using OS Login via local ssh with public key is ok. But sudo will prompt for password after some time.
The way I fix is to use the GCP default SSH connect via console.cloud.google.com to connect. This adds 2 entries to ~/.ssh/authorized_keys. Go back to local login and sudo work again. It seems the 2 entries added by GCP default connect will be removed after expiry which disable the sudo login.
This is a nice feature to provide additional security