A worker image contains unused network daemons and package-management tooling unrelated to its workload. Which hardening action directly reduces host attack surface?

1. Set every application Service to LoadBalancer
2. Change all Pod labels to hardened=true
3. Remove unnecessary components and disable unneeded services while preserving supported operation
4. Install additional remote shells for every application team