A transit-authority microservice on OKE must call the Kubernetes API (and later OCI APIs via workload identity) under a least-privilege identity. Which Pod-level object supplies that identity?
Select an answer to reveal the explanation.
Short Explanation
A ServiceAccount is the Pod’s badge at the door: every API call the Pod makes as itself carries that identity. Give each workload a dedicated ServiceAccount instead of leaning on an over-privileged default.
Full Explanation
API calls a Pod makes to the cluster—and, with workload identity, to OCI—use the ServiceAccount attached in the Pod spec. Production apps should not rely on the namespace default ServiceAccount when it is broader than needed; create a dedicated account and bind RBAC (and later IAM) to it. ClusterRoleBindings grant permissions but are not the Pod’s identity object, and NetworkPolicy controls traffic, not who the Pod is.