NGINXaaS: add managed public endpoint docs (#1860)

Co-authored-by: Valyria McFarland <v.mcfarland@f5.com>

Author: travisamartin

content/nginxaas-google/changelog.md

@@ -12,6 +12,16 @@ Learn about the latest updates, new features, and resolved bugs in F5 NGINXaaS f
 
 To see a list of currently active issues, visit the [Known issues]({{< ref "/nginxaas-google/known-issues.md" >}}) page.
 
+## April 16, 2026
+
+- {{% icon-feature %}} **NGINXaaS for Google now supports Managed Public Endpoint deployments (Preview)**
+
+You can now deploy NGINXaaS with an internet-facing managed public endpoint. Unlike private endpoint deployments, which require Private Service Connect (PSC) in your Google Cloud project, managed public endpoints provide a publicly resolvable, unique DNS name you can use to route traffic directly to your deployment over the internet.
+
+**Note:** This feature is currently in preview; pricing may change.
+
+See the [Service Frontend]({{< ref "/nginxaas-google/overview.md#service-frontend" >}}) documentation for more information about managed public endpoint.
+
 ## February 11, 2026
 
 - {{% icon-feature %}} **NGINXaaS for Google is now generally available in more regions**

content/nginxaas-google/getting-started/create-deployment/deploy-console.md

@@ -60,10 +60,12 @@ Next, create a new NGINXaaS deployment using the NGINXaaS Console:
    - Add an optional description for your deployment.
    - Change the **NCU Capacity** if needed.
       - The default value of `20 NCU` should be adequate for most scenarios.
-   - In the Cloud Details section, enter the network attachment ID that [you created earlier](#create-a-network-attachment) or select it in the  **Network attachment** list.
-      - The network attachment ID is formatted like the following example: `projects/my-google-project/regions/us-east1/networkAttachments/my-network-attachment`.
    - In the Apply Configuration section, select an NGINX configuration [you created earlier](#create-or-import-an-nginx-configuration) from the **Choose Configuration** list.
    - Select a **Configuration Version** from the list.
+   - In the Cloud Details section, enter the network attachment ID that [you created earlier](#create-a-network-attachment) or select it in the  **Network attachment** list.
+      - The network attachment ID is formatted like the following example: `projects/my-google-project/regions/us-east1/networkAttachments/my-network-attachment`.
+   - Select **Managed Public Endpoint** or **Private Endpoint** under Service Frontend. 
+      - Refer to the [Service Frontend]({{< ref "/nginxaas-google/overview.md#service-frontend" >}}) documentation for more information on these two frontend types.
    - Select **Submit** to begin the deployment process.
 
 Your new deployment will appear in the list of deployments. The status of the deployment will be "Pending" while the deployment is being created. Once the deployment is complete, the status will change to "Ready".
@@ -83,17 +85,31 @@ In the NGINXaaS Console,
 1. Select **Update Configuration** to change the NGINX configuration associated with the deployment.
 1. To modify the contents of the NGINX configuration, see [Update an NGINX Configuration]({{< ref "/nginxaas-google/getting-started/nginx-configuration/nginx-configuration-console.md#update-an-nginx-configuration" >}}).
 
-## Set up connectivity to your deployment
+## Set up connectivity (Private Endpoint only)
 
-To set up connectivity to your NGINXaaS deployment, you will need to configure a [Private Service Connect backend](https://cloud.google.com/vpc/docs/private-service-connect-backends).
+If you selected **Private Endpoint** as the service frontend type, complete the following steps to allow client access. If you selected **Managed Public Endpoint**, skip this section.**
 
-1. Access the [Google Cloud Console](https://console.cloud.google.com/) and select the project where your networking resources for connecting to your F5 NGINXaaS deployment should be created.
+### Internal traffic
+
+To set up private connectivity to your NGINXaaS deployment, create a [Private Service Connect (PSC) endpoint](https://docs.cloud.google.com/vpc/docs/configure-private-service-connect-services) in the same VPC as your internal clients.
+
+1. Go to the [Google Cloud Console](https://console.cloud.google.com/) and select the project where you want to create networking resources for your F5 NGINXaaS deployment.
+1. Create or reuse a [VPC network](https://cloud.google.com/vpc/docs/create-modify-vpc-networks).
+1. Create a PSC endpoint. See [Google's documentation on creating an endpoint](https://docs.cloud.google.com/vpc/docs/configure-private-service-connect-services#create-endpoint) for a step-by-step guide.
+    - For **Target service**, enter your NGINXaaS deployment's Service Attachment, which is visible on the `Deployment Details` section for your deployment.
+
+
+### External traffic
+
+To set up public connectivity for external clients, configure a [Private Service Connect (PSC) backend](https://cloud.google.com/vpc/docs/private-service-connect-backends) for your NGINXaaS deployment.
+
+1. Go to the [Google Cloud Console](https://console.cloud.google.com/) and select the project where you want to create networking resources for your F5 NGINXaaS deployment.
 1. Create or reuse a [VPC network](https://cloud.google.com/vpc/docs/create-modify-vpc-networks).
 1. Create a proxy-only subnet in your consumer VPC. See [Google's documentation on creating a proxy-only subnet](https://cloud.google.com/load-balancing/docs/tcp/set-up-ext-reg-tcp-proxy-zonal#console_1) for a step-by-step guide.
 1. Create a public IP address. See [Google's documentation on reserving a static address](https://cloud.google.com/load-balancing/docs/tcp/set-up-ext-reg-tcp-proxy-zonal#console_3) for a step-by-step guide.
 1. Create a Private Service Connect Network Endpoint Group (PSC NEG). See [Google's documentation on creating a NEG](https://cloud.google.com/vpc/docs/access-apis-managed-services-private-service-connect-backends#console) for a step-by-step guide.
    - Set **Network endpoint group type** to **Private Service Connect NEG (Regional)**.
-   - Set **Taget** to **Published service**.
+   - Set **Target** to **Published service**.
    - For **Target service**, enter your NGINXaaS deployment's Service Attachment, which is visible on the `Deployment Details` section for your deployment.
    - For **Producer port**, enter the port your NGINX server is listening on. If you're using the default NGINX config, enter port `80`.
    - For **Network** and **Subnetwork** select your consumer VPC network and subnet.
@@ -281,16 +297,14 @@ Each listening port configured on NGINX requires its own PSC network endpoint gr
 
 ## Test your deployment
 
-1. To test your deployment, go to the IP address created in [Set up connectivity to your deployment]({{< ref "/nginxaas-google/getting-started/create-deployment/deploy-console.md#set-up-connectivity-to-your-deployment" >}}) using your favorite web browser.
+1. To test your deployment, connect to the IP address created in [Set up connectivity]({{< ref "/nginxaas-google/getting-started/create-deployment/deploy-console.md#set-up-connectivity-private-endpoint-only" >}}) or the service endpoint created with your managed public endpoint deployment.
 
 {{< call-out "note" >}}
 
 The deployment is privately deployed in your subnet. If you want to route traffic to an application over the public internet, consider setting up [Cloud NAT](https://docs.cloud.google.com/nat/docs/overview).
 
 {{< /call-out >}}
 
-
-
 ## What's next
 
 [Manage your NGINXaaS users]({{< ref "/nginxaas-google/getting-started/manage-users-organizations.md" >}})

content/nginxaas-google/overview.md

@@ -37,20 +37,55 @@ The key capabilities of NGINXaaS for Google Cloud are:
 - NGINXaaS can route traffic to upstreams even if the upstream servers are located in different geographies. See [Known Issues]({{< ref "/nginxaas-google/known-issues.md" >}}) for any networking restrictions.
 - NGINXaaS supports request tracing. See the [Application Performance Management with NGINX Variables](https://www.f5.com/company/blog/nginx/application-tracing-nginx-plus) blog to learn more about tracing.
 - Supports HTTP to HTTPS, HTTPS to HTTP, and HTTP to HTTP redirects. NGINXaaS also provides the ability to create new rules for redirecting. See [How to Create NGINX Rewrite Rules | NGINX](https://blog.nginx.org/blog/creating-nginx-rewrite-rules) for more details.
-- Google Cloud's Private Service Connect (PSC) enables clients within your Virtual Private Cloud (VPC) to access your NGINXaaS deployments. PSC also provides NGINXaaS a secure and private way to connect to your upstream applications. Known networking limitations can be found in the [Known Issues]({{< ref "/nginxaas-google/known-issues.md" >}}).
 
-### Geographical Controllers
+### Service Frontend
 
-NGINXaaS for Google has a global presence with management requests being served from various geographical controllers. A Geographical Controller (GC) is a control plane that serves users in a given geographical boundary while taking into account concerns relating to data residency and localization. Example: A US geographical controller serves US customers. We currently have presence in three Geographies: **US**, **EU**, and **Asia Pacific (APAC)**.
+The service frontend of an NGINXaaS deployment controls how client ingress traffic reaches your deployment. There are two frontend types: managed public endpoint and private endpoint.
 
-## Supported regions
+#### Managed Public Endpoint
 
-{{< include "/nginxaas-google/supported-regions.md" >}}
+A managed public endpoint frontend allows client access over the internet through a public DNS name created by NGINXaaS in its network.
+
+**This frontend type is suitable for:**
+
+- Serving public web applications to end users over the internet
+- Proxying traffic from clients outside Google Cloud
+- Testing NGINXaaS configurations before you set up a [Private Endpoint]({{< ref "/nginxaas-google/overview.md#private-endpoint" >}}) frontend
+
+**Access control**
+
+Access control list (ACL) rules control traffic to a managed public endpoint deployment. If you don’t provide ACL rules, no traffic is allowed. An ACL rule includes the following settings:
+
+- **Source prefixes**: A list of CIDR blocks to allow traffic from
+    - Use `0.0.0.0/0` to allow traffic from all source IP addresses
+- **Protocol**: The network protocol to allow
+    - Valid values are **TCP** and **UDP**
+    - Required when you specify a port range
+- **Port range**: A single port or port range to allow traffic from
+    - If you don’t specify a port range, traffic is allowed from any port
+    - Required when you specify a protocol
+
+#### Private Endpoint
+
+A private endpoint frontend allows client access through your network by using Google’s [Private Service Connect (PSC)](https://cloud.google.com/vpc/docs/private-service-connect). To set up connectivity, create either a [PSC endpoint](https://docs.cloud.google.com/vpc/docs/private-service-connect#endpoints) for internal traffic or a [PSC backend](https://cloud.google.com/vpc/docs/private-service-connect#backends) for external traffic. This approach brings the NGINXaaS deployment into your client network through an NGINXaaS-created service attachment, so application clients can connect directly into your network. For step-by-step instructions, see [Set up connectivity]({{< ref "/nginxaas-google/getting-started/create-deployment/deploy-console.md#set-up-connectivity-private-endpoint-only" >}}).
+
+**This frontend type is suitable for:**
 
-### Networking
+- Situations where you need greater control over traffic to the NGINXaaS deployment
+- Environments where all clients exist within your Google Cloud network
+- Internal services that shouldn't be exposed to the internet
 
-We use Google [Private Service Connect]((https://cloud.google.com/vpc/docs/private-service-connect)) (PSC) to securely connect NGINXaaS to your applications and enable client access to your deployments. A [PSC backend](https://cloud.google.com/vpc/docs/private-service-connect#backends) brings the NGINXaaS deployment into your client network, allowing your application clients to connect seamlessly. A [PSC Interface](https://cloud.google.com/vpc/docs/private-service-connect#interfaces) brings the deployment into your application network, enabling secure connectivity to your applications. This approach gives you full control over traffic flow by leveraging your own networking resources, so you can apply your preferred security controls and ensure a secure deployment environment.
+**Access control**
 
+A service attachment accept list restricts which Google project IDs can connect to the deployment. If you don’t specify any project IDs in the accept list, traffic from all projects is allowed.
+
+### Upstream network
+
+NGINXaaS uses Google [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC) to connect securely to your applications.
+
+A [PSC interface](https://cloud.google.com/vpc/docs/private-service-connect#interfaces) brings the deployment into your application network and supports secure connectivity to your applications. By using your own networking resources, you control traffic flow and can apply your preferred security controls.
+
+To connect the NGINXaaS PSC interface to your network, you must create a [network attachment](https://cloud.google.com/vpc/docs/about-network-attachments). For steps, see {{< ref "/nginxaas-google/getting-started/create-deployment/deploy-console.md#create-a-network-attachment" >}}.
 
 #### Connection draining
 
@@ -61,6 +96,13 @@ During scaling, some connections older than 60 seconds might be reset. The servi
 An NGINX Capacity Unit (NCU) quantifies the capacity of an NGINX deployment based on its underlying compute resources. This abstraction lets you specify capacity in NCUs without considering hardware differences between regions.
 You can reserve a minimum capacity for your deployment. The deployment automatically scales up or down based on traffic demand and makes sure it never drops below the reserved minimum.
 
+### Geographical Controllers
+
+NGINXaaS for Google has a global presence, with management requests served by regional controllers. A geographical controller (GC) is a control plane that serves users within a defined geographic boundary while addressing data residency and localization requirements. For example, a US geographical controller serves customers in the United States. NGINXaaS currently operates in three geographies: US, EU, and Asia Pacific (APAC).
+
+### Supported regions
+
+{{< include "/nginxaas-google/supported-regions.md" >}}
 
 ## Current Limitations