Private OKE worker nodes need to pull images from OCI Container Registry in the same region without public internet exposure. Which path should be considered?

1. A service gateway with the required routing, security rules, and registry access
2. An internet gateway alone with no public addresses or applicable routing
3. A DNS record containing the registry password
4. Making the image repository public as the only required change