An automation account needs to inspect one Kubernetes namespace but not change deployments. What should its Kubernetes access use?

1. A suitably scoped read-only RBAC role and binding
2. Cluster-admin for every automation job
3. A public copy of the cluster administrator kubeconfig
4. Only a hidden menu entry in the web portal