1Z0-1123-25 Question 91
Select 2Your organization is migrating its microservices-based application from an on-premises environment to Oracle Cloud Infrastructure (OCI). You plan to run your containers on OCI Container Engine for Kubernetes (OKE) and use Oracle Cloud Infrastructure Registry (OCIR) to store your container images. Which two actions must you take to ensure your OKE cluster can seamlessly pull images from your private OCIR repository?
- A
Configure a container image pull secret in your OKE cluster with OCIR credentials
- B
Create an IAM policy that grants the OKE node pool permission to access OCIR
- C
Place the container images and the OKE cluster in exactly the same OCI compartment
- D
Expose your container images as public images in OCIR to bypass authentication
Show answer and explanation
Correct answers: A, B
Explanation
To enable seamless image pulling from Oracle Cloud Infrastructure Registry (OCIR), you need both an image pull secret in your OKE cluster and an IAM policy that grants the node pool authorization to access private repositories in OCIR. Refer to Oracle documentation on 'Pulling Images from Oracle Cloud Infrastructure Registry' for guidance on creating image pull secrets and writing the necessary IAM policies.
- A. Correct.
Correct. You must configure a Kubernetes secret containing valid OCIR credentials so that your OKE cluster can authenticate and pull private images from OCIR.
- B. Correct.
Correct. Even if you have a valid pull secret, your node pool (worker nodes) also needs proper authorizations defined in IAM policy to read from OCIR repositories.
- C. Incorrect.
Incorrect. You can store container images in different compartments as long as the OKE node pool and the required IAM policies are properly configured. There is no strict requirement that both OKE and OCIR be in the same compartment.
- D. Incorrect.
Incorrect. Making your images public might work technically, but it creates a significant security risk. Oracle best practices recommend using private repositories with proper authentication.