Missing IAP configuration for LB

[krisero]

Currently when I would like to add OIDC (IAP):

• I cannot add Signed Header Audience JWT in TF configuration. AFAIU it can only be done via system-admin panel.
• Additionally, there is missing configuration in LB for OIDC and after setting up IAP, this change is override by terraform apply.

Terraform planned the following actions, but then encountered a problem:

  # module.wandb.module.app_lb.module.url_map.google_compute_backend_service.default will be updated in-place
  ~ resource "google_compute_backend_service" "default" {
        id                              = "projects/***/global/backendServices/wandb-gke-ingress"
        name                            = "wandb-gke-ingress"
        # (17 unchanged attributes hidden)

      - iap {
          - oauth2_client_id            = "***.apps.googleusercontent.com" -> null
          - oauth2_client_secret_sha256 = (sensitive value) -> null
        }

        # (2 unchanged blocks hidden)
    }