Security groups for pods with pod-identity in strict mode.

Hey, is there a way to work around the fact that a pod with a Pod Identity Agent doesn't work using POD_SECURITY_GROUP_ENFORCING_MODE=strict?

We have a use case where two pods need to communicate with each other using security groups:

Pod#1: Has egress access to all destinations and allows inbound traffic from the node’s security group.

Pod#2: Has egress access only to S3 and STS via endpoints, and DNS via the node’s security group - no other egress is permitted.
Ingress is only allowed from Pod#1.

What’s the best approach to make this setup work without reverting to using IRSA?

No files, tests, or entry points are named. Start by investigating how the Pod Identity Agent interacts with POD_SECURITY_GROUP_ENFORCING_MODE=strict and the documented security-group behavior for pod-to-pod traffic. Done means identifying and documenting a supported approach that preserves the stated ingress and egress restrictions without reverting to IRSA.

Written by the indexing model from the issue text.