A municipal benefits Function always retrieves a database password by the same Vault secret OCID. After operators rotate the password in Vault, which statement correctly describes what the Function receives on the next retrieval?
Select an answer to reveal the explanation.
Short Explanation
Picture a labeled mailbox that never changes address while the letters inside get swapped. The secret OCID is the address; each version is a new generation of the password bytes.
Full Explanation
Vault secrets are stable resources identified by OCID. When municipal operators rotate the benefits database password, Vault creates a new secret version that holds the updated bytes while the parent secret OCID remains unchanged. The Function therefore continues to retrieve by the same OCID and receives the current contents—typically the latest current version—without any config rewrite. That separation of identity (OCID) from generation (version) is what makes rotation safe for long-lived Function wiring.
Expecting a new secret OCID on every update is wrong: versions are children of one secret, not replacements of its identifier, so rewriting Function config after each rotation is unnecessary churn and a common anti-pattern. Redeploying a Kubernetes Secret manifest from a chart repo confuses OKE delivery mechanics with Functions-to-Vault retrieval; Functions read Vault secret versions directly through the Secrets API and do not require a chart-sourced Kubernetes Secret for that path. Treating versions as replacing the parent resource so that version 1’s OCID becomes invalid after version 2 also fails conceptually—version OCIDs and the parent secret OCID are distinct, and the parent remains the handle apps should call.
Exam caveat: retrieval of “current” contents depends on rotation state; a newly created version that is still pending is not what current-fetching clients see until it is promoted. Operational check: after rotation, retrieve the same secret OCID from a test invoke or SDK call and verify the version number and rotation state match the intended current password before cutting the benefits Function over in production.