The EKS 401 That Wasn't About Credentials
Our CI pipeline was minting a valid EKS token, presenting it cleanly, and getting rejected. The problem was not AWS creds. It was EKS access control, and the failure was hiding in plain sight in the cluster's RBAC.