On GKE, a microservice needs read/write access to a Spanner database. To follow security best practices with minimal code changes, how should the application obtain Spanner credentials?

Workload Identity is the recommended and most secure way for applications running on GKE to access Google Cloud services like Spanner. It allows a Kubernetes service account to impersonate a Google Cloud service account, granting the pod the permissions of that Google Cloud service account without needing to store or manage credential files. This minimizes code changes as the application can use standard Google Cloud client libraries which automatically discover credentials. Storing credentials in Kubernetes Secrets is less secure as secrets are base64 encoded, not encrypted by default, and can be accessed by anyone with cluster access. VPC-native clusters are for network connectivity, not authentication. Cloud KMS can secure credentials, but retrieving them for each connection adds complexity and latency compared to Workload Identity's seamless integration.