El 15 de septiembre de 2026, todos los entornos de Cloud Composer 1 y Cloud Composer 2 versión 2.0.x alcanzarán el final de su ciclo de vida previsto, y no podrás usarlos. Te recomendamos que planifiques la migración a Cloud Composer 3.
La ejecución de una aplicación fundamental para la empresa en Cloud Composer requiere que varias partes tengan diferentes responsabilidades. Si bien no es una lista exhaustiva, en este documento se enumeran las responsabilidades de Google y del Cliente.
Responsabilidades de Google
Protección y aplicación de parches a los componentes y la infraestructura subyacente del entorno de Cloud Composer, incluidos el clúster de Google Kubernetes Engine, la base de datos de Cloud SQL (que aloja la base de datos de Airflow), Pub/Sub, Artifact Registry y otros elementos del entorno En particular, esto incluye la actualización automática de la infraestructura subyacente, incluido el clúster de GKE y la instancia de Cloud SQL de un entorno.
Proporcionar Google Cloud integraciones para Identity and Access Management, Registros de auditoría de Cloud y Cloud Key Management Service
Restringir y registrar el acceso de administrador de Google a los clústeres de los clientes para obtener asistencia contractual con la Transparencia de acceso y la Aprobación de acceso
Publicamos información sobre los cambios incompatibles con versiones anteriores entre las versiones de Cloud Composer y Airflow en las Notas de la versión de Cloud Composer.
Mantener actualizada la documentación de Cloud Composer:
Proporcionar una descripción de todas las funcionalidades que ofrece Cloud Composer
Proporcionar instrucciones para solucionar problemas que ayudan a mantener los entornos en buen estado
Publicar información sobre problemas conocidos con soluciones alternativas (si existen)
Resolver incidentes de seguridad críticos relacionados con los entornos de Cloud Composer y las imágenes de Airflow proporcionadas por Cloud Composer (sin incluir los paquetes de Python instalados por el cliente) a través de la entrega de nuevas versiones del entorno que aborden los incidentes.
Solución de problemas relacionados con el estado del entorno de Cloud Composer, según el plan de asistencia al cliente
Solucionar problemas y, si es posible, corregir problemas en las funcionalidades principales de Airflow
Responsabilidades de los clientes
Actualizar a versiones nuevas de Cloud Composer y Airflow para mantener la compatibilidad con el producto y resolver problemas de seguridad una vez que el servicio de Cloud Composer publique una versión de Cloud Composer que aborde los problemas
Mantener el código de los DAGs para que siga siendo compatible con la versión de Airflow que se usa
Mantener intacta la configuración del clúster de GKE del entorno, en particular, su función de actualización automática
Mantener los permisos adecuados en IAM para la cuenta de servicio del entorno En particular, mantener los permisos que requieren el agente de Cloud Composer y la cuenta de servicio del entorno. Mantener el permiso requerido para la clave de CMEK que se usa para la encriptación del entorno de Cloud Composer y rotarla según tus necesidades
Mantener los permisos adecuados en IAM para el bucket del entorno y el repositorio de Artifact Registry en el que se almacenan las imágenes de los componentes de Cloud Composer
Mantener los permisos de IAM adecuados para una cuenta de servicio que realiza instalaciones de paquetes de PyPI Para obtener más información, consulta Control de acceso.
Mantener los permisos adecuados del usuario final en IAM y la configuración del control de acceso a la IU de Airflow
Mantén el tamaño de la base de datos de Airflow por debajo de los 16 GB con el DAG de mantenimiento.
Resolver todos los problemas de análisis del DAG antes de presentar casos de ayuda a Atención al cliente de Cloud
Asigna nombres a los DAG de forma adecuada (por ejemplo, sin usar caracteres invisibles, como ESPACIO o TAB, en los nombres de los DAG) para que las métricas se puedan informar correctamente para los DAG.
Actualiza el código de los DAG para que no use operadores obsoletos y migra a sus alternativas actualizadas. Es posible que los operadores en desuso se quiten de los proveedores de Airflow, lo que podría afectar tus planes para actualizar a una versión posterior de Cloud Composer o Airflow. Los operadores desaprobados tampoco se mantienen y deben usarse "tal cual".
Configurar los permisos de IAM adecuados cuando se usan back-ends de secretos, como Secret Manager, de modo que la cuenta de servicio del entorno tenga acceso a ellos
Ajustar los parámetros del entorno de Cloud Composer (como la CPU y la memoria para los componentes de Airflow) y las configuraciones de Airflow para cumplir con las expectativas de rendimiento y carga de los entornos de Cloud Composer con la guía de optimización de Cloud Composer y la guía de escalamiento de entornos
Evita quitar los permisos que requieren las cuentas de servicio del agente de Cloud Composer y del entorno (quitar estos permisos puede provocar errores en las operaciones de administración o en las tareas y los DAG).
Evita instalar o ejecutar componentes adicionales en el clúster de GKE del entorno que interfieran con los componentes de Cloud Composer y les impidan funcionar correctamente.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-03 (UTC)"],[[["\u003cp\u003eGoogle is responsible for hardening, patching, and auto-upgrading the Cloud Composer environment's infrastructure, as well as protecting access and data encryption.\u003c/p\u003e\n"],["\u003cp\u003eCustomers are responsible for upgrading to new Cloud Composer and Airflow versions, maintaining DAG code compatibility, and managing IAM permissions for the environment's service account and related resources.\u003c/p\u003e\n"],["\u003cp\u003eGoogle will resolve critical security incidents in Cloud Composer and the Airflow images that they provide, while the customer is responsible for making sure that they upgrade to new versions when available.\u003c/p\u003e\n"],["\u003cp\u003eCustomers are responsible for keeping the size of the Airflow database below 16GB and resolving DAG parsing issues.\u003c/p\u003e\n"],["\u003cp\u003eCustomers must ensure proper IAM permissions are configured when using secret backends, and for services used for PyPI packages installations, and other end users.\u003c/p\u003e\n"]]],[],null,["# Cloud Composer shared responsibility model\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/shared-responsibility \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-2/shared-responsibility \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nRunning a business-critical application on Cloud Composer requires\nmultiple parties to carry different responsibilities. While not an exhaustive\nlist, this document lists the responsibilities for both Google and the Customer\nsides.\n\nGoogle Responsibilities\n-----------------------\n\n- [Hardening](/container-optimized-os/docs/concepts/security) and\n [patching](/kubernetes-engine/docs/resources/security-patching) the Cloud Composer\n environment's components and underlying infrastructure, including\n Google Kubernetes Engine cluster, Cloud SQL database (that hosts the Airflow\n database), Pub/Sub, Artifact Registry and other environment\n elements. In particular, this includes auto-upgrading the underlying\n infrastructure, including the GKE cluster and\n Cloud SQL instance of an environment.\n\n | **Note:** Cloud Composer 1 is in the post-maintenance mode and new versions of Cloud Composer 1 with security fixes are no longer published. Migrate to Cloud Composer 2 to get the latest version updates with security improvements.\n- Protecting access to Cloud Composer environments through\n incorporating access control provided by IAM,\n [encrypting data at rest by default](/security/encryption-at-rest/default-encryption),\n providing [additional customer-managed storage encryption](/kubernetes-engine/docs/how-to/using-cmek),\n [encrypting data in transit](/security/encryption-in-transit).\n\n- Providing Google Cloud integrations for Identity and Access Management, Cloud Audit Logs\n and Cloud Key Management Service.\n\n- Restricting and logging Google administrative access to customers' clusters\n for contractual support purposes with\n [Access Transparency](/access-transparency) and\n [Access Approval](/cloud-provider-access-management/access-approval/docs/overview).\n\n- Publishing information about backward incompatible changes between\n Cloud Composer and Airflow versions in\n [Cloud Composer Release Notes](/composer/docs/release-notes).\n\n- Keeping Cloud Composer documentation up to date:\n\n - Providing description of all functionalities provided by\n Cloud Composer.\n\n - Providing troubleshooting instructions that help to keep environments in\n a healthy state.\n\n - Publishing information about known issues with workarounds (if they\n exist).\n\n- Resolving critical security incidents related to Cloud Composer\n environments and Airflow images provided by Cloud Composer\n (excluding customer-installed Python packages) by delivering new\n environment versions addressing the incidents.\n\n- Depending on customer's Support Plan, troubleshooting of\n Cloud Composer environment health issues.\n\n- Maintaining and expanding the functionality of the\n [Cloud Composer Terraform provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/composer_environment).\n\n- Cooperating with the Apache Airflow community to maintain and develop\n [Google Airflow operators](https://airflow.apache.org/docs/apache-airflow-providers-google/stable/operators/cloud/cloud_composer.html).\n\n | **Note:** Google won't fix or troubleshoot issues in operator providers for third-party services or products.\n- Troubleshooting and, if possible, fixing issues in Airflow core\n functionalities.\n\nCustomer responsibilities\n-------------------------\n\n- Upgrading to new Cloud Composer and Airflow versions to keep\n support for the product and to resolve security issues once\n Cloud Composer service publishes a Cloud Composer\n version that addresses the issues.\n\n- Maintaining the DAGs code to keep it compatible with the used Airflow version.\n\n- Keeping the environment's GKE cluster configuration intact,\n particularly including its auto-upgrade feature.\n\n- Maintaining proper permissions in IAM for the environment's\n service account. Particularly, keeping permissions required by the\n [Cloud Composer Agent](/composer/docs/composer-1/access-control#composer-sa) and the\n [environment's service account](/composer/docs/composer-1/access-control#service-account). Maintaining\n required permission for the CMEK key used for Cloud Composer\n environment encryption and rotating it according to your needs.\n\n | **Caution:** We recommend to [set up a user-managed service account](/composer/docs/composer-1/access-control#custom-service-account) for Cloud Composer environments that has only the required set of permissions that are necessary to run the environment and perform operations defined in your DAGs. The **Composer Worker** (`composer.worker`) role provides this required set of permissions in most cases. Add extra permissions to this service account only when it's necessary for the operation of your DAGs. \n |\n | Although we recommend against using this approach, if you don't specify an environment's service account, then your Cloud Composer environment uses the default Compute Engine service account. The default Compute Engine service account usually has the **Editor** basic role, which contains many more permissions than necessary to run Cloud Composer environments and thus creates a risk of DAGs using broader permissions than intended.\n- Maintaining proper permissions in IAM for the environment's\n bucket\n\n and Artifact Registry repository where Cloud Composer's component images are stored\n\n .\n\n | **Caution:** Users with read-write access to the following components:\n | - Your environment's bucket\n | - Artifact Registry repositories with container images used by: %Airflow components, `GKEPodOperator`, or `GKEStartPodOperator`\n |\n | can deploy their own versions of DAGs or container images to an environment\n | even without explicit Cloud Composer-related permissions.\n | These DAGs or images can be later executed in your environment\n | with the permissions of the Cloud Composer environment\n | service account.\n- Maintaining proper IAM permissions for a service account\n that performs PyPI packages installations. For more information, see\n [Access control](/composer/docs/composer-1/access-control#service-account-security).\n\n | **Caution:** Users with read-write access to the environment's bucket or those who can initiate PyPI packages installations can initate the process of building images on behalf of a service account which is used to perform such builds. This service account is called the environment's service account that is specified during the environment creation, It can be a user-provided service account, or the default service account.\n- Maintaining proper end user permissions in IAM and Airflow\n UI Access Control configuration.\n\n- Keeping Airflow database size below\n 16 GB through\n using the [maintenance DAG](/composer/docs/composer-1/cleanup-airflow-database).\n\n- Resolving all DAG parsing issues before raising support cases to\n Cloud Customer Care.\n\n- Naming DAGs in a proper way (for example, without using invisible characters\n like SPACE or TAB in DAG names) so that metrics can be reported correctly\n for DAGs.\n\n- Upgrade the code of DAGs so that it doesn't use deprecated operators and\n migrate to their up to date alternatives. Deprecated operators might be\n removed from Airflow providers, which might impact your plans to upgrade\n to a later Cloud Composer or Airflow version. The deprecated\n operators are also not maintained and they must be used 'as is'.\n\n- Configuring proper IAM permissions when using secret\n backends like Secret Manager so that the environment's\n service account has access to it.\n\n- Adjusting Cloud Composer environment parameters (such as CPU and\n memory for Airflow components) and Airflow configurations to meet\n performance and load expectations of Cloud Composer environments\n using\n [Cloud Composer optimization guide](/composer/docs/composer-2/optimize-environments)\n and [environment scaling guide](/composer/docs/composer-1/scale-environments).\n\n- Avoiding removing permissions required by Cloud Composer Agent and\n environment's service accounts (removing these permissions can lead either\n to failed management operations or to DAG and task failures).\n\n- Keeping\n [all services and APIs required by Cloud Composer](/composer/docs/composer-1/enable-composer-service#required-services)\n always enabled. These dependencies must have quotas configured at levels\n required for Cloud Composer.\n\n- Keeping Artifact Registry repositories that host container images used by\n Cloud Composer environments.\n\n- [Following recommendations and best practices](/composer/docs/composer-1/write-dags) for\n implementing DAGs.\n\n- Diagnosing DAG and task failures using instructions for\n [scheduler troubleshooting](/composer/docs/composer-1/troubleshooting-scheduling),\n [DAG troubleshooting](/composer/docs/composer-1/troubleshooting-dags) and\n [triggerer troubleshooting](/composer/docs/composer-2/troubleshooting-triggerer).\n\n- Avoiding installing or running additional components in the environment's\n GKE cluster that interfere with Cloud Composer\n components and prevent them from functioning correctly.\n\nWhat's next\n-----------\n\n- [Access control with IAM](/composer/docs/composer-1/access-control)\n- [Clean up the Airflow database](/composer/docs/composer-1/cleanup-airflow-database)\n- [Security overview](/composer/docs/composer-1/composer-security-overview)"]]
