An OKE Pod must read a Vault secret using workload identity without putting an instance principal on every node. Which policy form matches the documented shape?
Select an answer to reveal the explanation.
Short Explanation
Workload identity policies look like a checklist on the caller: type workload, namespace, service account, and cluster OCID—all must match before the secret read is allowed.
Full Explanation
Documented OKE workload-identity policies use Allow any-user with a where all clause on request.principal.type = 'workload', request.principal.namespace, request.principal.service_account, and request.principal.cluster_id. That pattern lets a Pod read a secret or bucket without relying on an instance principal on every node.