A team synchronizes secrets from Vault into Kubernetes Secrets. Which security consideration remains essential?

1. Assume the destination copy is never accessible to Kubernetes administrators
2. Protect Kubernetes Secret access and storage within the destination cluster
3. Delete Kubernetes RBAC because Vault has its own policies
4. Treat base64 representation as sufficient encryption