An application running on Google Kubernetes Engine (GKE) needs to read data from a Cloud Storage bucket. What is the most secure way to grant the application access to the bucket?

Export a Service Account JSON key and store it as a Kubernetes Secret.

Grant the required IAM roles to the Compute Engine default service account used by the GKE nodes.

Enable Workload Identity on the GKE cluster and map a Kubernetes Service Account to a Google Cloud Service Account.

Make the Cloud Storage bucket public.