A teammate tries to add an OKE workload identity to the same dynamic group used by Oracle Functions. Why will that fail?
Select an answer to reveal the explanation.
Short Explanation
Functions join a dynamic-group club; OKE workload identity uses a different door—any-user plus principal conditions—and cannot be stuffed into that club today.
Full Explanation
OKE workload identities cannot currently be placed in the same dynamic groups used by Oracle Functions. Functions become principals through dynamic-group matching on fnfunc resources. Workload identities are authorized with any-user policies that constrain request.principal fields (type workload, namespace, service account, cluster id). Mixing them in one dynamic group therefore fails by design of the two principal models, not because of a tagging typo.
Claiming workload identities only work on basic clusters while dynamic groups require enhanced clusters reverses and muddles the facts: workload identity is an enhanced-cluster capability, and the failure mode here is principal modeling, not that swap of cluster types. Claiming dynamic groups accept only Object Storage buckets—and never Functions or OKE workloads—is false; dynamic groups commonly include Functions (and Compute instances), but that still does not mean workload identities join those groups. Claiming both workload identity and Functions require embedding IAM user PEMs contradicts both documented principal paths.
Exam caveat: teams often try to reuse one dynamic group for “all compute-like things”; for municipal platforms that run both Functions and OKE, plan two authorization patterns instead of one shared group. Operational check: keep Functions on dynamic-group policies, express OKE secret reads with any-user + request.principal workload conditions, and verify each path independently rather than expecting membership in civic-fn-dg to cover Pods.