You need per-pod outbound identity so that different workloads present different identities to Azure services. Which feature satisfies this?
- A Kubelet managed identity
- B Workload Identity with one federated credential per ServiceAccount (correct answer)
- C A shared service principal
- D Node pool user-assigned identity
Shortcut: The kubelet identity is shared by every pod on the node. Workload Identity binds a distinct Azure AD identity to each ServiceAccount, giving per-workload identity and auditability.