GCP Workload Identity两类IAM绑定命令差异及替代方案问询

基本信息 #

• GSA：gke-service@test-ingest.iam.gserviceaccount.com
• KSA：default/log-forwarder
• 目标角色：roles/logging.logWriter

官方推荐配置命令 #

1. 为GSA赋予项目级日志写入权限 #

gcloud projects add-iam-policy-binding test-ingest \
--member=serviceAccount:gke-service@test-ingest.iam.gserviceaccount.com \
--role='roles/logging.logWriter'

2. 建立KSA与GSA的信任关系（允许KSA模拟GSA） #

gcloud iam service-accounts add-iam-policy-binding gke-service@test-ingest.iam.gserviceaccount.com \
--role roles/iam.workloadIdentityUser \
--member "serviceAccount:test-ingest.svc.id.goog[default/log-forwarder]"

疑问点 #

我确认过官方文档的标准配置方法，但发现也可以通过projects add-iam-policy-binding命令给GSA添加workloadIdentityUser权限：

gcloud projects add-iam-policy-binding test-ingest \
--member=serviceAccount:gke-service@test-ingest.iam.gserviceaccount.com \
--role='roles/iam.workloadIdentityUser'

不清楚gcloud projects add-iam-policy-binding和gcloud iam service-accounts add-iam-policy-binding这两个命令的差异，也想知道为什么绑定GSA与KSA要用后者而非前者。

另外，能否用以下两条iam service-accounts add-iam-policy-binding命令替代上述官方推荐的两条命令完成配置？

gcloud iam service-accounts add-iam-policy-binding gke-service@test-ingest.iam.gserviceaccount.com \
--role roles/logging.logWirter \
--member "serviceAccount:test-ingest.svc.id.goog[default/log-forwarder]"

gcloud iam service-accounts add-iam-policy-binding gke-service@test-ingest.iam.gserviceaccount.com \
--role roles/iam.workloadIdentityUser \
--member "serviceAccount:test-ingest.svc.id.goog[default/log-forwarder]"

内容的提问来源于stack exchange，提问作者ryullulala