A workload needs temporary API credentials. Which approach is preferable to long-lived copied tokens?

1. A permanent token embedded in its image
2. The node administrator's personal kubeconfig
3. A shared token copied into every namespace
4. Scoped, time-bound projected service-account tokens