If I write a FlyteAgent in python can i assume that agent will be running in a pod running under the Flyte system's service account (specifically, if I want to authenticate to the cluster master to spin up other resources in k8s, can I do that using the know credentials location for the service account)

You can use whatever service account you want. I think the default agent uses the Flyte service account

Ahh, are there more detailed docs on how this works? Trying to figure out if it supports my use case (cleaner/safer Dask cluster).

Interesting- iiuc it might. Check agent docs

@melodic-magician-71351 I see you can instruct the agent Helm chart whether to create or not a ServiceAccount (ref) Do you need the Agent to consume an existing KSA?

Either way is fine, was thinking it was kinda deployed within the flyte controller. But if I can control it that works too.