Patch XPK to deploy cluster with private nodes (#1733)

Update hard-coded setting to disable node public IP in cluster blueprint
which is not exposed in xpk - cluster redeployed on Oct 7 2025 due to
organization policy constraint

Author: aybchan

.github/gke-workflow/gke/xpk-gcs-sa.yml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: xpk-gcs-sa
+  name: xpk-sa
   namespace: default
   annotations:
     iam.gke.io/gcp-service-account: jobset-xpk-user@nv-jaxtoolboxgcp-20240925.iam.gserviceaccount.com
@@ -25,7 +25,7 @@ metadata:
   namespace: default
 subjects:
   - kind: ServiceAccount
-    name: xpk-gcs-sa
+    name: xpk-sa
     namespace: default
 roleRef: 
   kind: Role

.github/gke-workflow/xpk/v0.10.1/blueprint.patch

@@ -1,15 +1,16 @@
 diff --git a/src/xpk/core/blueprint/blueprint_generator.py b/src/xpk/core/blueprint/blueprint_generator.py
-index 3d7f046..d94fe9e 100644
+index 3d7f046..bac71ba 100644
 --- a/src/xpk/core/blueprint/blueprint_generator.py
 +++ b/src/xpk/core/blueprint/blueprint_generator.py
-@@ -201,12 +201,15 @@ class BlueprintGenerator:
+@@ -201,12 +201,16 @@ class BlueprintGenerator:
                  "type": "nvidia-h100-mega-80gb",
                  "count": 8,
                  "gpu_driver_installation_config": {
 -                    "gpu_driver_version": "LATEST"
 +                    "gpu_driver_version": "INSTALLATION_DISABLED"
                  },
              }],
++            "enable_private_nodes": True,
              "auto_upgrade": (
                  True if capacity_type != CapacityType.FLEX_START else False
              ),