resource google_cloud_run_service default {
  name     = "test"
  location = "${var.region}"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

resource google_container_registry registry {
  project  = "cloud_run_test_sakurai"
  location = "ASIA"
}

# デプロイ時は先にgcrへイメージをアップロードする必要がある
resource google_cloud_run_service default {
  name     = "cloud_run_test_sakurai"
  location = "asia-southeast1"

  template {
    spec {
      containers {
        image = "gcr.io/{{PROJECT_ID}}/cloud_run_test_sakurai:latest"
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

resource google_storage_notification notification {
  bucket         = "cloud_run_test_sakurai.appspot.com"
  payload_format = "JSON_API_V1"
  topic          = google_pubsub_topic.image_upload.id
  event_types    = ["OBJECT_FINALIZE"]
  depends_on = [google_pubsub_topic_iam_binding.binding]
}

resource google_pubsub_topic_iam_binding binding {
  topic   = google_pubsub_topic.image_upload.id
  role    = "roles/pubsub.publisher"
  members = ["serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"]
}

data "google_storage_project_service_account" "gcs_account" {}

resource google_pubsub_topic image_upload {
  name = "cloud_run_test_sakurai-topic"
}

resource google_service_account pubsub_kicker {
  account_id = "cloud_run_test_sakurai-pubsub-kicker"
  display_name = "Pub/Sub service account for cloud run kicker"
}

resource google_project_iam_member pubsub_kicker {
  member = "serviceAccount:service-{{ACCOUNT_ID}}@gcp-sa-pubsub.iam.gserviceaccount.com"
  role = "roles/iam.serviceAccountTokenCreator"
}

resource google_cloud_run_service_iam_member pubsub_kicker {
  service = google_cloud_run_service.default.name
  location = google_cloud_run_service.default.location
  role = "roles/run.invoker"
  member = "serviceAccount:${google_service_account.pubsub_kicker.email}"
}

resource google_pubsub_subscription kick_cloud_run {
  name  = "cloud_run_test_sakurai-subscription"
  topic = google_pubsub_topic.image_upload.name

  ack_deadline_seconds = 600
  message_retention_duration = "1200s"

  retry_policy {
    minimum_backoff = "60s"
  }

  push_config {
    push_endpoint = "${google_cloud_run_service.default.status[0].url}"
    oidc_token {
      service_account_email = google_service_account.pubsub_kicker.email
    }
  }
}

substitutions:
  _TERRAFORM_VERSION_: 0.12.10
steps:
  - id: 'build_gkr_image'
    name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'docker'
    args: ['build','-t','gcr.io/${PROJECT_ID}/cloud_run_test_sakurai:latest','{{PATH/TO/DOCKERFILE}}']
    allow_failure: true
  - id: 'push_gkr'
    name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'docker'
    args: ['push','gcr.io/${PROJECT_ID}/cloud_run_test_sakurai:latest']
    allow_failure: true
  - id: 'tf apply'
    name: 'hashicorp/terraform:${_TERRAFORM_VERSION_}'
    entrypoint: 'sh'
    args: ['./ci/terraform_apply.sh','dev']
timeout: 3600s