在某些情况下，您可能需要为专用池定义静态 IP 范围，例如，调用允许来自已定义 IP 范围的列表调用的服务时。使用专用池时，如果要在您的 VPC 网络与专用池的 VPC 网络之间建立专用连接，您可以使用 IP 地址的已定义 CIDR 范围创建分配的 IP 地址，供专用池在其上运行。您还可以在专用池将要使用的分配 IP 地址范围内指定较小的 CIDR 范围。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003ePrivate pools can be configured to use the default Virtual Private Cloud (VPC) network, which allows builds to access the public internet and utilize features like configurable machine types and static internal IP ranges.\u003c/p\u003e\n"],["\u003cp\u003eYou can define a static internal IP range for your private pool, enabling it to interact with services that require allowlisting calls from a defined IP range by setting up a private connection between the VPC network and the private pool's VPC network.\u003c/p\u003e\n"],["\u003cp\u003ePrivate pools can connect to resources within a private network, such as source repositories and databases, by creating a private connection between the pool and your managed VPC network.\u003c/p\u003e\n"],["\u003cp\u003eFor shared VPC networks, the project creating the private pool must be attached to the host project containing the shared VPC network, which is essential for centralized networking and Identity and Access Management across projects.\u003c/p\u003e\n"],["\u003cp\u003eEgress from private pools to the public internet can be restricted by removing public IPs, creating a VPC Service Controls perimeter, or customizing firewall rules on the VPC network, allowing to improve security.\u003c/p\u003e\n"]]],[],null,["# Using Cloud Build in a private network\n\nThis page explains how to configure commonly-used private network setups to use\nwith private pools. For an overview of private pools, see\n[Private pools overview](/build/docs/private-pools/private-pools-overview).\n\nDefining the default network settings\n-------------------------------------\n\nWhen you create a private pool, by default you're set up to use the Virtual Private Cloud\nnetwork in which the private pools reside. Use the default VPC\nnetwork if:\n\n- You want builds to access the public internet.\n- You want [configurable machine types and sizes](/build/docs/private-pools/private-pools-overview), static internal IP ranges, or one of the other features of [private pools](/build/docs/private-pools/private-pools-overview).\n- You are **not** looking for builds to access resources within your private VPC network.\n\nFor instructions on connecting to the default network, see\n[Creating a private pool](/build/docs/private-pools/create-manage-private-pools#creating_a_new_private_pool).\n\nDefining a static internal IP range\n-----------------------------------\n\nIn some cases, you may need to have a defined static IP range for your private\npool, such as when calling a service that allowlists calls from a defined\nIP range. With private pools, when setting up a\n[private connection between your VPC network and the private pool's VPC network](/build/docs/private-pools/set-up-private-pool-environment#setup-private-connection), you can create allocated IP\naddress ranges with a defined CIDR range of IPs that your private pools will run on. You can also specify a smaller CIDR range within an allocated IP address range that a private pool will use.\n\nRunning in a VPC network\n------------------------\n\nTo use Cloud Build with resources in a private network behind a firewall,\nsuch as in a VPC network, you can\n[create a private connection between the private pool and your managed VPC network](/build/docs/private-pools/set-up-private-pool-environment#setup-private-connection). This enables the private pool to access\nresources in your private network such as source repositories, artifact repositories,\ndatabases, secrets instances, and runtimes.\n\nRunning in a shared VPC network\n-------------------------------\n\nIf you're using a shared VPC network, the project where you're\ncreating the private pool must be attached to the host project that contains\nthe shared VPC network. For instructions on attaching a project,\nsee [Provisioning a shared VPC network](/vpc/docs/provisioning-shared-vpc#create-shared).\n\nConnecting to resources in another peered VPC network or shared VPC network\n---------------------------------------------------------------------------\n\nOrganizations often adopt a [shared VPC](/vpc/docs/shared-vpc)\n(host project) to centralize networking and Identity and Access Management across all the projects.\nThis allows internal IP addresses to be used for Google-managed services like\n[private GKE clusters](/kubernetes-engine/docs/how-to/cluster-shared-vpc#create_private_cluster)\nand [private Cloud SQL](/sql/docs/postgres/configure-private-ip). These\nGoogle-managed services are also peered into a customer-owned shared VPC\nnetwork. The issue with this setup is that private pools are not able to\ncommunicate with the Google-managed services due to the\n[lack of transitive peering](/vpc/docs/vpc-peering#transit-network). Transitive\npeering is only an issue when multiple networks are connected to one\nanother via VPC peering. If one of the connections is changed to\nuse a [VPN](/network-connectivity/docs/vpn/concepts/overview) (or\n[interconnect](/network-connectivity/docs/interconnect)) instead of VPC\npeering, then the networks can establish connectivity. For instructions on this\nnetwork setup, see\n[Accessing private Google Kubernetes Engine clusters with Cloud Build private pools](/build/docs/private-pools/accessing-private-gke-clusters-with-cloud-build-private-pools).\n\nRunning in a specific region\n----------------------------\n\nYou can create a private pool in one of the [supported regions](/build/docs/locations). You can store any built container images and artifacts in [Artifact Registry repositories](/artifact-registry/docs/configure-cloud-build)\nand [Cloud Storage buckets](/build/docs/building/store-build-artifacts)\nin specified regions.\n\nDeploying to private GKE clusters\n---------------------------------\n\nPrivate GKE clusters can have a public or private endpoint for\nthe control plane.\n\nTo deploy to a private GKE cluster with a public\nendpoint, you can [create your private pool in the default network with access to\nthe public internet](/build/docs/private-pools/create-manage-private-pools#creating_a_new_private_pool)\nand [define a static internal IP range](#static-ip-range) for your pool to allow list for access to the cluster.\n\nTo deploy to private GKE clusters with a private endpoint, you can\nfollow the steps described in [Accessing private Google Kubernetes Engine clusters with Cloud Build private pools](/build/docs/private-pools/accessing-private-gke-clusters-with-cloud-build-private-pools).\nAlternatively, once peered into your VPC, you can run a network\nproxy on the cluster as described in [Creating private GKE clusters with network proxies](/architecture/creating-kubernetes-engine-private-clusters-with-net-proxies).\n\nUsing with VPC Service Controls\n-------------------------------\n\nVPC Service Controls is a Google Cloud feature that allows you to set up a secure\nperimeter to guard against data exfiltration. For instructions on using VPC Service Controls\nwith private pools to add additional security to your builds,\nsee [Using VPC Service Controls](/build/docs/private-pools/using-vpc-service-controls).\n\nRemoving public IPs on private pools\n------------------------------------\n\nYou can remove public IPs on private pools by\n[setting `egressOption` field in the private pool config file to `NO_PUBLIC_EGRESS`](/build/docs/private-pools/worker-pool-config-file-schema).\nHowever, keep in mind that removing public IPs will restrict your private pool\nfrom accessing resources in the public internet.\n\nRestricting egress to the public internet\n-----------------------------------------\n\nThere are few ways to restrict egress from private pools to the public internet:\n\n- Remove public IPs on private pools by [setting `egressOption` field in the private pool config file to `NO_PUBLIC_EGRESS`](/build/docs/private-pools/worker-pool-config-file-schema).\n This will remove all access from the private pool to the public internet.\n\n- Create a [private pool within a VPC Service Controls perimeter](/build/docs/private-pools/using-vpc-service-controls).\n This allows you to set up a secure perimeter to guard against data exfiltration.\n\n- [Customize firewall rules on your VPC network](/vpc/docs/vpc#firewall_rules)\n to restrict egress.\n\nEnforcing the usage of private pools\n------------------------------------\n\nCloud Build provides a `constraints/cloudbuild.allowedWorkerPools`\n[organization policy constraint](/resource-manager/docs/organization-policy/understanding-constraints)\nthat you can enforce to mandate the builds in your organization to not use the\ndefault pool and only use the private pool. For instructions on using this feature,\nsee [Setting up organization policy constraints](/build/docs/private-pools/using-vpc-service-controls#optional_setting_up_organization_policy_constraints).\n\nUsing with private Cloud DNS zones\n----------------------------------\n\nYou can share a private Cloud DNS zone to use with private pools. For\ninstructions, see [Sharing a private zone](/vpc/docs/configure-private-services-access#dns-peering).\n\nRunning behind a NAT\n--------------------\n\nAlthough you can control the IP range of your private pool in your\nVPC, the external IP addresses (if enabled) cannot be controlled.\nIf you need to access a resource from a reserved IP, create a proxy VM and\nroute traffic through it by completing steps in\n[Access external resource from a static source IP address using Cloud Build](https://console.cloud.google.com/?walkthrough_id=build--cloud-build-static-external-ip).\n\nWhat's next\n-----------\n\n- Learn how to [set up your environment to create private pools](/build/docs/private-pools/set-up-private-pool-environment).\n- Learn how to [create and manage private\n pools](/build/docs/private-pools/create-manage-private-pools)."]]
