GKE app must make authorized requests to Google Cloud managed services. You already created a service account with required IAM roles. For a one-time secure setup that avoids long-lived keys and supports automatic key rotation, what should you do next?

Workload Identity is the recommended and most secure way to grant GKE applications access to Google Cloud services. It allows a Kubernetes service account to impersonate a Google Cloud service account, eliminating the need to manage and distribute service account keys. This provides automatic key rotation and avoids long-lived credentials, enhancing security. Exporting the service account and sharing it as a Kubernetes Secret or embedding it in the source code are less secure as they involve managing long-lived keys, which can be compromised and require manual rotation. While HashiCorp Vault can manage secrets, Workload Identity is a native and more integrated solution for GKE to Google Cloud service account authorization, offering a simpler and more secure setup for this specific use case.