Expose a Cloud Run service via an HTTP LB

test.tf

resource "google_cloud_run_v2_service" "my_svc" {
  name = "my-svc"
  location = "asia-northeast1"
  ingress = "INGRESS_TRAFFIC_ALL"
  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
      resources {
        limits = { "cpu": "4000m", "memory" : "2Gi" }
      }  
    }
  }
  traffic {
    type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }
  lifecycle {
    ignore_changes = [
      client,
      client_version,
      template[0].annotations,
      template[0].revision,
      template[0].containers[0].image,
      annotations
    ]
  }
}

# ip
resource "google_compute_global_address" "my_svc" {
  name = "my-svc"
}

resource "google_dns_record_set" "my_svc" {
  name = "my-svc.example.com"
  type = "A"
  ttl  = 60
  managed_zone = google_dns_managed_zone.default.name
  rrdatas = [google_compute_global_address.my_svc.address]
}

# NEG
resource "google_compute_region_network_endpoint_group" "my_svc" {
  name                  = "my-svc"
  network_endpoint_type = "SERVERLESS"
  region                = google_cloud_run_v2_service.my_svc.location
  cloud_run {
    service = google_cloud_run_v2_service.my_svc.name
  }
}

resource "google_compute_backend_service" "my_svc" {
  name       = "my-svc"
  enable_cdn = true
  backend {
    group = google_compute_region_network_endpoint_group.my_svc.id
  }
}

resource "google_compute_url_map" "my_svc" {
  name = "my-svc"
  default_service = google_compute_backend_service.my_svc.id
}

resource "google_compute_managed_ssl_certificate" "my_svc" {
  name = "my-svc"
  managed {
    domains = [google_dns_record_set.my_svc.name]
  }
}

resource "google_compute_target_https_proxy" "my_svc" {
  name = "my-svc"
  url_map = google_compute_url_map.my_svc.id
  ssl_certificates = [
    google_compute_managed_ssl_certificate.my_svc.id
  ]
}

resource "google_compute_global_forwarding_rule" "my_svc" {
  name = "my-svc"
  load_balancing_scheme = "EXTERNAL"
  port_range = "443"
  ip_address = google_compute_global_address.my_svc.id
  target = google_compute_target_https_proxy.my_svc.id
}