Yes, I am using headlamp on my pixel fold running on EKS with hardware MFA and no, headlamp's ServiceAccount doesn't have any permissions.