Why does an unchanged gke/k8

ClusterRoleBinding

show as an update?

I think this is a nuance of https://github.com/pulumi/pulumi/pull/3327, which should be fixed in the next couple weeks.