move GCP external API ALB into gcp-host as a first-class option.

[eschultink]

Fixes

• alb example ONLY works with fixed ips

Features

• Replace root external-api-alb.tf composition with gcp-external-api-alb invoked from gcp-host via external_api_alb, keeping BYO host support and optional Cloud Armor when IP blocks are set.

Change implications

• dependencies added/changed? yes — enabling the ALB (self-signed PoC path) may pull hashicorp/tls into the root provider lockfile (gcp-host requires tls >= 4.0)
• something important to note in future release notes? yes — if you initially applied the old root external-api-alb.tf composition, destroy those root ALB resources or terraform state mv into the new gcp-host / gcp-external-api-alb addresses before upgrading (see docs/development/gcp-external-alb.md and CHANGELOG)

[Copilot]

Pull request overview

This PR makes GCP external API ingress via a global external Application Load Balancer (ALB) a first-class option of gcp-host, replacing the prior root-level example composition, while keeping bring-your-own (BYO) ALB support and making Cloud Armor optional (driven by allowed_data_access_ip_blocks when non-null).

Changes:

• Add external_api_alb to gcp-host to provision a global external ALB (managed TLS with domain, or self-signed PoC on a reserved global IP).
• Introduce new infra/modules/gcp-external-api-alb module (ALB + optional Cloud Armor + TLS plumbing) and wire it from gcp-host.
• Update examples and documentation to reflect the new first-class ALB option and migration away from the old external-api-alb.tf example.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
infra/modules/gcp-proxy-api/variables.tf	Clarifies when ingress_settings is driven by effective external ALB host.
infra/modules/gcp-host/variables.tf	Adds external_api_alb input and updates BYO ALB variable docs.
infra/modules/gcp-host/README.md	Documents optional beta ingress via provisioned or BYO external ALB.
infra/modules/gcp-host/output.tf	Adds outputs for provisioned ALB IP/DNS/self-signed cert and effective LB host.
infra/modules/gcp-host/main.tf	Reserves global IP, computes effective LB host, invokes new ALB module, adds XOR check, and adds tls provider requirement.
infra/modules/gcp-external-api-alb/variables.tf	New module inputs for ALB provisioning (domain, global IP, connector service names, allowlist).
infra/modules/gcp-external-api-alb/README.md	New module documentation and usage context.
infra/modules/gcp-external-api-alb/outputs.tf	New module outputs for host/IP, DNS instructions, and self-signed cert PEM.
infra/modules/gcp-external-api-alb/main.tf	New ALB implementation (NEGs, backend services, URL map, TLS via managed cert or self-signed, optional Cloud Armor).
infra/examples-dev/gcp/variables.tf	Adds external_api_alb example input and clarifies allowlist behavior with ALB.
infra/examples-dev/gcp/main.tf	Wires external_api_alb into the example and adds ALB-related outputs.
infra/examples-dev/gcp/external-api-alb.tf	Removes old root composition example for external ALB.
docs/guides/psoxy-test-tool.md	Updates testing guidance for ALB usage and allowlisting behavior.
docs/gcp/vpc.md	Updates ingress documentation reference to external_api_alb.
docs/development/gcp-private-service-connect.md	Updates Cloud Armor ingress guidance to new first-class option (and BYO).
docs/development/gcp-external-alb.md	Rewrites approach docs for gcp-host first-class ALB and migration guidance.
docs/configuration/ip-allowlisting.md	Updates allowlisting docs to reflect external_api_alb behavior and BYO ALB option.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[eschultink]

as these all related, may must succicnet to group into a single output object?