A Kubernetes team wants selected Vault values synchronized into Kubernetes Secrets using declarative custom resources. Which component fits?

1. The transit engine alone without a controller
2. A Raft snapshot job
3. A browser-only user login session
4. Vault Secrets Operator