Virtual-node Pods for the health-clinic API must read secrets from OCI Vault without relying on a worker-instance principal. Which enhanced-cluster approach maps a Kubernetes service account to IAM for those calls?
Select an answer to reveal the explanation.
Short Explanation
Workload identity is the badge on the Pod's service account, not on a worker VM. Virtual nodes have no instance principal path; enhanced-cluster workload identity is the documented way for that Pod to call Vault or Object Storage.
Full Explanation
Official enhanced-cluster workload identity maps a Kubernetes service account to IAM so that Pod can invoke OCI APIs (Vault, Object Storage, and similar) without an instance principal on a worker VM. Virtual nodes cannot use instance-principal patterns that assume a worker instance. Baking user keys into images or opening Vault publicly violates least privilege and is not the documented path.