How to pass flags to konlet in Google Container OS?

I am running Google Container OS and would like to pass `-open-iptables=no` to konlet in order to not open a hole for all UDP and TCP traffic in the firewall:

https://github.com/GoogleCloudPlatform/konlet/blob/9cb9106daf07123c2641159cb8bcc9d6f4960ec2/gce-containers-startup/gce-containers-startup.go#L94-L99

How do I do that?

Update 2021-09-23: In case this should be supported with the current systemd service file, maybe you can answer https://github.com/terraform-google-modules/terraform-google-container-vm/issues/76 regarding how to do this with the Google Container Terraform module?

Start with gce-containers-startup/gce-containers-startup.go around lines 94-99, then inspect the current systemd service file referenced in the update. Determine how konlet receives -open-iptables=no, including through the Google Container Terraform module; done means the documented configuration passes the flag without opening all UDP and TCP traffic.

Written by the indexing model from the issue text.