An application is deployed on AKS and needs to call Azure Blob Storage. No credentials should be stored in the cluster. Which approach is recommended?
- A Store storage account key in Kubernetes Secret
- B Use workload identity: federate Kubernetes service account with a managed identity, assign Storage Blob Data Reader role (correct answer)
- C Use a service principal with client secret in pod environment variables
- D Embed SAS token in container image
Shortcut: Workload Identity federates the pod's Kubernetes service account with an Azure managed identity via OIDC. The managed identity gets the required Storage RBAC role, eliminating all stored credentials.