Imagine you're on a team developing a containerized application for deployment on GKE. The application, which handles sensitive user data, is set to run on a five-node cluster within a single region. There's a critical requirement to ensure sensitive data is excluded from logs before they're sent to Cloud Logging. Which option best fulfills this requirement?