A cluster's API server certificate expires. Which operational practice best prevents this availability risk?

1. Disable certificate verification permanently
2. Share one private key publicly for emergency use
3. Inventory certificates and rotate them before expiry
4. Assume certificate lifetimes extend with Pod restarts