Seems like there is a bug when updating a VPNTunnel in GCP. If you change the localTrafficSelectors, it doesn’t remove the old tunnel first. It’s trying to create it first, thus failing because

A tunnel with same peer IP is already associated with the same gateway.

By default Pulumi will create replacements before deleting old ones. Would https://www.pulumi.com/docs/reference/programming-model/#deletebeforereplace help in this case?

It would, but pulumi should know how to handle this automatically

Yea... that's an interesting one. This is pretty fundamental functionality so changing it for one-off resources would be unexpected for most people, even if it is the necessary behavior.

Sure