You work for a large bank where security and compliance are critical.
As part of the security overview meeting, your company decided to minimize the installation of local tools on your laptop.
You have been running Ansible and kubectl to spin up Oracle Container Engine for Kubernetes (OKE) clusters and deployed your application.
For authentication, you are using an Oracle Cloud Infrastructure (OCI) CLI config file that contains OCIDs, Fingerprint, and a locally stored PEM file.
Your security team doesn't want you to store any local API key and certificate, or any other local tools.
Which two actions should you perform to spin up the OKE cluster and interact with it? (Choose two.)
Click on the arrows to vote for the correct answer
A. B. C. D. E.CE.
https://oracle-cloud-infrastructure-ansible-modules.readthedocs.io/en/latest/modules/oci_cluster_module.htmlThe question is asking for two actions that can be taken to spin up an Oracle Container Engine for Kubernetes (OKE) cluster and interact with it without storing any local API key and certificate or other local tools. Let's go through each answer option and explain if it meets the requirements:
A. Create a developer workstation on OCI. Install Ansible and kubectl on it. Use resource principal to authenticate against OCI API and create the OKE Cluster.
This option suggests creating a developer workstation on Oracle Cloud Infrastructure (OCI), installing Ansible and kubectl on it, and using the resource principal to authenticate against OCI API to create the OKE cluster. A resource principal is an OCI feature that allows a compute instance to authenticate against OCI services using its own credentials without the need for API keys, user certificates, or IAM users.
This option meets the requirements because it does not require any local tools or certificates to be stored on the laptop. However, it requires creating a compute instance on OCI, which may be an additional cost.
B. Develop your own code using OCI SDK to deploy the OKE cluster.
This option suggests using the OCI SDK to develop code to deploy the OKE cluster. The OCI SDK is a software development kit that provides APIs for interacting with OCI services.
While this option meets the requirement of not storing any local tools, it may be time-consuming and requires expertise in programming and the OCI SDK.
C. Work on OCI Cloud Shell to use built-in Ansible and kubectl to deploy the OKE cluster. Use OCI_CLI_AUTH=instance_obo_user environment variable to authenticate using built-in token.
This option suggests working on the OCI Cloud Shell, which is a browser-based shell environment provided by OCI that has built-in tools, including Ansible and kubectl. It also suggests using the OCI_CLI_AUTH=instance_obo_user environment variable to authenticate using a built-in token.
This option meets the requirement of not storing any local tools or certificates on the laptop. However, it requires using the Cloud Shell and may have some limitations in terms of available tools and resources.
D. Work on OCI Cloud Shell to use built-in Ansible and kubectl to deploy the OKE cluster. Bring in your own config file and certificate to authenticate against OCI API.
This option suggests working on the OCI Cloud Shell and using built-in Ansible and kubectl to deploy the OKE cluster. It also suggests bringing in your own config file and certificate to authenticate against OCI API.
This option does not meet the requirement of not storing any local tools or certificates on the laptop, as it requires bringing in your own config file and certificate. It also has the same limitations as option C.
E. Create a developer workstation on OCI. Install Ansible and kubectl on it. Use instance principal to authenticate against OCI API and create the OKE Cluster.
This option suggests creating a developer workstation on OCI, installing Ansible and kubectl on it, and using the instance principal to authenticate against OCI API to create the OKE cluster. The instance principal is similar to the resource principal, but it is associated with the compute instance's network interface rather than the compute instance itself.
This option meets the requirement of not storing any local tools or certificates on the laptop. However, it requires creating a compute instance on OCI, which may be an additional cost.
In summary, the two actions that meet the requirement of not storing any local tools or certificates on the laptop are: