1Z0-1123-25 Question 96
Select 2You are migrating a microservices-based application from an on-premises environment to Oracle Cloud Infrastructure (OCI). You have provisioned an OCI Container Engine for Kubernetes (OKE) cluster to orchestrate your containers, and you intend to store your private container images in Oracle Cloud Infrastructure Registry (OCIR). Which two actions must you perform to ensure that your OKE cluster nodes can successfully pull images from your private repositories in OCIR?
- A
Create and apply a Kubernetes secret of type 'docker-registry' in your cluster, referencing the OCIR credentials.
- B
Define an IAM policy with the correct permissions for a dynamic group that includes the OKE node pool OCIDs, allowing them to 'use' the relevant OCIR repositories.
- C
Configure your images to point to the ephemeral registry endpoint by tagging them with 'localhost:5000/my-application:tag' before pushing to OCIR.
- D
Assign a public IP address to each OKE node so they can connect to OCIR over the public internet.
Show answer and explanation
Correct answers: A, B
Explanation
When deploying private images to an OCI Container Engine for Kubernetes cluster, you must grant your nodes permission to pull those images, typically by configuring both IAM policies and a Kubernetes secret. The secret of type 'docker-registry' holds the credentials to authenticate with OCIR, while the appropriate IAM policy ensures that the OKE node pool has the necessary privileges to access the specific OCIR repositories. For more information, refer to the OCI documentation on using private repositories with Container Engine for Kubernetes.
- A. Correct.
Correct. To allow private image pulls from OCIR, you must create a Kubernetes secret of type 'docker-registry' that holds your OCIR credentials (token). This secret is then referenced in the Pod specification, so OKE knows how to authenticate.
- B. Correct.
Correct. Even if you have created a Kubernetes secret, your node pool VMs need the necessary IAM permissions to 'use' the repository in OCIR. A common best practice is to create a dynamic group containing the node pool OCIDs and then define an IAM policy granting access to the relevant repositories.
- C. Incorrect.
Incorrect. Tagging the images with 'localhost:5000' implies you are using a local or custom registry, not OCIR. In OCI, images should be tagged with the region-specific OCIR endpoint (e.g., 'iad.ocir.io/
/ :tag'). - D. Incorrect.
Incorrect. You do not need to assign a public IP to each node for image pulls from OCIR. OKE nodes can access OCIR through OCI's inherent private network paths and IAM permissions without exposing the node pool publicly.