建議您避免在剖析 DAG 的期間存取非公開資源。有時您不得不存取非公開資源，在這種情況下，您必須為網路伺服器的服務帳戶授予相關權限。服務帳戶名稱衍生自網路伺服器網域。舉例來說，如果網域是 example-tp.appspot.com，則服務帳戶為 example-tp@appspot.gserviceaccount.com。
DAG 錯誤
本節僅適用於 Cloud Composer 1。
網路伺服器是在 App Engine 上執行，並與環境的 GKE 叢集隔開。網路伺服器會剖析 DAG 定義檔，如果 DAG 中有錯誤，就可能發生 502 gateway timeout。如果有問題的 DAG 不會中斷 GKE 中執行的任何程序，Airflow 就能在沒有可用網路伺服器的情況下正常運作。在這種情況下，您可以使用 gcloud composer environments run 從環境中擷取詳細資料，並在網路伺服器無法使用時做為解決方法。
在其他情況下，您可以在 GKE 中剖析 DAG，並留意是否有 DAG 擲回嚴重 Python 例外狀況或逾時 (超出預設的 30 秒)。如要進行疑難排解，請連線至 Airflow 工作站容器中的遠端殼層並進行測試，檢查是否有語法錯誤。詳情請參閱測試 DAG 一文。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-29 (世界標準時間)。"],[[["\u003cp\u003eThis document provides troubleshooting steps for common issues related to the Airflow web server in Cloud Composer 1 environments, which is a component that offers a user interface for managing Airflow DAGs and tasks.\u003c/p\u003e\n"],["\u003cp\u003eIf you're encountering a 403 error when attempting to access the Airflow UI, it may be caused by the web server network access controls, which allow restricting access to specified IP ranges.\u003c/p\u003e\n"],["\u003cp\u003eTo determine if web server network access controls are causing access issues, verify if the "Web server access control" is set to "All IP addresses have access (default)" in the environment's configuration.\u003c/p\u003e\n"],["\u003cp\u003eThe troubleshooting process involves temporarily allowing access from all IP addresses to determine if the problem stems from IP configuration, IAM permissions, or from the resolved address being IPv4 or IPv6.\u003c/p\u003e\n"],["\u003cp\u003eIf the issue is related to IP address conflicts, there are instructions on how to narrow down if you need an IPv4 or IPv6 address to be granted access.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/troubleshooting-web-server \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-2/troubleshooting-web-server \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides troubleshooting steps and information for common Airflow\nweb server issues.\n\nThe Airflow web server is an Airflow component that provides a user interface\nfor managing Airflow DAGs and tasks. This page describes troubleshooting steps\nfor various issues with accessing the Airflow web server of your environment or\nfor web server-related warnings visible in Airflow logs.\n\nCan't access Airflow UI when network access controls are enabled\n\n**Symptom**: After web server access controls are configured, it's not possible\nto access Airflow UI. Usually, the error code displayed in this situation is\n403.\n\n**Information about the issue** : Cloud Composer supports\n[web server network access controls](/composer/docs/composer-1/access-airflow-web-interface#network-access-controls),\nwhich lets you specify IP ranges that are allowed to connect to the web server.\n\nProblems with accessing Airflow UI usually result in error 403. To check if the\nerror is related to web server network access controls, do the following:\n\n1. In the list of environments, click the name of your environment. The **Environment details** page opens.\n2. Go to the **Environment configuration** tab.\n3. Check if the **Web server access control** item is set to **All IP addresses have access (default)**.\n4. If a value different than **All IP addresses have access (default)** is configured, then network access control is enabled and the visibility of the Airflow UI is limited to the provided IPv4 and IPv6 address ranges. In this case, the problem might be related to web server network access controls.\n\nIn most cases, the cause of the issue is the mismatch between the intended IP\nthat you specified and the IP that is actually resolved to connect to the\nAirflow UI. To troubleshoot the problem, do the following:\n\n1. In the list of environments, click the name of your environment.\n The **Environment details** page opens.\n\n2. Go to the **Environment configuration** tab.\n\n3. Find the **Web server access control** item and click **Edit**.\n\n4. In the **Web server network access control** dialog, select\n **Allow access from all IP addresses**.\n\n5. Access the Airflow UI multiple times and verify that it works without any\n issues:\n\n - If you don't experience problems, continue to the next step.\n\n - If you experience a problem at this point, it means that the issue might\n be related to your IAM permissions configuration. For\n more information about the IAM permissions for\n Cloud Composer, see [Access control](/composer/docs/composer-1/access-control).\n\n6. In the **Web server network access control** dialog, select\n **Allow access only from specific IP addresses**.\n\n7. Add the `0.0.0.0/0` IP range, then access the Airflow UI multiple times and\n verify that it works without issues:\n\n - If you don't experience problems, then the IP that you're connecting\n with is an IPv4 address.\n\n - If you experience a problem at this point, it means the IP you're\n connecting with is an IPv6 address.\n\n8. Delete the `0.0.0.0/0` IP range, and add the `::/0` IP range.\n\n - If you don't experience problems, then the IP that you're connecting\n with is an IPv6 address.\n\n - If you experience a problem at this point, it means the IP you're\n connecting with is an IPv4 address.\n\n9. Now you determined if your resolved address is IPv4 or IPv6.\n\n10. Depending on the address type, narrow down the `::/0` or `0.0.0.0/0` ranges\n to more specific ones, to verify the broadest range when the access stops\n working:\n\n - You can start with the wide subnet mask (such as `192.0.2.0/8`) that\n includes the address that you assume to be your IP address.\n\n - To determine your IP address, you can use a third-party service that\n provides your external IP address when you visit its page. You can\n search for such services by the \"what is my IP address\" search query).\n\nConfiguration values aren't displayed on the configuration page\n\nSome Airflow configuration parameters of Airflow are hidden on the\nconfiguration page to prevent access to potentially sensitive information. For\nexample, credentials to access the Airflow database are not displayed.\n| **Warning:** If you configure Airflow to display these parameters, then\n| **any Airflow user with `Admin` and `Op` permission will be able to access this\n| information.**\n| By default, Airflow assigns the `Op` role to new Airflow users.\n|\n| To prevent Airflow users with the `Op` role from accessing the configuration page:\n|\n| 1. Go to the **Security** \\\u003e **List Roles** configuration page in the Airflow UI.\n| 2. Revoke the **can read Configurations** and **menu access on Configurations** permissions from the `Op` role.\n\nTo display hidden fields, [override](/composer/docs/composer-1/override-airflow-configurations) the following Airflow\nconfiguration option. We recommend to revert the changes after you obtain the\nrequired values.\n\n| Section | Key | Value | Notes |\n|-------------|-----------------|--------|-------------------------------------------------------------------------------------------------|\n| `webserver` | `expose_config` | `True` | The default value is `non-sensitive-only`. Set to `False` to hide all configuration parameters. |\n\nDAG crashes the Airflow web server or causes it to return a '502 gateway timeout' error\n\nWeb server failures can occur for several different reasons. Check\nthe **airflow-webserver** logs in\n[Cloud Logging](/composer/docs/composer-1/view-logs#streaming) to determine the cause of the\n`502 gateway timeout` error.\n\nHeavy load computation\n\nThis section applies only to Cloud Composer 1.\n\nUnlike the worker and scheduler nodes, whose machine types can be customized to\nhave greater CPU and memory capacity, the web server uses a fixed machine type,\nwhich can lead to DAG parsing failures if the parse-time computation is too\nheavy.\n\nNote that the web server has [2 vCPUs and 2 GB of memory](/composer/pricing#environment_sizing).\nThe default value for `core-dagbag_import_timeout` is 30 seconds. This timeout\nvalue defines the upper limit for how long Airflow spends loading a\nPython module in the `/dags` folder.\n\nIncorrect permissions\n\nThis section applies only to Cloud Composer 1.\n\nThe web server does not run under the same service account as the workers and\nscheduler. As such, the workers and scheduler might be able to access\nuser-managed resources that the web server cannot access.\n\nWe recommend that you avoid accessing non-public resources during\nDAG parsing. Sometimes, this is unavoidable, and you will need to grant\npermissions to the web server's service account. The service\naccount name is derived from your web server domain. For example, if the domain\nis `example-tp.appspot.com`, the service account is\n`example-tp@appspot.gserviceaccount.com`.\n\nDAG errors\n\nThis section applies only to Cloud Composer 1.\n\nThe web server runs on App Engine and is separate from\nyour environment's GKE cluster. The web server parses the DAG\ndefinition files, and a `502 gateway timeout` can occur if there are errors\nin the DAG. Airflow works normally without a functional web server if the\nproblematic DAG is not breaking any processes running in GKE.\nIn this case, you can use `gcloud composer environments run` to retrieve\ndetails from your environment and as a workaround if the web server becomes\nunavailable.\n\nIn other cases, you can run DAG parsing in GKE and look for\nDAGs that throw fatal Python exceptions or that time out (default 30 seconds).\nTo troubleshoot, connect to a remote shell in an Airflow worker container and\ntest for syntax errors. For more information,\nsee [Testing DAGs](/composer/docs/composer-1/test-dags).\n\nWhat's next\n\n- [Access Airflow UI](/composer/docs/composer-1/access-airflow-web-interface)\n- [Access control](/composer/docs/composer-1/access-control)"]]
