[dlotterman]

Adds a top-level NLB section next to ALB for the Network Load Balancer early access, plus a DNS page. It also updates the existing pages that still said raw TCP and UDP exposure isn't available. This supersedes #149.

New pages

• nlb/:
  • overview, which includes a comparison of NLB and ALB and a diagram
  • listeners and routes, addresses and hostnames, health checks, traffic handling
  • operations, which walks through preparing a backend, creating an NLB, and connecting to it
  • observability, troubleshooting, limits and quotas, limitations and roadmap
• domain-dns/point-to-nlb.mdx: CNAME/ALIAS records to an NLB hostname with Datum DNS.

Changes to existing pages

• Removes the "raw TCP and UDP exposure isn't available" claims from the ALB, Compute, and gVPC pages.
• Adds NLB to:
  • the platform pages (isolation, zero trust, Galactic, Kubernetes, Envoy, roadmap)
  • the home page product cards
  • the Compute glossary
  • the guides index
• Network services: adds UDP ports and NLB routes, and notes that deleting a network service doesn't check for NLB routes.
• Changelog: the NLB entries now link to the new section. The October 30 entry said IPv4 is available. Production refuses it, so the entry now says IPv4 isn't available yet.

How this was checked

Each behavior the pages describe was tested against production NLBs in throwaway projects, which are deleted:

• status conditions and their exact messages
• every UnsupportedCapability error
• quotas: 5 NLBs and 25 routes per project
• health check timing and how a backend leaves and rejoins rotation
• per-flow hashing
• the client source address that the backend sees
• the 1392-byte UDP payload limit
• DNS publishing and withdrawal
• delete ordering

The operations steps for preparing a backend, creating an NLB, and connecting were then followed word for word in a fresh project.

mint broken-links --check-anchors finds no broken links in the new or changed pages. It still flags three #find-the-clients-ip-address links in alb/request-handling.mdx and guides/alb-as-httpd.mdx, which are already broken on main and untouched here.

Worth confirming before merge

• Same-location connections. A Compute Instance can't reach an NLB address in its own location; from another location it works. The docs state this as a limitation. Is it intended?
• withdrawalPending. It is true on healthy, serving addresses. The docs describe it as for Datum's own use.
• The BackendClaimConflict message. It mentions "Galactic", an internal name: Galactic cannot return traffic to two NLB VIPs on one socket.
• No datumctl nlb. The docs use manifests and the Cloud Portal only. network-services-operator#757 merged into codex/nlb-plugin-base, which isn't on main, and no PR is open to merge it.
• Portal steps. They're written from the portal code (network-services-operator#812, #890) and haven't been checked in a browser. There are no screenshots yet.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Datum	🟢 Ready	View Preview	Nov 11, 2026, 1:52 AM

💡 Tip: Enable Automations to automatically generate PRs for you.