An attacker gains access to a node's kubelet API. Why is this serious?

1. Kubelet access can expose powerful node workload operations
2. Kubelet access is always limited to public documentation
3. Kubelet cannot interact with containers
4. Kubelet credentials affect only DNS names