fix idempotent behaviour of allow_ingress [REVIEW]

It would appear that the "run.googleapis.com/ingress" annotation can be
set to "all" without having to enable the beta launch stage. Indeed it
*has* to be set to "all" since attempting to unset it causes Cloud Run
to immediately reset it.

main.tf

@@ -37,15 +37,16 @@ resource "google_cloud_run_service" "webapp" {
         "run.googleapis.com/ingress-status" : "placeholder",
       },
 
-      var.allowed_ingress != "" ? (
-        {
-          # Required to be able to set ingress type.
-          "run.googleapis.com/launch-stage" : "BETA",
+      # Add the beta launch stage if required.
+      var.allowed_ingress != "all" ? {
+        # Required to be able to set ingress type.
+        "run.googleapis.com/launch-stage" : "BETA",
+      } : {},
 
-          # Specify the allowable ingress types.
-          "run.googleapis.com/ingress" : var.allowed_ingress,
-        }
-      ) : {},
+      # Specify the allowable ingress types.
+      {
+        "run.googleapis.com/ingress" : var.allowed_ingress,
+      },
 
       var.service_annotations,
     )

variables.tf

@@ -124,13 +124,13 @@ variable "monitoring_path" {
 }
 
 variable "allowed_ingress" {
-  default     = ""
+  default     = "all"
   description = <<EOL
     Specify the allowed ingress to the service. Should be one of:
-    "", "all", "internal" or "internal-and-cloud-load-balancing".
+    "all", "internal" or "internal-and-cloud-load-balancing".
 
-    Setting this to a non-empty value implies that the service will be moved to
-    the "beta" launch stage. See
+    Setting this to a value other than "all" implies that the service will be
+    moved to the "beta" launch stage. See
     https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation.
   EOL
 }