A cluster security assessment identifies anonymous requests to the kubelet API as an unnecessary exposure. Which configuration direction addresses this finding?

1. Configure application readiness probes only
2. Disable kubelet anonymous authentication and use authenticated, authorized access
3. Expose the kubelet API publicly so clients need no tunnel
4. Grant every anonymous user cluster-admin