A pod must read a secret from Key Vault with no credentials stored anywhere in the cluster. Which combination is correct?
- A A Kubernetes Secret populated by an init container using a service principal
- B Workload Identity: a Kubernetes ServiceAccount federated to an Azure AD managed identity (correct answer)
- C The kubelet managed identity referenced directly by the pod
- D An imagePullSecret with Key Vault credentials
Shortcut: Workload Identity projects a signed service account token into the pod, which Azure AD exchanges for an access token via a federated credential. No secret material is stored in the cluster.