We run Celld v0.5.0 on EKS with Pod Identity. Celld already uses the pod’s rotating AWS credentials for its S3 storage. Our Worker also needs to call SigV4-authenticated services. Specifically, we care about the managed AWS and EKS MCP endpoints. We haven’t found a supported way for Worker code to use the host’s credential provider. The Worker filesystem does not expose the projected pod identity token file.

Is there an existing mechanism we should use? If not, could Celld expose an opt-in authenticated fetch/signing binding that: - Uses automatically refreshed workload credentials. - Keeps AWS secret keys outside Worker JavaScript. - Restricts signing to configured services, regions, and endpoints. - Allows application permissions to be scoped separately from Celld’s fleet-storage permissions.

We’d like to avoid long-lived access keys or running a separate signing service solely to bridge this boundary if possible, but understandable if this is out of scope.