allow ingress type to be specified

Provide a variable which allows ingress type to be specified. This allows placing the service behind Cloud Load Balancer.

Provide variables which allow extra annotations to be added to the Cloud Run service and the service template.

main.tf

@@ -26,6 +26,32 @@ resource "google_cloud_run_service" "webapp" {
 
   autogenerate_revision_name = true
 
+  metadata {
+    annotations = merge(
+      {
+        # As mentioned at https://www.terraform.io/docs/configuration/resources.html#ignore_changes
+        # placeholders need to be created as the adding the key to the map is
+        # considered a change and not ignored by ignore_changes. This needs to
+        # *always* be present in the config in order for it to appear in
+        # ignore_changes.
+        "run.googleapis.com/ingress-status" : "placeholder",
+      },
+
+      # Add the beta launch stage if required.
+      var.allowed_ingress != "all" ? {
+        # Required to be able to set ingress type.
+        "run.googleapis.com/launch-stage" : "BETA",
+      } : {},
+
+      # Specify the allowable ingress types.
+      {
+        "run.googleapis.com/ingress" : var.allowed_ingress,
+      },
+
+      var.service_annotations,
+    )
+  }
+
   template {
     metadata {
       annotations = merge(
@@ -49,7 +75,10 @@ resource "google_cloud_run_service" "webapp" {
           # Cloud SQL instances to auto-magically make appear in the container as
           # Unix sockets.
           "run.googleapis.com/cloudsql-instances" = var.sql_instance_connection_name
-        } : {}
+        } : {},
+
+        # Additional template annotations passed as a variable.
+        var.template_annotations,
       )
     }
 
@@ -105,6 +134,11 @@ resource "google_cloud_run_service" "webapp" {
       template[0].metadata[0].annotations["client.knative.dev/user-image"],
       template[0].metadata[0].annotations["run.googleapis.com/client-name"],
       template[0].metadata[0].annotations["run.googleapis.com/client-version"],
+
+      # If the allowed ingress variable is specified, ignore feedback about
+      # its status. We cannot make the presence of this ignore be dependent on
+      # "allowed_ingress" since ignore_changes needs to be a static list.
+      metadata[0].annotations["run.googleapis.com/ingress-status"],
     ]
   }
 }