If you delete a label from the config.yaml file in your GKE cluster, the Google Cloud Platform plugin for Panorama deletes the NAT rule and service object on Panorama, but the change is not pushed, so the managed firewalls retain the NAT rule and service object.

Workaround:

If you accidentally created an invalid label, correct the label in your config.yaml file. From Panorama, commit and push the changes to the managed firewalls.

You can also delete the service from your GKE cluster. In this case the Google Cloud Platform plugin automatically deletes the NAT rule and service object, and a commit is not required.