Starting GKE will create a new service agent named service-{PROJECT_

## Change Starting on February 3, 2025, GKE will create a new service agent named `service-{PROJECT_ NUMBER}@gcp-sa-gkenode.iam.gserviceaccount.com` that the GKE system workloads that run on your worker nodes can use. This service agent will only have the minimum permissions that GKE needs to operate these nodes by default, and will help to isolate the requirements of GKE-managed workloads from the requirements of your workloads. GKE-managed system workloads will begin using this service agent in an upcoming GKE version, which we'll announce in a separate release note.