An AKS cluster needs to pull images from a private ACR. What is the recommended authentication approach for production?

1. A Enable the ACR admin account and use its credentials
2. B Create a Kubernetes secret with a service principal
3. ✓ C Use az aks update --attach-acr to assign AcrPull to the kubelet managed identity (correct answer)
4. D Store credentials in a ConfigMap

Shortcut: az aks update --attach-acr creates an AcrPull role assignment on the AKS kubelet identity. This uses managed identity, avoiding stored credentials.