1Z0-997-25 Question 10
Select 2A gaming company is refactoring its monolithic platform into microservices on Oracle Cloud Infrastructure (OCI). They plan to use Oracle Container Engine for Kubernetes (OKE) for container orchestration, Oracle Container Registry (OCIR) for image storage, and OCI DevOps for CI/CD pipelines. They also need a secure method to manage sensitive credentials for each microservice. Which two design decisions align with recommended OCI best practices for this scenario?
- A
Implement an OCI DevOps build pipeline triggered by commits to a source code repository, ensuring container images are stored in Oracle Container Registry, and automate deployments to OKE with rolling updates.
- B
Store credentials in plain text within each microservice� Dockerfile to simplify local development and image creation.
- C
Use Oracle Vault to store sensitive credentials, then reference them via Kubernetes secrets for each microservice in OKE.
- D
Run each microservice on a separate OKE cluster to ensure strict network isolation and reduce operational overhead.
- E
Build a single universal Docker image containing all microservices to streamline DevOps pipelines.
Show answer and explanation
Correct answers: A, C
Explanation
Adopting OCI DevOps pipelines for CI/CD, storing images in OCIR, and using rolling updates in OKE are foundational best practices for cloud native solutions. Protecting secrets with Oracle Vault and referencing them via Kubernetes secrets is another essential security practice. For more information, refer to the official Oracle documentation on OCI DevOps, OKE, and managing secrets with Oracle Vault and Kubernetes secrets.
- A. Correct.
Option 1 is correct because using OCI DevOps pipelines, integrating with a version control system, and storing images in OCIR is a recommended best practice for continuous integration and deployment. Rolling updates in OKE minimize downtime and streamline the release process.
- B. Incorrect.
Option 2 is incorrect because embedding credentials directly in Dockerfiles is insecure and not aligned with best practices. It exposes secrets when images are built and stored in registries.
- C. Correct.
Option 3 is correct as storing sensitive information in Oracle Vault and referencing them through Kubernetes secrets improves security and adheres to principle of least privilege. OCI supports this pattern for microservices running in OKE.
- D. Incorrect.
Option 4 is incorrect because generally, you do not need a separate OKE cluster for each microservice. A single OKE cluster can effectively isolate microservices while simplifying operational overhead through namespaces and network policies.
- E. Incorrect.
Option 5 is incorrect because bundling all microservices in a single image negates the advantages of modular deployments. It complicates updates and scaling, going against the main benefits of microservices architectures.