An OKE Pod must read a Vault secret using workload identity without putting an instance principal on every node. Which policy form matches the documented shape?
Select an answer to reveal the explanation.
Short Explanation
Workload identity policies look like a checklist on the caller: type workload, namespace, service account, and cluster OCID—all must match before the secret read is allowed.
Full Explanation
The documented IAM shape for an OKE Pod reading a Vault secret with workload identity—without placing an instance principal on every node—is an Allow any-user statement with where conditions that constrain request.principal.type to workload and pin namespace, service_account, and cluster_id (cluster OCID). That form authorizes only the intended permits ServiceAccount on the intended cluster/namespace to read secret-family (or a tighter secret target) in CityApps, which matches how workload identity principals are expressed in policy.
Allowing a dynamic group of OKE nodes to manage all-resources in the tenancy where request.user.id = 'workload' mixes node dynamic groups with a nonsensical user-id condition and grants enormous scope. Allowing group wheel to use functions-family where target.pod = 'true' targets the wrong resource family and invents a pod target flag that does not express workload identity. Allowing service oke to inspect compartments without principal conditions neither grants secret read nor scopes a Pod workload.
Exam caveat: any-user plus request.principal conditions is easy to mis-copy; a single wrong cluster_id or ServiceAccount name yields deny while looking almost identical to a working policy. Operational check: exec or run a job as permits-sa in the permits namespace, retrieve the secret bundle successfully, then repeat with a different ServiceAccount and confirm denial—proving the principal conditions, not a compartment-wide open read, are in force.