1Z0-1123-25 Question 92
Select 2Your organization needs to deploy a microservices application to an OCI Container Engine for Kubernetes (OKE) cluster, with container images stored in a private repository on Oracle Cloud Infrastructure Registry (OCIR). Which TWO actions must you take to ensure that your OKE cluster can successfully pull images from the private repository?
- A
Store the container images in the OKE nodes� local Docker registry before creating the cluster.
- B
Generate an OCI Auth Token, use it to �docker login� to OCIR, and push your container images to the private repository.
- C
Configure a pod-level ImagePullSecret using your OCIR credentials, then reference that secret in your Deployment configuration.
- D
Directly attach the OCIR repository to the cluster using the cluster VCN and a public load balancer.
- E
Set up a custom Kubelet configuration file that bypasses authentication requirements for private images.
Show answer and explanation
Correct answers: B, C
Explanation
To enable OKE to pull private images from OCIR, you must first push your images using OCI Auth Tokens and Docker login (option 2). Next, create a Kubernetes secret referencing your OCIR credentials and configure your pods or deployments to use that secret (option 3). These steps adhere to OCI best practices documented at https://docs.oracle.com/en-us/iaas/Content/Registry/Tasks/registryauthtokens.htm and https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm.
- A. Incorrect.
Option 1: Incorrect. Merely storing images locally on OKE nodes is not a supported or secure approach. You must push images to OCIR for managed storage and distribution.
- B. Correct.
Option 2: Correct. You must generate an OCI Auth Token, then use �docker login� with the token to push images to your private repository in OCIR. This allows the repository to host your container images securely.
- C. Correct.
Option 3: Correct. After pushing images to the private repository, you need to create a Kubernetes secret with base64-encoded OCIR credentials. Referencing this secret in your workloads allows them to pull images during deployment.
- D. Incorrect.
Option 4: Incorrect. You cannot simply attach an OCIR repository to the cluster through the VCN. Authentication is still required to pull private images from OCIR.
- E. Incorrect.
Option 5: Incorrect. Kubelet configuration files cannot bypass authentication for private OCIR repositories. You must use proper secrets-based authentication.