<p>I have my hyperledger fabric blockchain deployed on k8s in the <strong>namespace: hlf-blockchain</strong> and my client app is deployed is in another <strong>namespace: hlf-app</strong></p>
<p>The cpp-profile template is below. url-&gt; <em><code>grpcs://&lt;service-name&gt;.&lt;namespace&gt;:&lt;port&gt;</code></em> which enables cross namespace communication.</p>
<pre><code>{
    &quot;name&quot;: &quot;test-network&quot;,
    &quot;version&quot;: &quot;1.0.0&quot;,
    &quot;client&quot;: {
        &quot;organization&quot;: &quot;MyOrg&quot;,
        &quot;connection&quot;: {
            &quot;timeout&quot;: {
                &quot;peer&quot;: {
                    &quot;endorser&quot;: &quot;10000&quot;
                }
            }
        }
    },
    &quot;organizations&quot;: {
        &quot;TboxOrg&quot;: {
            &quot;mspid&quot;: &quot;MyOrg&quot;,
            &quot;peers&quot;: [
                &quot;peer0&quot;,
                &quot;peer1&quot;,
                &quot;peer2&quot;
                ],
            &quot;certificateAuthorities&quot;: [
                &quot;ca-myorg&quot;
            ]
        }
    },
    &quot;peers&quot;: {
        &quot;peer0&quot;: {
            &quot;url&quot;: &quot;grpcs://peer0.hlf-blockchain:${P0PORT}&quot;,
            &quot;tlsCACerts&quot;: {
                &quot;pem&quot;: &quot;${PEERPEM}&quot;
            },
            &quot;grpcOptions&quot;: {
                &quot;ssl-target-name-override&quot;: &quot;peer0&quot;,
                &quot;hostnameOverride&quot;: &quot;peer0&quot;,
                &quot;request-timeout&quot;: 10000,
                &quot;grpc.keepalive_time_ms&quot;: 60000
            }
        },
        &quot;peer1&quot;: {
            &quot;url&quot;: &quot;grpcs://peer1.hlf-blockchain:${P1PORT}&quot;,
            &quot;tlsCACerts&quot;: {
                &quot;pem&quot;: &quot;${PEERPEM}&quot;
            },
            &quot;grpcOptions&quot;: {
                &quot;ssl-target-name-override&quot;: &quot;peer1&quot;,
                &quot;hostnameOverride&quot;: &quot;peer1&quot;,
                &quot;request-timeout&quot;: 10000,
                &quot;grpc.keepalive_time_ms&quot;: 60000
            }
        },
        &quot;peer2-tbox&quot;: {
            &quot;url&quot;: &quot;grpcs://peer2.hlf-blockchain:${P2PORT}&quot;,
            &quot;tlsCACerts&quot;: {
                &quot;pem&quot;: &quot;${PEERPEM}&quot;
            },
            &quot;grpcOptions&quot;: {
                &quot;ssl-target-name-override&quot;: &quot;peer2&quot;,
                &quot;hostnameOverride&quot;: &quot;peer2&quot;,
                &quot;request-timeout&quot;: 10000,
                &quot;grpc.keepalive_time_ms&quot;: 60000
            }
        }
    },
    &quot;certificateAuthorities&quot;: {
        &quot;ca-tboxorg&quot;: {
            &quot;url&quot;: &quot;https://ca-myorg.hlf-blockchain:${CAPORT}&quot;,
            &quot;caName&quot;: &quot;ca-myorg&quot;,
            &quot;tlsCACerts&quot;: {
                &quot;pem&quot;: [&quot;${CAPEM}&quot;]
            },
            &quot;httpOptions&quot;: {
                &quot;verify&quot;: false
            }
        }
    }
}
</code></pre>
<p>From my client-app using <strong>fabrid-sdk-go</strong> I am able to connect to the network using the gateway. While invoking the chaincode I am getting the following error:</p>
<pre><code>Endorser Client Status Code: (2) CONNECTION_FAILED. Description: dialing connection on target [peer0:7051]: connection is in TRANSIENT_FAILURE\nTransaction processing for endorser
</code></pre>
<p>I am able to invoke the transactions using cli command from the same <strong>namespace: hfl-blockchain</strong></p>
<p>My <strong>peer service configuration</strong>:</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: peer0
  labels:
    app: peer0
spec:
  selector:
    name: peer0
  type: ClusterIP
  ports:
    - name: grpc
      port: 7051
      protocol: TCP
    - name: event
      port: 7061
      protocol: TCP
    - name: couchdb
      port: 5984
      protocol: TCP
</code></pre>
<p>I believe this error is due to communication error between different namespace, which the client apps gets from the cpp-profile.</p>
<p>What's the correct way to configure the peer service or the cpp connection profile?</p>

<p>You are correct, the discovery service is returning network URLs that are unreachable from the <code>hlf-blockchain</code> namespace.</p>
<p>It is possible to run a Gateway client in a different namespace from the Fabric network.  If you are using Kube DNS, each
of the fabric nodes can be referenced with a fully qualified host name <code>&lt;service-name&gt;.&lt;namespace&gt;.svc.cluster.local</code>.</p>
<p>In order to connect a gateway client across namespaces, you will need to introduce the .svc.cluster.local
Fully Qualified Domain Name to the fabric URLs returned by discovery:</p>
<ul>
<li><p>In your TLS CA enrollments, make sure that the certificate signing requests include a valid Subject Alternate Name
with the FQDN.  For example, if your peer0 TLS certificate is only valid for the host <code>peer0</code>, then the grpcs://
connection will be rejected in the TLS handshake when connecting to grpcs://peer0.hlf-blockchain.svc.cluster.local.</p>
</li>
<li><p>In the Gateway Client Connection Profile, use the FQDN when connecting to the discovery peers.  In addition
to the peer <code>url</code> attribute, make sure to address host names in the <code>grpcOptions</code> stanzas.</p>
</li>
<li><p>Discovery will return the peer host names as specified in the core.yaml <code>peer.gossip.externalendpoint</code>
(<code>CORE_PEER_GOSSIP_EXTERNALENDPOINT</code> env) parameter.  Make sure that this specifies the FQDN for all peers
visible to discovery.</p>
</li>
<li><p>Discovery will return the orderer host names as specified in the configtx.yaml organization <code>OrdererEndpoints</code> stanza.
Make sure that these URLs specify the FQDN for all orderers.</p>
</li>
</ul>
<p>Regarding the general networking, make sure to double-check that the gateway client application has visibility and a
network route to the pods running fabric services in a different namespace.  Depending on your Calico   configuration
and Kube permissions, it's possible that traffic is getting blocked before it ever reaches the Fabric services.</p>
