Humans sign in, workloads call APIs — never confuse the two.
A recurring exam distractor pairing.
Workforce (Ch 1)Workload
FederatesHumansPipelines, apps, Pods
Typical useConsole SSOProgrammatic API calls
GKE variantN/AWIF for GKE — binds a K8s SA to a GCP SA
Two access patterns: direct grants roles straight to the federated identity; impersonation-based has it impersonate one service account. Start with direct, per Google's own guidance.