@@ -77,8 +77,10 @@ function usage() {
   echo "                                         or the podcert-agent sidecar, for clusters without the"
   echo "                                         certificates.k8s.io/v1beta1 API such as AKS and EKS"
   echo "  --overlay=NAME                         Install from manifests/ate-install/NAME instead of the GKE base"
-  echo "                                         (aks: in-cluster S3 snapshot store, no GCP auth; implies --pki-delivery=agent"
-  echo "                                         unless set). Not combined with kind or --atenet-router=agentgateway"
+  echo "                                         (aks: in-cluster S3 snapshot store, no GCP auth; eks: Amazon S3 with IRSA,"
+  echo "                                         needs ATE_AWS_REGION and ATE_EKS_ATELET_ROLE_ARN; both imply"
+  echo "                                         --pki-delivery=agent unless set). Not combined with kind or"
+  echo "                                         --atenet-router=agentgateway"
   echo "  --podcert-workers-per-signer N         Concurrent workers per podcertificate-controller signer (default: 1)"
   echo "  --rollout-timeout DURATION             Per-workload readiness wait timeout, kubectl-style Go duration (default: 60s)"
   echo "  --otlp-endpoint URL                    Send all control plane telemetry to URL, not to the cluster default (see benchmarking/telemetry/README.md)"
@@ -682,6 +684,8 @@ deploy_ate_system() {
     fi
   fi
 
+  annotate_atelet_service_account_for_irsa
+
   local manifests=""
   manifests="$(render_ate_system_manifests)"
   echo "${manifests}" | run_kubectl apply -f -
@@ -720,10 +724,13 @@ ensure_apiserver_prerequisites() {
   create_api_server_env_vars
   run_kubectl get configmap -n ate-system ate-api-authentication >/dev/null 2>&1 \
     || create_api_authentication_config
-  if [[ -n "$(install_overlay)" ]]; then
+  if [[ -n "$(install_overlay)" && -f "manifests/ate-install/$(install_overlay)/rustfs.yaml" ]]; then
     run_kubectl get secret -n ate-system rustfs-credentials >/dev/null 2>&1 \
       || create_rustfs_credentials_secret
   fi
+  if [[ "$(install_overlay)" == "eks" ]]; then
+    create_aws_config
+  fi
 }
 
 # The in-cluster S3 store of the aks overlay and atelet share these keys
@@ -737,6 +744,40 @@ create_rustfs_credentials_secret() {
     --dry-run=client -o yaml | run_kubectl apply -f -
 }
 
+# The eks overlay's atelet reads the snapshot bucket's region from this
+# ConfigMap (manifests/ate-install/eks/atelet). Reconciled on every install so a
+# region change in ATE_AWS_REGION takes effect on the next atelet rollout.
+create_aws_config() {
+  log_step "create_aws_config"
+  if [[ -z "${ATE_AWS_REGION:-}" ]]; then
+    echo "Error: --overlay eks needs ATE_AWS_REGION (the region of the S3 snapshot bucket)" >&2
+    exit 1
+  fi
+  run_kubectl create configmap -n ate-system ate-aws-config \
+    --from-literal=region="${ATE_AWS_REGION}" \
+    --dry-run=client -o yaml | run_kubectl apply -f -
+}
+
+# IRSA for atelet on EKS: the pod identity webhook projects a web identity
+# token into pods whose ServiceAccount carries eks.amazonaws.com/role-arn, so
+# the annotation must be on the ServiceAccount before the DaemonSet's pods are
+# created. The annotation is set imperatively (not through apply) so applying
+# the plain manifest afterwards leaves it alone. A changed role needs an atelet
+# rollout restart; the installer's apply of the DaemonSet does not restart pods
+# on its own when nothing else changed.
+annotate_atelet_service_account_for_irsa() {
+  [[ "$(install_overlay)" == "eks" ]] || return 0
+  if [[ -z "${ATE_EKS_ATELET_ROLE_ARN:-}" ]]; then
+    echo "Error: --overlay eks needs ATE_EKS_ATELET_ROLE_ARN (IAM role with access to the S3 snapshot bucket)" >&2
+    exit 1
+  fi
+  log_step "annotate_atelet_service_account_for_irsa"
+  run_kubectl get serviceaccount -n ate-system atelet >/dev/null 2>&1 \
+    || run_kubectl create serviceaccount -n ate-system atelet
+  run_kubectl annotate serviceaccount -n ate-system atelet --overwrite \
+    "eks.amazonaws.com/role-arn=${ATE_EKS_ATELET_ROLE_ARN}"
+}
+
 # Redeploy only the ate-apiserver
 deploy_ate_apiserver() {
   log_step "deploy_ate_apiserver"
@@ -764,6 +805,10 @@ deploy_atelet() {
 
   apply_otel_config
   apply_otel_endpoint_override
+  if [[ "$(install_overlay)" == "eks" ]]; then
+    create_aws_config
+  fi
+  annotate_atelet_service_account_for_irsa
 
   local manifest=""
   if [[ -n "$(install_overlay)" ]]; then
@@ -1174,8 +1219,8 @@ esac
 podcert_workers_per_signer >/dev/null
 rollout_timeout >/dev/null
 install_overlay >/dev/null
-# The aks overlay exists for clusters without certificates.k8s.io/v1beta1.
-if [[ "${ATE_INSTALL_OVERLAY:-}" == "aks" && -z "${ATE_PKI_DELIVERY:-}" ]]; then
+# The aks and eks overlays exist for clusters without certificates.k8s.io/v1beta1.
+if [[ ("${ATE_INSTALL_OVERLAY:-}" == "aks" || "${ATE_INSTALL_OVERLAY:-}" == "eks") && -z "${ATE_PKI_DELIVERY:-}" ]]; then
   ATE_PKI_DELIVERY=agent
 fi
 if [[ "$(pki_delivery)" == "agent" && "${ATE_EXPERIMENTAL_USE_SDSMINT:-false}" == "true" ]]; then
 
@@ -0,0 +1,56 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# atelet for Amazon EKS: no GCP credentials for image pulls, and the S3
+# snapshot backend pointed at Amazon S3 itself. The bucket's region comes from
+# the ate-aws-config ConfigMap (hack/install-ate.sh creates it from
+# ATE_AWS_REGION); the credentials come from IRSA: the installer annotates the
+# atelet ServiceAccount with eks.amazonaws.com/role-arn, and EKS's pod identity
+# webhook then projects a web identity token and sets AWS_ROLE_ARN and
+# AWS_WEB_IDENTITY_TOKEN_FILE on every atelet pod, which the SDK's default
+# credential chain in cmd/atelet uses. Nothing here names the account or role.
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../atelet.yaml
+
+patches:
+  - patch: |-
+      apiVersion: apps/v1
+      kind: DaemonSet
+      metadata:
+        name: atelet
+        namespace: ate-system
+      spec:
+        template:
+          spec:
+            containers:
+            - name: atelet
+              args:
+              - --gcp-auth-for-image-pulls=false
+              - --grpc-server-cred-bundle=/run/podidentity.podcert.ate.dev/credential-bundle.pem
+              - --client-ca-certs=/run/podidentity.podcert.ate.dev/trust-bundle.pem
+              - --ateapi-ca-file=/run/servicedns.podcert.ate.dev/trust-bundle.pem
+              - --drain-delay=0s
+              - --drain-timeout=5m
+              env:
+              - name: ATE_STORAGE_BACKEND
+                value: s3
+              - name: AWS_REGION
+                valueFrom:
+                  configMapKeyRef:
+                    name: ate-aws-config
+                    key: region
@@ -0,0 +1,56 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# eks: the control plane for an Amazon EKS cluster. Like the aks overlay it is
+# the GKE base with the Google-specific pieces swapped out, but where aks ships
+# an in-cluster S3 store, EKS has the real thing:
+#
+#   - snapshots go to an Amazon S3 bucket; atelet authenticates with IAM Roles
+#     for Service Accounts (the AWS SDK default credential chain picks up the
+#     web identity token the EKS pod identity webhook projects once the atelet
+#     ServiceAccount carries the eks.amazonaws.com/role-arn annotation), so no
+#     access keys exist anywhere in the cluster. hack/install-ate.sh sets the
+#     annotation from ATE_EKS_ATELET_ROLE_ARN and the bucket region from
+#     ATE_AWS_REGION (ConfigMap ate-aws-config), see ./atelet;
+#   - atelet pulls images without GCP credentials (./atelet);
+#   - telemetry goes to the small in-cluster OTLP collector the kind overlay
+#     ships instead of GKE's managed collector;
+#   - everything else is the base manifest, unchanged. Postgres uses the
+#     cluster's default StorageClass (create a gp3 one and mark it default on
+#     clusters that have none, such as EKS Auto Mode).
+#
+# Certificates: EKS 1.34-1.36 do not serve certificates.k8s.io/v1beta1, so
+# install with --pki-delivery=agent (the installer defaults to it for this
+# overlay), which layers components/agent-pki on top.
+#
+# Nodes: the gVisor worker is unprivileged but runsc maps identities in a user
+# namespace, so worker nodes need user namespaces enabled
+# (user.max_user_namespaces > 0). Amazon Linux 2023 managed node groups
+# qualify; EKS Auto Mode's Bottlerocket nodes do not (they set it to 0), so
+# run the tainted ate.dev/sandboxClass=gvisor worker pool on a managed node
+# group and keep the control plane on whatever nodes the cluster has.
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../ate-api-server.yaml
+  - ../ate-controller.yaml
+  - ./atelet
+  - ../atenet-dns.yaml
+  - ../atenet-router.yaml
+  - ../postgres.yaml
+  - ../pod-certificate-controller.yaml
+  - ../kind/ate-otel-config.yaml
+  - ../kind/otel-collector.yaml