A teammate tries to add an OKE workload identity to the same dynami…

Question

A teammate tries to add an OKE workload identity to the same dynamic group used by Oracle Functions. Why will that fail?

Accepted Answer

OKE workload identities cannot currently be placed in dynamic groups; they use any-user policies with request.principal conditions, while Functions use dynamic groups — Functions join a dynamic-group club; OKE workload identity uses a different door—any-user plus principal conditions—and cannot be stuffed into that club today.

Answer

Workload identities only work on basic clusters, and dynamic groups require enhanced clusters

Answer

Dynamic groups accept only Object Storage buckets, never Functions or OKE workloads

Answer

Workload identity and Functions both require embedding IAM user PEMs instead of principals

A teammate tries to add an OKE workload identity to the same dynamic group used by Oracle Functions. Why will that fail?

Short Explanation

Full Explanation