Create Cloud Run Service through Deployment Manager

cloudrun.jinja

{% set PROJECT = env['project'] %}
{% set REGION = properties['region'] | default('us-east1') %}

{% set PARENT = 'projects/' + PROJECT + '/locations/' + REGION %}

{% set PREFIX = env['deployment'] %}

{% set CLOUDRUN_TYPE_PROVIDER = PREFIX + '-provider' %}
{% set CLOUDRUN_SERVICE_TYPE = PROJECT + '/' + CLOUDRUN_TYPE_PROVIDER + ':projects.locations.services' %}

{% set CLOUDRUN_SERVICE = PREFIX + '-service' %}
{% set CLOUDRUN_SERVICE_ACCOUNT = PREFIX + '-sa' %}

{% set CLOUDRUN_SERVICE_INVOKER = PREFIX + '-service' %}
{% set CLOUDRUN_INVOKER = properties['invoker'] | default('allUsers') %}

resources:
- name: {{ CLOUDRUN_TYPE_PROVIDER }}
  type: deploymentmanager.v2beta.typeProvider
  properties:
    descriptorUrl: https://run.googleapis.com/$discovery/rest?version=v1alpha1
    options:
      inputMappings:
      - fieldName: Authorization
        location: HEADER
        value: $.concat("Bearer ", $.googleOauth2AccessToken())

    collectionOverrides:
    - collection: projects.locations.services
      options:
        virtualProperties: |
          schema: http://json-schema.org/draft-04/schema#
          type: object
          required:
          - spec
          properties:
            spec:
              type: object
              description: https://cloud.google.com/run/docs/reference/rest/v1alpha1/RevisionSpec

        inputMappings:
        - methodMatch: ^create$
          location: PATH
          fieldName: parent
          value: $.concat("{{ PARENT }}")

        - methodMatch: ^(get|replaceService|delete)$
          location: PATH
          fieldName: name
          value: $.concat("{{ PARENT }}/services/", $.resource.name)

        - methodMatch: ^setIamPolicy$
          location: PATH
          fieldName: resource
          value: $.concat("{{ PARENT }}/services/", $.resource.name)

        - methodMatch: ^create$
          location: BODY
          fieldName: kind
          value: $.concat("Service")

        - methodMatch: ^create$
          location: BODY
          fieldName: apiVersion
          value: $.concat("serving.knative.dev/v1alpha1")

        - methodMatch: ^create$
          location: BODY
          fieldName: metadata.name
          value: $.resource.name

        - methodMatch: ^replaceService$
          location: BODY
          fieldName: metadata
          value: $.resource.self.metadata

        - methodMatch: ^(create|replaceService)$
          location: BODY
          fieldName: spec.template.spec
          value: $.resource.properties.spec

- name: {{ CLOUDRUN_SERVICE }}
  type: {{ CLOUDRUN_SERVICE_TYPE }}
  metadata:
    dependsOn:
    - {{ CLOUDRUN_TYPE_PROVIDER }}
  properties:
    spec:
      serviceAccountName: $(ref.{{ CLOUDRUN_SERVICE_ACCOUNT }}.email)
      containerConcurrency: 5
      timeoutSeconds: 10
      containers:
      - image: marketplace.gcr.io/google/nginx1
        env:
        - name: NGINX_HOST
          value: example.com
        resources:
          limits:
            memory: 128Mi
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/run.invoker
        members:
        - {{ CLOUDRUN_INVOKER }}

- name: {{ CLOUDRUN_SERVICE_ACCOUNT }}
  type: iam.v1.serviceAccount
  properties:
    accountId: {{ CLOUDRUN_SERVICE_ACCOUNT }}
    displayName: Service account for {{ CLOUDRUN_SERVICE }}

Yep, although it's possible to do Docker even in Terraform:
https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs/resources/image#build
(but we're actually using https://github.com/GoogleContainerTools/kaniko for it via separate Cloud Build steps, which works nicely).