Oracle ' s documented OKE Workload Identity policy pattern is Allow any-user to < verb > < resource > in < location > where all {...} with conditions identifying request.principal.type= ' workload ' , the Kubernetes namespace, service account, and cluster OCID. Crucially, Oracle defines < location > as either the entire tenancyor a specific compartment. Oracle even provides examples granting a workload access only to resources in a named compartment. Consequently, C is false because workload-identity policies do not have to be tenancy-wide. Options A, B, and D accurately describe the standard policy structure: any-user is narrowed through workload-specific conditions, and those conditions identify the exact OKE workload by cluster, namespace, and service account. This enables fine-grained least-privilege access without storing OCI credentials inside pods.

Explanation

The correct syntax for implementing a rolling update deployment strategy in Kubernetes using the kubectl command is: kubectl rolling-update < deployment-name > --image=image:v2 This command initiates a rolling update of the specified deployment by updating the container image to image:v2. The rolling update strategy ensures that the new version of the application is gradually deployed while maintaining availability and minimizing downtime.

Oracle specifically recommends the multitenant database model for microservices because multiple Pluggable Databases can reside within one Container Database while retaining logical isolation. Oracle ' s microservices architecture guidance identifies PDBs as a strong persistence choice forbounded-context isolation, security, and high availability. Allocating a PDB per microservice isolates that service ' s private database objects while avoiding the infrastructure and operational overhead of provisioning an entire VM database system for every service. Shared schemas or shared tables weaken service autonomy and create tight coupling between bounded contexts. Because a CDB can host multiple isolated PDBs while sharing common database infrastructure and administration, option B best combines isolation with operational efficiency.

To push a new Docker container image to a repository in OCI Registry, you need to use an Auth Token to complete the authentication via the Docker CLI1. An Auth Token is a secure, auto-generated password that you can use to authenticate with OCI services such as OCI Registry1. You can generate an Auth Token in the Console by following these steps1:

In the top-right corner of the Console, open the Profile menu and then click User settings to view the details.

On the Auth Tokens page, click Generate Token.

Enter a friendly description for the auth token. Avoid entering confidential information.

Click Generate Token. The new auth token is displayed.

Copy the auth token immediately to a secure location from where you can retrieve it later, because you won’t see the auth token again in the Console.

Close the Generate Token dialog. After generating an Auth Token, you need to log in to OCI Registry by entering docker login < region-key > .ocir.io in a terminal window on the client machine running Docker, where < region-key > corresponds to the key for the OCI Registry region you’re using1. When prompted for a username, enter your username in the format < tenancy-namespace > / < username > , where < tenancy-namespace > is the auto-generated Object Storage namespace string of your tenancy1. When prompted for a password, enter the Auth Token you copied earlier1.