An administrator adds a NoSchedule taint to dedicated nodes. What lets an otherwise suitable Pod tolerate it?

1. A matching toleration
2. A higher container image version
3. An unrelated ConfigMap label
4. A Service with the same name