Virtual-node Pods for the health-clinic API must read secrets from OCI Vault without relying on a worker-instance principal. Which enhanced-cluster approach maps a Kubernetes service account to IAM for those calls?
Select an answer to reveal the explanation.
Short Explanation
Workload identity is the badge on the Pod's service account, not on a worker VM. Virtual nodes have no instance principal path; enhanced-cluster workload identity is the documented way for that Pod to call Vault or Object Storage.
Full Explanation
Workload identity on an enhanced cluster maps a Kubernetes service account to OCI IAM so virtual-node Pods for the health-clinic API can call Vault (and other OCI APIs) without an instance principal on a worker VM. Virtual nodes have no traditional worker instance metadata path for instance principals; workload identity is the documented replacement that binds the Pod's service account to OCI permissions. Embedding long-lived user API signing keys in the container image shares brittle credentials across namespaces, complicates rotation, and violates least privilege. Image-baked keys are the antipattern workload identity exists to eliminate. Instance principals on virtual nodes fail because virtual nodes do not expose a normal worker instance principal/metadata path the way managed Compute workers do. Designing clinic Pods around instance principals breaks on virtual pools. Disabling IAM and making Vault secrets publicly readable from the internet removes the security boundary entirely and is never an acceptable pattern for clinic credentials. Exam caveat: workload identity requires enhanced cluster capabilities and correct IAM policies on the service-account mapping—enabling the feature without policies still yields authorization failures to Vault. Operational check: annotate/bind the clinic service account for workload identity, grant it least-privilege Vault access, deploy on virtual nodes, and confirm the Pod retrieves secrets without instance-principal metadata or embedded user keys.