Private-subnet Oracle Functions and OKE Pods for the city intranet must reach Vault without exposing the apps to the internet or dropping user keys on nodes. What is the appropriate pattern?
Select an answer to reveal the explanation.
Short Explanation
Use the building’s private service corridor—the service gateway—to reach Vault, and wear a workload or resource principal badge instead of taping user keys to the server.
Full Explanation
Private-subnet Oracle Functions and OKE Pods on the city intranet should reach Vault over a service gateway from the VCN and authenticate with a resource principal (Functions) or workload principal (OKE Pods). The service gateway provides private access to Oracle services without placing public IPs on the workloads, while principals replace user PEMs on nodes. Together they satisfy “reach Vault” without internet exposure of the apps or dropped user keys.
Attaching public IPs to every Function and baking IAM user PEMs into node cloud-init for debugging maximizes exposure and reintroduces long-lived user keys. Opening the Function to the internet and storing tenancy keys in Function config for local testing similarly violates both network and secret hygiene. Peering the VCN to on-premises only for Vault and disabling IAM policies for private workloads is neither necessary for OCI Vault access nor acceptable—private connectivity does not replace IAM authorization.
Exam caveat: service gateway alone does not grant secret read; IAM for the Function dynamic group or OKE workload principal is still required on the private path. Operational check: confirm the subnet route table sends Oracle Services traffic to the service gateway, ensure no public IP on the Function/Pods, retrieve a Vault secret with the resource or workload principal, and verify the same call fails if the principal’s read policy is removed.