A Pod does not call the Kubernetes API. Which change reduces unnecessary credential exposure?

1. Mount an additional cluster-admin token
2. Disable automatic service-account token mounting
3. Increase the Pod's DNS search list
4. Copy the token into the public image