A CI runner and later an OKE worker must retrieve the same permits-api artifact that was pushed to OCIR. How is that artifact identified on pull?
Select an answer to reveal the explanation.
Short Explanation
Pull uses the same fully qualified path you pushed. Laptop, CI, or worker—same domain/namespace/repo:version string identifies the artifact.
Full Explanation
Retrieving an image uses the same fully qualified OCIR reference: <registry-domain>/<tenancy-namespace>/<repository>:<version>. Whether the client is a laptop, CI runner, or kubelet, that string is the artifact identity. Hostname at build time or Object Storage bucket guesses are not the pull identity; private versus public access rules are a separate concern.