Issue: In GKE version 1.35 and later, due to faster node startup, workloads that use Dataplane V2 and Workload Identity...

In GKE version 1.35 and later, due to faster node startup, workloads that use Dataplane V2 and Workload Identity Federation for GKE to authenticate to Google Cloud APIs might experience transient connectivity timeouts or refused connections to the GKE metadata server immediately following node startup.

For recommendations and workarounds if this impacts your workload (for example, if your workload doesn't retry requests until they succeed), see Timeout errors at Pod startup, specifically by deploying an initContainer.

Alternatively, add any that selects no workloads, such as in a namespace with no workloads—to GKE Dataplane V2, network policy—including one which disables the faster node startup. Improvements are in progress and coming in a future GKE patch.