Moving discussion from https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/116#discussion_r292235959 to this issue.