1Z0-1123-25 Question 94
Select 2Your team is migrating an on-premises microservice to containerized workloads on Oracle Cloud Infrastructure (OCI). You have built Docker images and stored them in a private repository in Oracle Cloud Infrastructure Registry (OCIR). You plan to deploy these containerized workloads to an Oracle Container Engine for Kubernetes (OKE) cluster in a private subnet. Which TWO steps should you take to ensure that your OKE cluster can seamlessly pull images from your private OCIR repository for deployment?
- A
Create a dynamic group that includes the OKE worker node instance IDs and define an IAM policy granting 'read' access to the OCIR repository for that dynamic group.
- B
Configure a Kubernetes imagePullSecret in your OKE cluster using an auth token associated with an IAM user and referencing the private repository.
- C
Enable 'Public' visibility for the repository in OCI Registry so that OKE can pull the image without authentication.
- D
Attach a service gateway to the VCN hosting your OKE cluster for outbound internet access to the private registry.
- E
Deploy an instance principal on every worker node so that each node can authenticate using Oracle Single Sign-On when pulling images from OCIR.
Show answer and explanation
Correct answers: A, B
Explanation
To pull images from a private OCIR repository, you must configure authentication so that your OKE cluster can access the registry. Oracle documentation describes two main approaches: (1) dynamic groups combined with IAM policies that give worker nodes 'read' access to OCIR, or (2) using a Kubernetes secret (imagePullSecret) containing Docker credentials tied to an OCI auth token. Both methods allow seamless image pulls while preserving repository privacy. For more details, refer to OCI documentation on Container Engine for Kubernetes and OCIR authentication methods.
- A. Correct.
Correct. By creating a dynamic group for the OKE worker nodes and defining an IAM policy that allows them to read from the private OCIR repository, you enable the cluster to pull images without requiring additional secrets. This is a recommended approach when you prefer to leverage instance principals rather than storing credentials in Kubernetes.
- B. Correct.
Correct. Configuring a Kubernetes imagePullSecret using an IAM user� auth token is a common method for private repository access. You store the repository credentials in a secret, and Kubernetes uses that secret to authenticate when pulling images from the registry.
- C. Incorrect.
Incorrect. Enabling public visibility for the repository would remove the private nature of your images. This is not required for OKE to pull images and could expose your container images to unintended parties.
- D. Incorrect.
Incorrect. A service gateway allows private connectivity to OCI services without traversing the public internet, but it does not handle authentication to OCIR. You still need a valid authentication mechanism, such as a dynamic group or a Kubernetes secret.
- E. Incorrect.
Incorrect. OKE worker nodes already have instance principals. You don't manually 'deploy' an instance principal on each node. Instead, you either configure a dynamic group or set up a Kubernetes secret to handle authentication.