allow ingress type to be specified

Provide a variable which allows ingress type to be specified. This
allows placing the service behind Cloud Load Balancer.

Provide variables which allow extra annotations to be added to the Cloud
Run service and the service template.

main.tf

@@ -26,6 +26,20 @@ resource "google_cloud_run_service" "webapp" {
 
   autogenerate_revision_name = true
 
+  metadata {
+    annotations = merge(
+      {
+        # Required to be able to set ingress type.
+        "run.googleapis.com/launch-stage" : "BETA",
+
+        # Specify the allowable ingress types.
+        "run.googleapis.com/ingress" : var.allowed_ingress,
+      },
+
+      var.service_annotations,
+    )
+  }
+
   template {
     metadata {
       annotations = merge(
@@ -49,7 +63,10 @@ resource "google_cloud_run_service" "webapp" {
           # Cloud SQL instances to auto-magically make appear in the container as
           # Unix sockets.
           "run.googleapis.com/cloudsql-instances" = var.sql_instance_connection_name
-        } : {}
+        } : {},
+
+        # Additional template annotations passed as a variable.
+        var.template_annotations,
       )
     }
 

variables.tf

@@ -122,3 +122,29 @@ variable "monitoring_path" {
   default     = "/"
   description = "path component of url to be monitored"
 }
+
+variable "allowed_ingress" {
+  default     = "all"
+  description = <<EOL
+    Specify the allowed ingress to the service. Should be one of:
+    "all", "internal" or "internal-and-cloud-load-balancing".
+  EOL
+}
+
+variable "service_annotations" {
+  type        = map(string)
+  default     = {}
+  description = <<EOL
+    Map containing additional annotations to be added to the Cloud Run service
+    itself.
+  EOL
+}
+
+variable "template_annotations" {
+  type        = map(string)
+  default     = {}
+  description = <<EOL
+    Map containing additional annotations to be added to the Cloud Run service
+    template.
+  EOL
+}