OKE worker nodes for a records-management workload run in a private subnet and must pull images from OCIR in the same region without public IPs. Which VCN attachment pattern do official OCIR docs call out for that pull path?
Select an answer to reveal the explanation.
Short Explanation
Private subnet workers do not need public IPs to pull same-region OCIR. A service gateway on the VCN is the documented path—app attachment to an existing VCN, not a hub-spoke redesign.
Full Explanation
Official OCIR guidance for private subnet workers is that a service gateway on the VCN enables pulls from OCIR in the same region without public IPs or public-internet traversal. Mandating an internet gateway as the only answer is incorrect for this pattern, and the item is not an Architect hub-spoke redesign question. Ad-hoc SSH image copies are not the platform pattern.