对于专用 IP 环境，Cloud Composer 仅会为您的环境中的代管式 Google Kubernetes Engine 和 Cloud SQL 虚拟机分配专用 IP (RFC 1918) 地址，从而导致无法通过公共互联网对这些代管式虚拟机进行入站访问。您也可以选择以不公开方式使用的公共 IP 地址和 IP 伪装代理来节省 IP 地址空间，并使用非 RFC 1918 地址。
默认情况下，在专用 IP 环境中，Cloud Composer 工作流没有出站互联网访问权限。对 Google Cloud API 和服务的访问不受 Google 专用网络路由的影响。
VPC 原生 GKE 集群
当您创建环境时，Cloud Composer 会在 Google 管理的租户项目和您的客户项目之间分配环境的资源。
对于专用 IP 环境，Cloud Composer 会在客户项目中针对您的环境创建一个 VPC 原生 GKE 集群。
VPC 原生集群使用 VPC 网络内置的别名 IP 路由机制，进而让 VPC 能够管理 pod 路由。当您使用 VPC 原生集群时，GKE 会自动选择次要范围。如有特定的网络要求，您还可以在创建环境期间为 GKE pod 和 GKE 服务配置次要范围。
专用 IP Cloud Composer 环境
您可以在创建环境时选择专用 IP 环境。使用专用 IP 意味着环境中的 GKE 和 Cloud SQL 虚拟机不会被分配公共 IP 地址，并且只能通过 Google 的内部网络进行通信。
创建专用 IP 环境时，您的环境的 GKE 集群会配置为专用集群，并且 Cloud SQL 实例会配置专用 IP。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-29。"],[[["\u003cp\u003ePrivate IP Cloud Composer environments assign only private IP addresses to managed Google Kubernetes Engine and Cloud SQL VMs, preventing inbound access from the public internet.\u003c/p\u003e\n"],["\u003cp\u003eIn a Private IP environment, Cloud Composer workflows typically lack outbound internet access, but access to Google Cloud APIs and services is unaffected as they route over Google's private network.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments utilize VPC-native GKE clusters that leverage Alias IP routing, and users can configure secondary IP ranges for GKE pods and services.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments create a peering connection between the customer project's VPC network and the tenant project's VPC network, ensuring private traffic between the environment's GKE cluster and Cloud SQL database.\u003c/p\u003e\n"],["\u003cp\u003eAccess to external networks and resources may fail unless Cloud NAT is configured to allow it.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/change-networking-type#comparison \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-2/private-ip-environments \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides information about Private IP Cloud Composer environments.\n\nFor Private IP environments, Cloud Composer assigns only private IP\n([RFC 1918](https://www.ietf.org/rfc/rfc1918.txt)) addresses to the managed Google Kubernetes Engine and\nCloud SQL VMs in your environment, resulting in no inbound access to\nthose managed VMs from the public internet. As an option, you can also use [privately used public IP addresses](/composer/docs/composer-1/configure-privately-used-public-ip)\nand [the IP Masquerade agent](/composer/docs/composer-1/enable-ip-masquerade-agent) to save the IP address\nspace and to use non-RFC 1918 addresses.\n\nBy default, in a Private IP environment, Cloud Composer workflows\ndo not have outbound internet access. Access to Google Cloud APIs and\nservices is not affected by routing over Google's private network.\n\nVPC-native GKE cluster\n\nWhen you create an environment, Cloud Composer\n[distributes your environment's resources](/composer/docs/composer-1/environment-architecture)\nbetween a Google-managed [tenant](/service-infrastructure/docs/glossary#tenant) project and your customer project.\n\nFor a Private IP environment, Cloud Composer creates\na VPC-native GKE cluster for your environment\nin your customer project.\n\nVPC-native clusters use [Alias IP routing](/vpc/docs/alias-ip) built\ninto the VPC network, enabling the VPC to\nmanage routing for pods. When you use VPC-native clusters,\nGKE automatically chooses a secondary range. For specific\nnetworking requirements, you can also\n[configure the secondary ranges](/composer/docs/composer-1/configure-private-ip#secondary-range)\nfor your GKE pods and GKE services when you\ncreate an environment.\n\nPrivate IP Cloud Composer environment\n\nYou can select a Private IP environment when you create an environment.\nUsing private IP means that the GKE and Cloud SQL\nVMs in your environment are not assigned public IP addresses and\ncommunicate only over Google's internal network.\n\nWhen you create a Private IP environment, the GKE cluster for\nyour environment is [configured as a private cluster](/kubernetes-engine/docs/how-to/private-clusters),\nand the Cloud SQL instance is [configured for private IP](/sql/docs/postgres/private-ip).\n\n\u003cbr /\u003e\n\nCloud Composer creates a\npeering connection between your customer project's VPC network\nand your tenant project's VPC network.\n\nWith private IP enabled for your environment, the IP traffic between your\nenvironment's GKE cluster and Cloud SQL\ndatabase is private, thus isolating your workflows from the public\ninternet.\n\nThis additional layer of security affects how you connect to these resources\nand how your environment accesses external resources. Using private IP\ndoes not affect how you access Cloud Storage or your Airflow webserver over the public IP.\n\nGKE cluster\n\nUsing a private GKE cluster enables you to control\n[access to the cluster's control plane](/kubernetes-engine/docs/concepts/private-cluster-concept)\n(cluster nodes do not have public IP addresses).\n\nWhen you create a private IP Cloud Composer environment, you specify whether\nor not access to the control plane is public and its IP range. The control\nplane IP range must not overlap with any subnetwork in your\nVPC network.\n| **Caution:** In Cloud Composer versions before 2.4.0, you need access to the control plane of your environment's cluster to [run Airflow CLI commands](/composer/docs/composer-1/access-airflow-cli).\n\n| Option | Description |\n|--------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Public endpoint access disabled | To connect to the cluster, you must connect from a VM in the same region and same VPC network of the Private IP environment. The VM instance you are connecting from requires the [Access scope](/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes) **Allow full access to all Cloud APIs** . From that VM, you can run `kubectl` commands on your environment's cluster |\n| Public endpoint access enabled, master authorized networks enabled | In this configuration, cluster nodes communicate with the control plane over Google's private network. Nodes can access resources in your environment and in authorized networks. You can [add authorized networks](/kubernetes-engine/docs/how-to/authorized-networks) in GKE. On authorized networks, you can run `kubectl` commands on your environment's cluster |\n\nCloud SQL\n\nBecause the Cloud SQL instance does not have\na public IP address, the Cloud SQL traffic inside your Private IP\nenvironment is not exposed to the public internet.\n\nCloud Composer configures Cloud SQL to accept incoming\nconnections through private service access. You can access the\nCloud SQL instance on your VPC network by using its private IP\naddress.\n\nPublic internet access for your workflows\n\nOperators and operations that require access to resources on unauthorized\nnetworks or on the public internet can fail. For example, the Dataflow Python\noperation requires a public internet connection to download Apache Beam from pip.\n\nAllowing VMs without external IP addresses and private GKE\nclusters to connect to the internet requires [Cloud NAT](/nat/docs/overview).\n\nTo use Cloud NAT,\n[create a NAT configuration](/nat/docs/gke-example#create-nat) using Cloud Router\nfor the VPC network and region that your\nprivate IP Cloud Composer environment is in.\n\nWhat's next\n\n- [Configure Private IP networking](/composer/docs/composer-1/configure-private-ip)\n- [Create an environment](/composer/docs/composer-1/create-environments)"]]
