main.tf

resource "google_cloud_run_service" "default" {
  provider = google-beta

  name                       = var.name
  location                   = var.location
  autogenerate_revision_name = true
  project                    = local.project_id

  metadata {
    namespace = local.project_id
    labels    = var.labels
    annotations = merge(
      {
        "run.googleapis.com/ingress"     = var.ingress
        "run.googleapis.com/client-name" = "terraform"
        "client.knative.dev/user-image"  = var.image
      },
      length(local.secrets_to_aliases) < 1 ? {} : {
        "run.googleapis.com/secrets" = join(",", [for secret, alias in local.secrets_to_aliases : "${alias}:${secret}"])
      }
    )
  }

  lifecycle {
    ignore_changes = [
      template[0].metadata[0].annotations,
      metadata[0].annotations,
      metadata[0].labels,
      template[0].spec[0].containers[0].image
    ]
  }

  template {
    spec {
      container_concurrency = var.concurrency
      timeout_seconds       = var.timeout
      service_account_name  = var.service_account_email

      containers {
        image   = var.image
        command = var.entrypoint
        args    = var.args

        ports {
          name           = var.http2 ? "h2c" : "http1"
          container_port = var.port
        }

        resources {
          limits = {
            cpu    = "${var.cpus * 1000}m"
            memory = "${var.memory}Mi"
          }
        }

        # Populate straight environment variables.
        dynamic "env" {
          for_each = [for e in local.env : e if e.value != null]

          content {
            name  = env.value.key
            value = env.value.value
          }
        }

        # Populate environment variables from secrets.
        dynamic "env" {
          for_each = [for e in local.env : e if e.secret.name != null]

          content {
            name = env.value.key
            value_from {
              secret_key_ref {
                name = coalesce(env.value.secret.alias, env.value.secret.name)
                key  = env.value.secret.version
              }
            }
          }
        }

        dynamic "volume_mounts" {
          for_each = local.volumes

          content {
            name       = volume_mounts.value.name
            mount_path = volume_mounts.value.path
          }
        }
      }

      dynamic "volumes" {
        for_each = local.volumes

        content {
          name = volumes.value.name

          secret {
            secret_name = coalesce(volumes.value.secret.alias, volumes.value.secret.name)

            dynamic "items" {
              for_each = volumes.value.items

              content {
                key  = items.value.version
                path = items.value.filename
              }
            }
          }
        }
      }
    }

    metadata {
      labels = var.labels
      annotations = merge(
        {
          "run.googleapis.com/cpu-throttling"        = var.cpu_throttling
          "run.googleapis.com/cloudsql-instances"    = join(",", var.cloudsql_connections)
          "autoscaling.knative.dev/maxScale"         = var.max_instances
          "autoscaling.knative.dev/minScale"         = var.min_instances
          "run.googleapis.com/execution-environment" = var.execution_environment
        },
        local.vpc_access.connector == null ? {} : {
          "run.googleapis.com/vpc-access-connector" = local.vpc_access.connector
          "run.googleapis.com/vpc-access-egress"    = local.vpc_access.egress
        },
        length(local.secrets_to_aliases) < 1 ? {} : {
          "run.googleapis.com/secrets" = join(",", [for secret, alias in local.secrets_to_aliases : "${alias}:${secret}"])
        },
      )
    }
  }

  traffic {
    percent         = 100
    latest_revision = var.revision == null
    revision_name   = var.revision != null ? "${var.name}-${var.revision}" : null
  }
}


resource "google_cloud_run_service_iam_member" "public_access" {
  count    = var.allow_public_access ? 1 : 0
  service  = google_cloud_run_service.default.name
  location = google_cloud_run_service.default.location
  project  = google_cloud_run_service.default.project
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_domain_mapping" "domains" {
  for_each = var.map_domains

  location = google_cloud_run_service.default.location
  project  = google_cloud_run_service.default.project
  name     = each.value

  metadata {
    namespace = google_cloud_run_service.default.project
    annotations = {
      "run.googleapis.com/launch-stage" = local.launch_stage
    }
  }

  spec {
    route_name = google_cloud_run_service.default.name
  }

  lifecycle {
    ignore_changes = [metadata[0]]
  }
}