Debugged this with @glamorous-printer-66548. Turns out GCP provider made a change recently, and you now need to use

subnetwork: vpnSubNetwork.selfLink

instead of

subnetwork: vpnSubNetwork.id

here. He was getting the confusing diff shown in https://pulumi-community.slack.com/archives/C84L4E3N1/p1563404171471600 because he had

0.17.22

of the

pulumi

CLI, but in

0.17.23

we actually released an improved rendering of this diff - and with that he gets a clearer presentation of what the root cause of this problem is:

+-gcp:compute/instance:Instance: (replace)
        [id=vpn-00a]
        [urn=urn:pulumi:gcp-project-solvvy-prod::gcp-project-solvvy-prod::gcp:compute/instance:Instance::instance]
      ~ networkInterfaces: [
          ~ [0]: {
                  ~ subnetwork: "<https://www.googleapis.com/compute/v1/projects/solvvy-production/regions/us-west1/subnetworks/vpn-subnetwork>" => "us-west1/vpn-subnetwork"
                }
        ]