An AKS deployment shows ImagePullBackOff with 'unauthorized'. The cluster uses a system-assigned kubelet identity. What is the fastest correct remedy?

1. A Create an imagePullSecret from the ACR admin credentials
2. ✓ B Run az aks update --attach-acr <registry> to grant AcrPull to the kubelet identity (correct answer)
3. C Assign Contributor on the registry to the cluster identity
4. D Set imagePullPolicy to IfNotPresent

Shortcut: --attach-acr creates an AcrPull role assignment for the kubelet identity. Admin credentials work but reintroduce a shared secret; Contributor is excessive; imagePullPolicy does not affect authentication.