An Azure Kubernetes Service pod accesses Key Vault using the Secrets Store CSI Driver. Which identity mechanism is recommended?

1. A Service principal with client secret in Kubernetes Secret
2. ✓ B Workload Identity (OIDC-federated managed identity) (correct answer)
3. C Node-level managed identity (kubelet)
4. D SAS token stored in pod environment

Shortcut: Workload Identity (OIDC federation) binds a Kubernetes service account to an Azure managed identity. The CSI Driver uses this to authenticate to Key Vault without any stored credentials in the cluster.