Different GKE applications need distinct Google API permissions without sharing the node's broad identity. Which approach best fits?

1. Attach a least-privilege service account and use application default credentials.
2. Use Workload Identity Federation for GKE with per-workload grants.
3. Use Workload Identity Federation with appropriately scoped trust and IAM grants.
4. Grant narrowly scoped service-account impersonation permissions and use short-lived credentials.