OKE pods need OCI service access without storing a shared human API key. Which design should be evaluated for eligible workloads?

1. A Kubernetes label assumed to grant OCI permissions automatically.
2. Supported workload identity and narrowly scoped IAM policies.
3. One administrator signing key copied into every image.
4. Public access to all target services.