A GKE microservice needs to download files from a Cloud Storage bucket. You have a Google IAM service account with Storage Object Viewer on the project. Following Google best practices, how should the application access the bucket?

The correct approach is to use Workload Identity, which allows a Kubernetes ServiceAccount to act as a Google IAM service account. This is achieved by binding the Kubernetes ServiceAccount to a Google IAM service account via an IAM policy and annotating the Kubernetes ServiceAccount with the IAM account name. Pods then use this Kubernetes ServiceAccount, and Application Default Credentials (ADC) automatically leverage the bound IAM permissions. This is the most secure and recommended method as it avoids distributing service account keys. Assigning the IAM service account to the cluster node pool grants all pods on that node the same permissions, violating the principle of least privilege. Using encrypted JSON keys on a PV or storing base64-encoded keys in Kubernetes Secrets are less secure as they involve managing and distributing credentials directly, increasing the risk of exposure.