You need pods in GKE to access Google Cloud services across projects securely and following best practices. What should you do?

Workload Identity is the recommended and most secure way for applications running in GKE to access Google Cloud services. It allows a Kubernetes service account to act as a Google service account, granting fine-grained permissions directly to individual pods. This eliminates the need to manage and distribute service account keys. Assigning a Google service account to GKE nodes grants all pods on that node the same permissions, which violates the principle of least privilege. Storing credentials as a Kubernetes Secret is less secure as secrets are base64 encoded, not encrypted by default, and can be accessed by anyone with cluster access. GKE RBAC controls access within the Kubernetes cluster, not to external Google Cloud services.