Your application runs on GKE and needs to access a Cloud Storage bucket. You want to follow the principle of least privilege and avoid managing service account keys manually. What is the most secure way to grant the GKE pods access to the bucket?

Export a JSON key for a Google Cloud Service Account and store it as a Kubernetes Secret.

Assign the required IAM roles to the Compute Engine default service account used by the GKE nodes.

Configure Workload Identity to bind a Kubernetes Service Account to a Google Cloud Service Account.

Use Cloud VPN to create a secure tunnel between the GKE cluster and Cloud Storage.