An AKS pod must access Cosmos DB with a workload-specific identity. Which combination is correct?
- A Kubelet identity with Cosmos DB Contributor
- B Workload Identity federated to a user-assigned identity holding a Cosmos DB data-plane role (correct answer)
- C Account key in a ConfigMap
- D Node pool identity
Shortcut: Workload Identity gives the pod its own Entra ID identity. Pairing it with the Cosmos DB Built-in Data Contributor data role grants exactly the data access required.