEY:?}"
 : "${EKS_ACCOUNT_ID:?}"
 : "${EKS_CLUSTER_NAME:?}"