경우에 따라 정의된 IP 범위의 호출을 허용 목록에 추가하는 서비스를 호출하는 경우와 같이 비공개 풀의 정적 IP 범위가 정의되어 있어야 할 수 있습니다. 비공개 풀을 사용하면 VPC 네트워크와 비공개 풀의 VPC 네트워크 간에 비공개 연결을 설정할 때 비공개 풀이 실행될 정의된 CIDR IP 범위를 사용하여 할당된 IP 주소 범위를 만들 수 있습니다. 또한 비공개 풀이 사용할 할당된 IP 주소 범위 내에 더 작은 CIDR 범위를 지정할 수도 있습니다.
VPC 네트워크에서 실행
VPC 네트워크와 같이 방화벽 뒤에 있는 비공개 네트워크의 리소스에서 Cloud Build를 사용하려면 비공개 풀과 관리형 VPC 네트워크 간에 비공개 연결을 만듭니다. 이렇게 하면 비공개 풀이 소스 저장소, 아티팩트 저장소, 데이터베이스, 보안 비밀 인스턴스, 런타임과 같은 비공개 네트워크의 리소스에 액세스할 수 있습니다.
공유 VPC 네트워크에서 실행
공유 VPC 네트워크를 사용하는 경우 비공개 풀을 만들 프로젝트가 공유 VPC 네트워크가 포함된 호스트 프로젝트에 연결되어 있어야 합니다. 프로젝트 연결에 대한 안내는 공유 VPC 네트워크 프로비저닝을 참조하세요.
다른 피어링된 VPC 네트워크 또는 공유 VPC 네트워크의 리소스에 연결
조직은 공유 VPC(호스트 프로젝트)를 채택하여 모든 프로젝트에서 네트워킹 및 Identity and Access Management를 중앙화하기도 합니다.
이렇게 하면 비공개 GKE 클러스터 및 비공개 Cloud SQL과 같은 Google 관리 서비스에 내부 IP 주소를 사용할 수 있습니다. 이러한 Google 관리 서비스도 고객 소유의 공유 VPC 네트워크에 피어링됩니다. 이 설정과 관련된 문제는 전환 피어링의 문제로 인해 비공개 풀이 Google 관리 서비스와 통신할 수 없다는 점에 있습니다. 전환 피어링은 여러 네트워크가 VPC 피어링을 통해 서로 연결된 경우에만 문제가 됩니다. 연결 중 하나가 VPC 피어링 대신 VPN(또는 상호 연결)을 사용하도록 변경되면 네트워크에서 연결을 설정할 수 있습니다. 이 네트워크 설정에 대한 안내는 Cloud Build 비공개 풀로 비공개 Google Kubernetes Engine 클러스터에 액세스를 참조하세요.
Cloud Build가 제공하는 constraints/cloudbuild.allowedWorkerPools조직 정책 제약조건을 사용하면 조직의 빌드가 기본 풀을 사용하지 않고 비공개 풀만 사용하도록 강제할 수 있습니다. 이 기능을 사용하는 방법은 조직 정책 제약조건 설정을 참조하세요.
비공개 Cloud DNS 영역과 함께 사용
비공개 풀과 함께 사용할 비공개 Cloud DNS 영역을 공유할 수 있습니다. 자세한 내용은 비공개 영역 공유를 참조하세요.
NAT 뒤에서 실행
VPC에서 비공개 풀의 IP 범위를 제어할 수 있지만 외부 IP 주소(사용 설정된 경우)를 제어할 수 없습니다.
예약된 IP에서 리소스에 액세스해야 하는 경우 Cloud Build를 사용하여 고정 소스 IP 주소에서 외부 리소스에 액세스의 단계를 완료하여 프록시 VM을 만들고 이를 통해 트래픽을 라우팅하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003ePrivate pools can be configured to use the default Virtual Private Cloud (VPC) network, which allows builds to access the public internet and utilize features like configurable machine types and static internal IP ranges.\u003c/p\u003e\n"],["\u003cp\u003eYou can define a static internal IP range for your private pool, enabling it to interact with services that require allowlisting calls from a defined IP range by setting up a private connection between the VPC network and the private pool's VPC network.\u003c/p\u003e\n"],["\u003cp\u003ePrivate pools can connect to resources within a private network, such as source repositories and databases, by creating a private connection between the pool and your managed VPC network.\u003c/p\u003e\n"],["\u003cp\u003eFor shared VPC networks, the project creating the private pool must be attached to the host project containing the shared VPC network, which is essential for centralized networking and Identity and Access Management across projects.\u003c/p\u003e\n"],["\u003cp\u003eEgress from private pools to the public internet can be restricted by removing public IPs, creating a VPC Service Controls perimeter, or customizing firewall rules on the VPC network, allowing to improve security.\u003c/p\u003e\n"]]],[],null,["# Using Cloud Build in a private network\n\nThis page explains how to configure commonly-used private network setups to use\nwith private pools. For an overview of private pools, see\n[Private pools overview](/build/docs/private-pools/private-pools-overview).\n\nDefining the default network settings\n-------------------------------------\n\nWhen you create a private pool, by default you're set up to use the Virtual Private Cloud\nnetwork in which the private pools reside. Use the default VPC\nnetwork if:\n\n- You want builds to access the public internet.\n- You want [configurable machine types and sizes](/build/docs/private-pools/private-pools-overview), static internal IP ranges, or one of the other features of [private pools](/build/docs/private-pools/private-pools-overview).\n- You are **not** looking for builds to access resources within your private VPC network.\n\nFor instructions on connecting to the default network, see\n[Creating a private pool](/build/docs/private-pools/create-manage-private-pools#creating_a_new_private_pool).\n\nDefining a static internal IP range\n-----------------------------------\n\nIn some cases, you may need to have a defined static IP range for your private\npool, such as when calling a service that allowlists calls from a defined\nIP range. With private pools, when setting up a\n[private connection between your VPC network and the private pool's VPC network](/build/docs/private-pools/set-up-private-pool-environment#setup-private-connection), you can create allocated IP\naddress ranges with a defined CIDR range of IPs that your private pools will run on. You can also specify a smaller CIDR range within an allocated IP address range that a private pool will use.\n\nRunning in a VPC network\n------------------------\n\nTo use Cloud Build with resources in a private network behind a firewall,\nsuch as in a VPC network, you can\n[create a private connection between the private pool and your managed VPC network](/build/docs/private-pools/set-up-private-pool-environment#setup-private-connection). This enables the private pool to access\nresources in your private network such as source repositories, artifact repositories,\ndatabases, secrets instances, and runtimes.\n\nRunning in a shared VPC network\n-------------------------------\n\nIf you're using a shared VPC network, the project where you're\ncreating the private pool must be attached to the host project that contains\nthe shared VPC network. For instructions on attaching a project,\nsee [Provisioning a shared VPC network](/vpc/docs/provisioning-shared-vpc#create-shared).\n\nConnecting to resources in another peered VPC network or shared VPC network\n---------------------------------------------------------------------------\n\nOrganizations often adopt a [shared VPC](/vpc/docs/shared-vpc)\n(host project) to centralize networking and Identity and Access Management across all the projects.\nThis allows internal IP addresses to be used for Google-managed services like\n[private GKE clusters](/kubernetes-engine/docs/how-to/cluster-shared-vpc#create_private_cluster)\nand [private Cloud SQL](/sql/docs/postgres/configure-private-ip). These\nGoogle-managed services are also peered into a customer-owned shared VPC\nnetwork. The issue with this setup is that private pools are not able to\ncommunicate with the Google-managed services due to the\n[lack of transitive peering](/vpc/docs/vpc-peering#transit-network). Transitive\npeering is only an issue when multiple networks are connected to one\nanother via VPC peering. If one of the connections is changed to\nuse a [VPN](/network-connectivity/docs/vpn/concepts/overview) (or\n[interconnect](/network-connectivity/docs/interconnect)) instead of VPC\npeering, then the networks can establish connectivity. For instructions on this\nnetwork setup, see\n[Accessing private Google Kubernetes Engine clusters with Cloud Build private pools](/build/docs/private-pools/accessing-private-gke-clusters-with-cloud-build-private-pools).\n\nRunning in a specific region\n----------------------------\n\nYou can create a private pool in one of the [supported regions](/build/docs/locations). You can store any built container images and artifacts in [Artifact Registry repositories](/artifact-registry/docs/configure-cloud-build)\nand [Cloud Storage buckets](/build/docs/building/store-build-artifacts)\nin specified regions.\n\nDeploying to private GKE clusters\n---------------------------------\n\nPrivate GKE clusters can have a public or private endpoint for\nthe control plane.\n\nTo deploy to a private GKE cluster with a public\nendpoint, you can [create your private pool in the default network with access to\nthe public internet](/build/docs/private-pools/create-manage-private-pools#creating_a_new_private_pool)\nand [define a static internal IP range](#static-ip-range) for your pool to allow list for access to the cluster.\n\nTo deploy to private GKE clusters with a private endpoint, you can\nfollow the steps described in [Accessing private Google Kubernetes Engine clusters with Cloud Build private pools](/build/docs/private-pools/accessing-private-gke-clusters-with-cloud-build-private-pools).\nAlternatively, once peered into your VPC, you can run a network\nproxy on the cluster as described in [Creating private GKE clusters with network proxies](/architecture/creating-kubernetes-engine-private-clusters-with-net-proxies).\n\nUsing with VPC Service Controls\n-------------------------------\n\nVPC Service Controls is a Google Cloud feature that allows you to set up a secure\nperimeter to guard against data exfiltration. For instructions on using VPC Service Controls\nwith private pools to add additional security to your builds,\nsee [Using VPC Service Controls](/build/docs/private-pools/using-vpc-service-controls).\n\nRemoving public IPs on private pools\n------------------------------------\n\nYou can remove public IPs on private pools by\n[setting `egressOption` field in the private pool config file to `NO_PUBLIC_EGRESS`](/build/docs/private-pools/worker-pool-config-file-schema).\nHowever, keep in mind that removing public IPs will restrict your private pool\nfrom accessing resources in the public internet.\n\nRestricting egress to the public internet\n-----------------------------------------\n\nThere are few ways to restrict egress from private pools to the public internet:\n\n- Remove public IPs on private pools by [setting `egressOption` field in the private pool config file to `NO_PUBLIC_EGRESS`](/build/docs/private-pools/worker-pool-config-file-schema).\n This will remove all access from the private pool to the public internet.\n\n- Create a [private pool within a VPC Service Controls perimeter](/build/docs/private-pools/using-vpc-service-controls).\n This allows you to set up a secure perimeter to guard against data exfiltration.\n\n- [Customize firewall rules on your VPC network](/vpc/docs/vpc#firewall_rules)\n to restrict egress.\n\nEnforcing the usage of private pools\n------------------------------------\n\nCloud Build provides a `constraints/cloudbuild.allowedWorkerPools`\n[organization policy constraint](/resource-manager/docs/organization-policy/understanding-constraints)\nthat you can enforce to mandate the builds in your organization to not use the\ndefault pool and only use the private pool. For instructions on using this feature,\nsee [Setting up organization policy constraints](/build/docs/private-pools/using-vpc-service-controls#optional_setting_up_organization_policy_constraints).\n\nUsing with private Cloud DNS zones\n----------------------------------\n\nYou can share a private Cloud DNS zone to use with private pools. For\ninstructions, see [Sharing a private zone](/vpc/docs/configure-private-services-access#dns-peering).\n\nRunning behind a NAT\n--------------------\n\nAlthough you can control the IP range of your private pool in your\nVPC, the external IP addresses (if enabled) cannot be controlled.\nIf you need to access a resource from a reserved IP, create a proxy VM and\nroute traffic through it by completing steps in\n[Access external resource from a static source IP address using Cloud Build](https://console.cloud.google.com/?walkthrough_id=build--cloud-build-static-external-ip).\n\nWhat's next\n-----------\n\n- Learn how to [set up your environment to create private pools](/build/docs/private-pools/set-up-private-pool-environment).\n- Learn how to [create and manage private\n pools](/build/docs/private-pools/create-manage-private-pools)."]]
