This service account includes the Workload Identity annotations
(https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to) to map this to a correspond GCP Service Account.

Workload Identity is already enabled for the dogfooding cluster.