With our self-hosted retool instance in Amazon EKS, we are unable to successfully attach an irsa to the retool service account without the following configurations:

env:
  AWS_ROLE_ARN: ${IRSA_ARN}
  AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token

serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: ${IRSA_ARN}

As well as manually patching the service account to set automountServiceAccountToken: true