A company stores Azure OpenAI Service API keys in Azure Key Vault. An automated pipeline needs to retrieve the key at runtime. The pipeline runs on an Azure Container Apps environment. What is the most secure method to grant the container app access to Key Vault?

B is correct because assigning a managed identity to the Azure Container Apps environment eliminates the need to store any credentials. The 'Key Vault Secrets User' role (RBAC) grants least-privilege read access to secrets. The container app authenticates to Key Vault using the managed identity's token from the Azure Instance Metadata Service, with no secrets in code or environment variables. A is wrong because storing credentials in environment variables risks exposure through container logs, environment variable enumeration, or image inspection. C is wrong because a client certificate stored in a container image means the certificate is embedded in the image layer, which is accessible to anyone with image pull access. D is wrong because Key Vault firewall IP allowlisting controls network access but does not authenticate the caller or eliminate credential storage.