An administrator enables encryption at rest for Secrets in the API server's configuration. Existing Secrets were stored before the change. What additional action is needed to protect those stored records with the new configuration?

1. Rewrite the existing Secrets through the API using the configured encryption provider
2. Base64-encode existing Secret values one additional time
3. Change only file permissions on the application's mounted Secret
4. Only restart application Deployments that consume the Secrets