Since the error is not easily reproducible, I created a script that repeatedly executes the installation and destruction of the Elastic Agent using the deploy.sh script. In 20 runs, the issue occurred twice.

Debug logs did not reveal anything new. During deployment, Deployment Manager performs status checks to determine if the operation is still running or completed. In the failed cases, the issue was related to binding a policy to a service account that was not yet available. I verified in the cloud console that the service account was created, which suggests this is likely a timing issue — the flow fails because the service account isn’t fully available at the time the binding is attempted.

According to Google’s notice, Deployment Manager will be deprecated on December 31, 2025. Given that, I don't think further investigation is necessary. To resolve this issue, we can use our existing feature to create the service account before executing the Deployment Manager script. This should work around the flakiness and enable stable workflow execution.