A developer must authorize an OKE Pod in the city’s enhanced cluster to call OCI APIs with workload identity. Which identifying triple is written into IAM for that workload?
Select an answer to reveal the explanation.
Short Explanation
Workload identity is a three-part name tag: which cluster, which namespace, and which ServiceAccount—like building, floor, and desk badge.
Full Explanation
OKE workload identity for a Pod in an enhanced cluster is identified in IAM by the triple of cluster, Kubernetes namespace, and ServiceAccount the Pod uses. Policies condition on those principal attributes so that only Pods running with that ServiceAccount in that namespace on that cluster can call the granted OCI APIs. That is how the city’s Pod gets a first-class OCI principal without mapping every workload to a node identity.
Using only the worker node OCID because every Pod supposedly inherits the node’s instance principal automatically is the older, coarser model and is not the workload-identity triple the question asks for; it also over-grants every Pod on the node. Using only Helm release name and chart version as free-form tags on the cluster does not constitute the workload principal identity in IAM. Using only the API Gateway deployment OCID that fronts the service identifies an edge deployment, not the Pod’s workload identity.
Exam caveat: workload identity support is tied to enhanced clusters and correct ServiceAccount configuration; basic-cluster assumptions or a Pod using the wrong ServiceAccount silently miss the policy. Operational check: compare the Pod’s namespace and ServiceAccount with the policy’s request.principal.namespace, request.principal.service_account, and request.principal.cluster_id values, then call a permitted API from the Pod and an unpermitted one to verify the triple is binding.