비공개 IP 환경의 경우 Cloud Composer가 환경의 관리형 Google Kubernetes Engine과 Cloud SQL VM에 비공개 IP(RFC 1918) 주소만 할당하므로 공개 인터넷에서 이러한 관리형 VM으로 들어오는 액세스가 없습니다. 옵션으로 비공개로 사용되는 공개 IP 주소와 IP 매스커레이드 에이전트를 사용하여 IP 주소 공간을 절약하고 RFC 1918 이외 주소를 사용할 수도 있습니다.
기본적으로 비공개 IP 환경에서 Cloud Composer 워크플로에는 아웃바운드 인터넷 액세스가 없습니다. API 및 서비스에 대한 액세스는 Google Cloud Google의 비공개 네트워크를 통한 라우팅에 영향을 받지 않습니다.
VPC 기반 GKE 클러스터
환경을 만들면 Cloud Composer가 Google 관리 테넌트 프로젝트와 고객 프로젝트 간에 환경 리소스를 분산시킵니다.
비공개 IP 환경의 경우 Cloud Composer가 고객 프로젝트에 환경의 VPC 기반 GKE 클러스터를 만듭니다.
VPC 기반 클러스터는 VPC 네트워크에 기본 제공되는 별칭 IP 라우팅을 사용하여 VPC가 포트의 라우팅을 관리할 수 있게 해줍니다. VPC 기반 클러스터를 사용하면 GKE가 자동으로 보조 범위를 선택합니다. 특정 네트워킹 요구사항에 따라 환경을 만들 때 GKE 포드와 GKE 서비스의 보조 범위를 구성할 수도 있습니다.
비공개 IP Cloud Composer 환경
환경을 만들 때 비공개 IP 환경을 선택할 수 있습니다.
비공개 IP를 사용하면 환경의 GKE와 Cloud SQL VM은 할당된 공개 IP 주소 없이 Google의 내부 네트워크를 통해서만 통신합니다.
비공개 IP Cloud Composer 환경을 만들 때 제어 영역에 대한 액세스가 공개 액세스인지 여부와 IP 범위를 지정합니다. 제어 영역 IP 범위는 VPC 네트워크의 서브네트워크와 겹치지 않아야 합니다.
옵션
설명
공개 엔드포인트 액세스 중지
클러스터에 연결하려면 비공개 IP Cloud Composer 환경과 동일한 리전 및 동일한 VPC 네트워크에 있는 VM에서 연결해야 합니다.
연결 원본 VM 인스턴스에는 모든 Cloud API에 대한 전체 액세스 허용액세스 범위가 필요합니다.
이 VM에서는 환경의 클러스터에서 kubectl 명령어를 실행할 수 있습니다.
공개 엔드포인트 액세스 사용, 마스터 승인된 네트워크 사용
이 구성에서 클러스터 노드는 Google의 비공개 네트워크를 통해 제어 영역과 통신합니다. 노드는 환경 및 승인된 네트워크의 리소스에 액세스할 수 있습니다. GKE에서 승인된 네트워크를 추가할 수 있습니다.
승인된 네트워크에서는 환경의 클러스터에서 kubectl 명령어를 실행할 수 있습니다.
Cloud SQL
Cloud SQL 인스턴스에는 공개 IP 주소가 없으므로 비공개 IP 환경 내 Cloud SQL 트래픽은 공개 인터넷에 노출되지 않습니다.
Cloud Composer는 비공개 서비스 액세스를 통해 들어오는 연결을 허용하도록 Cloud SQL을 구성합니다. 비공개 IP 주소를 사용하여 VPC 네트워크의 Cloud SQL 인스턴스에 액세스할 수 있습니다.
워크플로에 대한 공개 인터넷 액세스
권한이 없는 네트워크나 공개 인터넷의 리소스에 액세스해야 하는 연산자와 작업은 실패할 수 있습니다. 예를 들어 Dataflow Python 작업을 수행하려면 공개 인터넷 연결을 통해 pip에서 Apache Beam을 다운로드해야 합니다.
외부 IP 주소가 없는 VM 및 비공개 GKE 클러스터가 인터넷에 연결하려면 Cloud NAT가 필요합니다.
Cloud NAT를 사용하려면 비공개 IP Cloud Composer 환경이 속한 VPC 네트워크 및 리전에서 Cloud Router를 사용하여 NAT 구성을 만듭니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-29(UTC)"],[[["\u003cp\u003ePrivate IP Cloud Composer environments assign only private IP addresses to managed Google Kubernetes Engine and Cloud SQL VMs, preventing inbound access from the public internet.\u003c/p\u003e\n"],["\u003cp\u003eIn a Private IP environment, Cloud Composer workflows typically lack outbound internet access, but access to Google Cloud APIs and services is unaffected as they route over Google's private network.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments utilize VPC-native GKE clusters that leverage Alias IP routing, and users can configure secondary IP ranges for GKE pods and services.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments create a peering connection between the customer project's VPC network and the tenant project's VPC network, ensuring private traffic between the environment's GKE cluster and Cloud SQL database.\u003c/p\u003e\n"],["\u003cp\u003eAccess to external networks and resources may fail unless Cloud NAT is configured to allow it.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/change-networking-type#comparison \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-2/private-ip-environments \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides information about Private IP Cloud Composer environments.\n\nFor Private IP environments, Cloud Composer assigns only private IP\n([RFC 1918](https://www.ietf.org/rfc/rfc1918.txt)) addresses to the managed Google Kubernetes Engine and\nCloud SQL VMs in your environment, resulting in no inbound access to\nthose managed VMs from the public internet. As an option, you can also use [privately used public IP addresses](/composer/docs/composer-1/configure-privately-used-public-ip)\nand [the IP Masquerade agent](/composer/docs/composer-1/enable-ip-masquerade-agent) to save the IP address\nspace and to use non-RFC 1918 addresses.\n\nBy default, in a Private IP environment, Cloud Composer workflows\ndo not have outbound internet access. Access to Google Cloud APIs and\nservices is not affected by routing over Google's private network.\n\nVPC-native GKE cluster\n\nWhen you create an environment, Cloud Composer\n[distributes your environment's resources](/composer/docs/composer-1/environment-architecture)\nbetween a Google-managed [tenant](/service-infrastructure/docs/glossary#tenant) project and your customer project.\n\nFor a Private IP environment, Cloud Composer creates\na VPC-native GKE cluster for your environment\nin your customer project.\n\nVPC-native clusters use [Alias IP routing](/vpc/docs/alias-ip) built\ninto the VPC network, enabling the VPC to\nmanage routing for pods. When you use VPC-native clusters,\nGKE automatically chooses a secondary range. For specific\nnetworking requirements, you can also\n[configure the secondary ranges](/composer/docs/composer-1/configure-private-ip#secondary-range)\nfor your GKE pods and GKE services when you\ncreate an environment.\n\nPrivate IP Cloud Composer environment\n\nYou can select a Private IP environment when you create an environment.\nUsing private IP means that the GKE and Cloud SQL\nVMs in your environment are not assigned public IP addresses and\ncommunicate only over Google's internal network.\n\nWhen you create a Private IP environment, the GKE cluster for\nyour environment is [configured as a private cluster](/kubernetes-engine/docs/how-to/private-clusters),\nand the Cloud SQL instance is [configured for private IP](/sql/docs/postgres/private-ip).\n\n\u003cbr /\u003e\n\nCloud Composer creates a\npeering connection between your customer project's VPC network\nand your tenant project's VPC network.\n\nWith private IP enabled for your environment, the IP traffic between your\nenvironment's GKE cluster and Cloud SQL\ndatabase is private, thus isolating your workflows from the public\ninternet.\n\nThis additional layer of security affects how you connect to these resources\nand how your environment accesses external resources. Using private IP\ndoes not affect how you access Cloud Storage or your Airflow webserver over the public IP.\n\nGKE cluster\n\nUsing a private GKE cluster enables you to control\n[access to the cluster's control plane](/kubernetes-engine/docs/concepts/private-cluster-concept)\n(cluster nodes do not have public IP addresses).\n\nWhen you create a private IP Cloud Composer environment, you specify whether\nor not access to the control plane is public and its IP range. The control\nplane IP range must not overlap with any subnetwork in your\nVPC network.\n| **Caution:** In Cloud Composer versions before 2.4.0, you need access to the control plane of your environment's cluster to [run Airflow CLI commands](/composer/docs/composer-1/access-airflow-cli).\n\n| Option | Description |\n|--------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Public endpoint access disabled | To connect to the cluster, you must connect from a VM in the same region and same VPC network of the Private IP environment. The VM instance you are connecting from requires the [Access scope](/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes) **Allow full access to all Cloud APIs** . From that VM, you can run `kubectl` commands on your environment's cluster |\n| Public endpoint access enabled, master authorized networks enabled | In this configuration, cluster nodes communicate with the control plane over Google's private network. Nodes can access resources in your environment and in authorized networks. You can [add authorized networks](/kubernetes-engine/docs/how-to/authorized-networks) in GKE. On authorized networks, you can run `kubectl` commands on your environment's cluster |\n\nCloud SQL\n\nBecause the Cloud SQL instance does not have\na public IP address, the Cloud SQL traffic inside your Private IP\nenvironment is not exposed to the public internet.\n\nCloud Composer configures Cloud SQL to accept incoming\nconnections through private service access. You can access the\nCloud SQL instance on your VPC network by using its private IP\naddress.\n\nPublic internet access for your workflows\n\nOperators and operations that require access to resources on unauthorized\nnetworks or on the public internet can fail. For example, the Dataflow Python\noperation requires a public internet connection to download Apache Beam from pip.\n\nAllowing VMs without external IP addresses and private GKE\nclusters to connect to the internet requires [Cloud NAT](/nat/docs/overview).\n\nTo use Cloud NAT,\n[create a NAT configuration](/nat/docs/gke-example#create-nat) using Cloud Router\nfor the VPC network and region that your\nprivate IP Cloud Composer environment is in.\n\nWhat's next\n\n- [Configure Private IP networking](/composer/docs/composer-1/configure-private-ip)\n- [Create an environment](/composer/docs/composer-1/create-environments)"]]
