[release-4.4] docs: externalize NetObserv docs and update Kube-OVN guidance

docs/en/networking/how_to/kube_ovn/configure_egress_gateway.mdx

@@ -106,6 +106,11 @@ Before creating the gateway, prepare the following resources:
 - An external subnet
 - A Network Attachment Definition (NAD) for that subnet
 
+:::note
+  The NetworkAttachmentDefinition name MUST NOT contain a dot (`.`).
+  Each NetworkAttachmentDefinition can be used by only one subnet. Do not reuse the same NetworkAttachmentDefinition across multiple subnets.
+:::
+
 The following example uses a Kube-OVN underlay subnet as the external network.
 
 :::note
@@ -428,6 +433,50 @@ Routing Policies
      29000            ip4.src == $subnet1.kube.ovn.worker_ip4  reroute  100.64.0.4
 ```
 
+### Optional: Configure Bandwidth Limits
+
+To limit the bandwidth of selected namespaces or workloads, set _.spec.bandwidth.ingress_ and _.spec.bandwidth.egress_.
+Each field accepts one of the following formats:
+
+- A non-negative integer or numeric string, interpreted as Mbps. For example, `2000` and `"2000"` both mean 2000 Mbps.
+- A Kubernetes quantity string with the `M`, `Mi`, `G`, or `Gi` suffix, interpreted as bits per second. Decimal values are supported when a suffix is present. The value is rounded up to the nearest whole Mbps. For example, `1Gi` becomes 1074 Mbps.
+
+Omit a field or set it to `0` to leave that direction unlimited. The limits apply to each gateway instance.
+
+:::note
+  If _.spec.replicas_ is greater than 1, each replica gets the configured limit.
+  Quantity strings require a VPC Egress Gateway CRD and controller version that supports them. During a rolling upgrade, continue to use integer Mbps values until the Kube-OVN upgrade is complete.
+:::
+
+The following example limits the selected namespaces to 2 Gbps ingress bandwidth and 4 Gbps egress bandwidth:
+
+```yaml
+apiVersion: kubeovn.io/v1
+kind: VpcEgressGateway
+metadata:
+  name: gateway-bandwidth
+  namespace: default
+spec:
+  replicas: 1
+  internalSubnet: ovn-default
+  externalSubnet: underlay-ext
+  externalIPs:
+    - 172.17.0.21
+  bandwidth:
+    ingress: 2G
+    egress: 4G
+  selectors:
+    - namespaceSelector:
+        matchExpressions:
+          - key: kubernetes.io/metadata.name
+            operator: In
+            values:
+              - ecommerce
+              - ecommerce-test
+```
+
+In this example, the direction is relative to the selected namespaces or workloads: `ingress` limits traffic from the external network to them, and `egress` limits traffic from them to the external network.
+
 ### Optional: Enable BFD-based High Availability
 
 BFD-based failover depends on the VPC BFD LRP.

docs/en/networking/how_to/kube_ovn/multiple_networks.mdx

@@ -46,6 +46,9 @@ Example: `network-attachment-definition.yml`
 :::note
 The provider format in config is `<NAME>.<NAMESPACE>.ovn`, where `<NAME>` and `<NAMESPACE>` are the name and namespace of this NetworkAttachmentDefinition CR respectively.
 
+The NetworkAttachmentDefinition name MUST NOT contain a dot (`.`).
+Each NetworkAttachmentDefinition can be used by only one subnet. Do not reuse the same NetworkAttachmentDefinition across multiple subnets.
+
 If you use an underlay secondary network, set `spec.vlan` in the Subnet to the target VLAN CR name.
 :::
 

docs/en/networking/observability/index.mdx

@@ -4,4 +4,6 @@ weight: 70
 
 # Network Observability
 
-<Overview />
+Network Observability provides continuous cluster-wide network flow collection and on-demand packet or flow capture for troubleshooting. It uses eBPF to inspect traffic behavior, identify performance issues, and investigate connectivity problems between workloads.
+
+<ExternalSite name="network-observability-operator" />