A compromised Pod can read the host filesystem through an unrestricted hostPath mount. Which boundary is weakened?

1. Workload-to-host isolation
2. Public DNS delegation
3. Registry-to-source-code version mapping
4. The application's external TLS cipher order