GCP has "Workload Identity" as an analogue to IRSA for a little while now.
What I appreciate about GCP's IAM is that it seems to work well with simple ACLs vs. needing a lot of conditional policies, but this is probably because it strongly encourages folder and project structure to define different permission domains.
Still no capability model unfortunately. The closest I have seen is SPIFFE (https://spiffe.io/docs/latest/spiffe-about/overview/) which tries to tie most permissions to the identity of the requester using a policy engine instead of direct capabilities, but without broad support in... anything, it requires a ton of proxies to existing resources to work as anything other than a service mesh. It is also not as fine-grained as capabilities, but I think it's a reasonable first step since in a distributed software ecosystem the question of what owns a capability is definitely tied up in the identity of a thing running (probably virtualized) on something somewhere, as opposed to within a single operating system where the kernel can conveniently track identity/ownership.
What I appreciate about GCP's IAM is that it seems to work well with simple ACLs vs. needing a lot of conditional policies, but this is probably because it strongly encourages folder and project structure to define different permission domains.
Still no capability model unfortunately. The closest I have seen is SPIFFE (https://spiffe.io/docs/latest/spiffe-about/overview/) which tries to tie most permissions to the identity of the requester using a policy engine instead of direct capabilities, but without broad support in... anything, it requires a ton of proxies to existing resources to work as anything other than a service mesh. It is also not as fine-grained as capabilities, but I think it's a reasonable first step since in a distributed software ecosystem the question of what owns a capability is definitely tied up in the identity of a thing running (probably virtualized) on something somewhere, as opposed to within a single operating system where the kernel can conveniently track identity/ownership.