Anyone seen an issue with gcp classic where a GKE cluster keeps being recreated for a NodeConfig change even though there isn't an change? I have to use a non-default NodeConfig because the org requires secure boot for everything.

Are you using the inline default node group on the cluster? If so, rhags expected behaviour, the api is immutable. The way to do it is to make the default node group super small and taint it for only system use, then add another node group for workloads

I'm using the auto remove node pool option, I ended up using pulumi.IgnoreChanges([]string{"nodeConfig"})