A platform uses one long-lived administrator kubeconfig in every CI job. What is a better design?

1. Disabling API server authentication
2. Rotating only the kubeconfig's filename
3. A publicly shared copy of that kubeconfig
4. Scoped short-lived identities for approved pipeline operations