Workload Identity is the Google-recommended method for GKE workloads to access Google Cloud services.
It eliminates the need for manual management of service account keys (JSON files), which are a major security risk if leaked.1 According to Google Cloud Documentation (Workload Identity Federation for GKE):
"Workload Identity is the recommended way for your workloads running on GKE to access Google Cloud services in a secure and manageable way. It allows a Kubernetes service account in your GKE cluster to act as a Google IAM service account.2 When you use Workload Identity, you don't need to manage service account keys or store them as Kubernetes secrets." Why other options are incorrect:
* A is incorrect: Service account keys are long-lived and difficult to rotate. Using them increases the risk of credential theft.
* C & D are incorrect: Attaching a service account to a Node gives every pod running on that node the same permissions. This violates the Principle of Least Privilege because different workloads on the same node should have different permissions.
Reference:
Google Cloud Documentation: "Workload Identity Federation for GKE" (https://cloud.google.com
/kubernetes-engine/docs/how-to/workload-identity).
Google Cloud Security Engineer Study Guide: Chapter on "Managing Identities and Access - GKE Security."