A nasty surprise in the latest openvpn@.service definitions on Ubuntu Xenial (16.04) - OpenVPN can start before networking and so dhcp will complain about an unknown interface tun0 and the whole network stack does not get started.
The solution is to add After=networking.service to the [Unit] section of the file /lib/systemd/system/openvpn@.service
source: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1598522
on google cloud, the only way to fix this problem (short of having proper serial port login access configured) is to delete instance/detach the disk, attach to another vm, fix this file and recreate instance using the same disk as described in this answer@ StackOverflow
With terraform it adds another layer of complexity - I eventually ended up fudging the VM manually created to exactly match the one in terraform.tfstate and all was well.