{"slug":"networking-peering","title":"Network Peering","description":"Network Peering connects two teams that you own so that resources in either team's namespace can reach each other over the cluster network — without going through the public internet.","section":"Features","url":"https://docs.danubedata.ro/networking-peering","markdown_url":"https://docs.danubedata.ro/networking-peering.md","breadcrumbs":[{"title":"Features","slug":null},{"title":"Networking","slug":"networking-overview"},{"title":"Network Peering","slug":"networking-peering"}],"headings":[{"level":1,"title":"Network Peering","id":"network-peering"},{"level":2,"title":"How it works","id":"how-it-works"},{"level":2,"title":"Requirements","id":"requirements"},{"level":2,"title":"Create a peering","id":"create-a-peering"},{"level":2,"title":"Use the peering","id":"use-the-peering"},{"level":2,"title":"Remove a peering","id":"remove-a-peering"},{"level":2,"title":"Limitations and notes","id":"limitations-and-notes"},{"level":2,"title":"Troubleshooting","id":"troubleshooting"},{"level":2,"title":"Related Documentation","id":"related-documentation"}],"format":"markdown","word_count":710,"content":"# Network Peering\n\nNetwork Peering connects two teams that you own so that resources in either team's namespace can reach each other over the cluster network — without going through the public internet.\n\nA common use case is connecting a **staging** team to a **production** team for read-only data sync, or connecting a shared **services** team (e.g. a central observability stack) to one or more application teams.\n\n## How it works\n\nEach team has its own Kubernetes namespace and is isolated by default — pods in one team cannot reach pods in another. A peering establishes bidirectional Cilium network policies between the two namespaces:\n\n- After peering, every pod in team A can reach every pod in team B and vice versa\n- Internal DNS works across the peering (resolve services by their short names from either side)\n- Traffic stays inside the cluster — it does not touch the public internet\n- The firewalls attached to individual instances still apply on top — peering opens the cluster path; per-instance rules decide what listens\n\n## Requirements\n\n- You must **own both teams** (the same user account must be the team owner on each side)\n- Each team must already have a tenant namespace provisioned (the default for any team that has created at least one resource)\n- A given pair of teams can only be peered once\n\n## Create a peering\n\n1. Switch into the team you want to peer **from** (top-right team switcher)\n2. Open **Networking** from the main menu\n3. Scroll to **Network Peering**\n4. Pick the peer team from the dropdown — only teams you own that aren't already peered will be listed\n5. Click **Create Peering**\n\nThe peering moves through `pending` → `deploying` → `active`. Deployment usually takes 10–30 seconds while the policies are committed and synced into the cluster.\n\n## Use the peering\n\nOnce active, resources in either team can reach the other side using the peer's internal DNS names. The fully-qualified form is:\n\n```\n<service-name>.<peer-team-namespace>.svc.cluster.local\n```\n\nFor example, from a VPS in team `app-prod`, to reach a Postgres database named `db-orders` in team `data-shared`:\n\n```bash\npsql -h db-orders.tenant-data-shared.svc.cluster.local -U appuser -d orders\n```\n\nYou can find the exact namespace name on the peer team's [Networking page](https://docs.danubedata.ro/networking-overview).\n\n## Remove a peering\n\n1. Open **Networking** in either of the peered teams\n2. Find the peering row in the **Network Peering** table\n3. Click the trash icon and confirm\n\nBoth directions are torn down together. The status briefly shows `removing` while the policies are cleaned up.\n\n## Limitations and notes\n\n- Peering is **all-or-nothing** at the namespace level: every pod in one team can reach every pod in the other. There is no per-service or per-port granularity in the peering itself — use per-instance firewall rules to restrict what each service exposes.\n- Peering does **not** cross teams owned by different users. There is no cross-account peering today.\n- Peering does **not** create new IP addresses or NICs. Your resources continue to use their existing internal cluster IPs.\n- A peering does **not** count against any resource quota and is **not** billed separately.\n- Tearing down a peering immediately drops in-flight connections that depended on it.\n\n## Troubleshooting\n\n**The peer team I want isn't in the dropdown**\n\nThe dropdown only shows teams owned by your account that aren't already peered with the current team. Check that the team is owned by the same user (not just one you're a member of), and that no peering already exists between the two.\n\n**Peering is stuck in `pending` or `deploying`**\n\nDeployment normally completes within 30 seconds. If it hasn't moved after a few minutes, contact support — there may be a sync issue with the underlying GitOps reconciliation.\n\n**I can resolve the peer's hostname but the connection times out**\n\nThe peering opens cluster-level connectivity, but the target instance may still have a firewall blocking the source. On the target instance's **Firewall** tab, add an inbound rule with the source set to the calling instance (you can pick instances across peered teams — they appear in the instance picker once peering is active). See [Firewalls — east-west traffic](https://docs.danubedata.ro/networking-firewalls) for the worked example.\n\n## Related Documentation\n\n- [Networking Overview](https://docs.danubedata.ro/networking-overview)\n- [Firewalls](https://docs.danubedata.ro/networking-firewalls)\n- [Private Networks (status)](https://docs.danubedata.ro/networking-private)\n- [Projects (Teams)](https://docs.danubedata.ro/account-projects)\n","prev":{"title":"Private Networks","slug":"networking-private","url":"https://docs.danubedata.ro/networking-private","markdown_url":"https://docs.danubedata.ro/networking-private.md","json_url":"https://docs.danubedata.ro/networking-private.json"},"next":{"title":"Custom Domains & DNS","slug":"custom-domains","url":"https://docs.danubedata.ro/custom-domains","markdown_url":"https://docs.danubedata.ro/custom-domains.md","json_url":"https://docs.danubedata.ro/custom-domains.json"},"index_url":"https://docs.danubedata.ro/index.json"}