For GKE workloads that need access to different Google Cloud APIs, which authentication practices follow Google-recommended best practices? (Choose two.)

Workload Identity is the recommended way for applications running in GKE to access Google Cloud services. Enabling Workload Identity in the cluster (via gcloud container clusters update --workload-identity-config) is the first step. Once enabled, you then bind a Kubernetes Service Account to a Google Cloud Service Account using gcloud iam service-accounts add-iam-policy-binding with the roles/iam.workloadIdentityUser role. This allows pods using that Kubernetes Service Account to automatically authenticate as the bound Google Cloud Service Account. Using the service account attached to the GKE node grants broad permissions to all workloads on that node, violating the principle of least privilege. Storing or accessing Google service account keys from a secret management service is less secure and more complex than Workload Identity, as it involves managing and rotating keys manually.