A Pod must authenticate to an external service using a short-lived Kubernetes service account token with a specific audience. Which mechanism is designed for this?

1. A namespace label equal to the audience string
2. A ConfigMap storing the cluster administrator's kubeconfig
3. A projected serviceAccountToken volume with the required audience and expiration
4. A hard-coded legacy token copied into the image