Morgante Pell

i think this might be an upstream issue, since we don't touch labels at all and this shouldn't cause a permadiff. It looks like you reported the same issue there:...

As a workaround, you can try setting `add_cluster_firewall_rules = false`. The real fix would be something like: ``` cluster_alias_ranges_cidr = (var.add_cluster_firewall_rules && data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range != null) ? { for range in...

@robertb724 Do you mind sharing your Terraform config? I'm really curious why (2) is failing.

We might not have time to add this immediately, but would be happy to review a pull request.

You're free to either use the beta version or open a pull request.

@apeabody We really want to *reduce* the use of variables over-time, actually. Ideally most examples should be self-contained and liberally include static values instead of variables.

The ideal fix would be moving the network creation from the fixture to the example. Eventually we want to get rid of fixtures entirely.

Honestly, this seems like a bit of an edge case. Since you already have a way to grant the correct network tag, shouldn't your existing firewall rule be able to...

Hmm, the firewall rules were originally meant as as "shadow" rules to enable logging. #741 has more context. @rux616 Since you added the TPU support in #810, can you confirm...

It's complicated because we *also* need to allow overrides as a feature request (where people want to deploy the same template on multiple networks). The better thing to do would...