Network sharing
Networks are normally project-isolated — a network in project acme-prod is invisible to acme-staging. Network sharing punches a controlled hole in that isolation: the owner project shares a specific network with a specific other project (in the same workspace), and the receiving project can attach VMs to the shared network as if it were their own.
Use cases: a shared services network (databases, caches, internal APIs) that several application projects need to reach. The alternative is exposing the services on public IPs and re-securing them at L7 — possible, but more complex than sharing the L2 segment within the trust boundary of a workspace.
Cross-workspace sharing isn't possible — that's a deliberate isolation boundary.
What's next
- Networks — the resource that gets shared.
- Workspaces — the boundary of sharing.
- Security groups — what filters traffic on a shared network.