[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-29 (世界標準時間)。"],[[["\u003cp\u003eCloud Composer 2 environments are built with resources distributed between a customer project, where environments are created, and a Google-managed tenant project for unified access control and data security.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer 2 offers different architecture configurations, including Public IP, Private IP, and Highly Resilient Private IP, each with distinct networking and failover properties.\u003c/p\u003e\n"],["\u003cp\u003eThe environment's cluster, which runs as an Autopilot mode VPC-native Google Kubernetes Engine cluster, along with other components such as the Airflow database, web server, schedulers, triggerers, and workers, are all managed by Google.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer integrates with Cloud Logging and Cloud Monitoring, enabling centralized viewing of Airflow and DAG logs, alongside metrics, events, and metadata for generating insights.\u003c/p\u003e\n"],["\u003cp\u003eThe Environment's bucket, which is a Cloud Storage bucket, is located in the customer project, and it is used to store DAGs, plugins, data dependencies, and Airflow logs.\u003c/p\u003e\n"]]],[],null,["# Environment architecture\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/environment-architecture \"View this page for Cloud Composer 3\") \\| **Cloud Composer 2** \\| [Cloud Composer 1](/composer/docs/composer-1/environment-architecture \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page describes the architecture of Cloud Composer environments.\n\nEnvironment architecture configurations\n---------------------------------------\n\nCloud Composer 2 environments can have the following architecture\nconfigurations:\n\n- [Public IP architecture](#public-ip)\n- [Private IP architecture](#private-ip-psc)\n- [Highly resilient Private IP architecture](#private-ip-high-resilience)\n\n\nCustomer and tenant projects\n----------------------------\n\nWhen you create an environment, Cloud Composer distributes the\nenvironment's resources between a tenant and a customer project:\n\n- *Customer project* is a Google Cloud project where you create your\n environments. You can create more than one environment in a single customer\n project.\n\n- *Tenant project* is a Google-managed [tenant project](/service-infrastructure/docs/glossary#tenant) and\n belongs to the Google.com organization. The tenant project provides unified\n access control and an additional layer of data security to your\n environment. Each Cloud Composer environment has its own tenant\n project.\n\nEnvironment components\n----------------------\n\nA Cloud Composer environment consists of environment components.\n\nAn *environment component* is an element of a managed Airflow infrastructure\nthat runs on Google Cloud, as a part of your environment. Environment\ncomponents run either in the tenant or in the customer project of\nyour environment.\n\n### Environment's cluster\n\n*Environment's cluster* is an [Autopilot](/kubernetes-engine/docs/concepts/types-of-clusters#modes) mode\n[VPC-native](/kubernetes-engine/docs/concepts/types-of-clusters#vpc-clusters) Google Kubernetes Engine cluster of your\nenvironment:\n\n\n| **Caution:** Do not introduce changes in the environment's cluster. Clusters for Cloud Composer and workloads deployed into them are managed by Google. It is possible to change the configuration of your environment's cluster, but doing so might break your environment. If you delete an environment's cluster, it cannot be restored; you must delete the environment and create a new environment.\n\nBy default, Cloud Composer enables\n[node auto-upgrades](/kubernetes-engine/docs/how-to/node-auto-upgrades) and [node auto-repair](/kubernetes-engine/docs/how-to/node-auto-repair)\nto protect your environment's cluster from security vulnerabilities. These\noperations happen during maintenance windows that you specify for your\nenvironment.\n\n### Environment's bucket\n\n*Environment's bucket* is a [Cloud Storage bucket](/composer/docs/composer-2/cloud-storage)\nthat stores DAGs, plugins, data dependencies, and Airflow logs. Environment's\nbucket is located in the customer project.\n\nWhen you [upload your DAG files](/composer/docs/composer-2/manage-dags) to the `/dags` folder in your\nenvironment's bucket, Cloud Composer synchronizes the DAGs to Airflow components of your environment.\n\n### Airflow web server\n\n*Airflow web server* runs the Airflow UI of your environment.\n\nCloud Composer provides access to the interface based on user\nidentities and IAM policy bindings defined for users.\n\n\n### Airflow database\n\n*Airflow database* is a [Cloud SQL instance](/sql/docs/introduction)\nthat runs in the tenant project of your environment. It hosts the Airflow\nmetadata database.\n\nTo protect sensitive connection and workflow information,\nCloud Composer allows database access only to\nthe [service account](/composer/docs/composer-2/access-control#service-account) of your environment.\n\n### Other airflow components\n\nOther Airflow components that run in your environment are:\n\n- *Airflow schedulers* parse DAG definition files, schedule DAG runs\n based on the schedule interval, and queues tasks for execution by\n Airflow workers.\n\n In Cloud Composer 2\n Airflow DAG processors run as a part of scheduler components.\n\n- *Airflow triggerers* asynchronously monitor all deferred tasks in your\n environment. If you set the number of triggerers in your environment above\n zero, then you can use\n [deferrable operators in your DAGs](/composer/docs/composer-2/use-deferrable-operators).\n\n- *Airflow workers* execute tasks that are scheduled by Airflow\n schedulers.\n\n The minimum and maximum number of workers in your environment changes\n dynamically depending on the number of tasks in the queue.\n\nPublic IP environment architecture\n----------------------------------\n\n[](/static/composer/docs/images/composer-2-public-ip-architecture.svg) **Figure 1.** Public IP environment architecture (click to enlarge)\n\nIn a Public IP environment architecture for Cloud Composer 2:\n\n- The tenant project hosts a Cloud SQL instance and Cloud SQL storage.\n- The customer project hosts all other components of the environment.\n- Airflow schedulers and workers in the customer project communicate with the Airflow database through a Cloud SQL proxy instance located in the customer project.\n\n\nPrivate IP environment architecture\n-----------------------------------\n\n[](/static/composer/docs/images/composer-2-private-ip-psc-architecture.svg) **Figure 2.** Private IP Cloud Composer environment resources in the tenant project and the customer project (click to enlarge)\n\nBy default, Cloud Composer 2\n[uses Private Service Connect](/composer/docs/composer-2/configure-private-service-connect), so that your\nPrivate IP environments communicate internally without the use of VPC\npeerings. It's also possible to use VPC peerings instead of\nPrivate Service Connect in your environment. This is a\nnon-default option.\n\nIn the Private IP environment architecture:\n\n- The tenant project hosts a Cloud SQL instance and Cloud SQL storage.\n- The customer project hosts all other components of the environment.\n- Airflow schedulers and workers connect to the Airflow database through the configured [PSC endpoint](/vpc/docs/configure-private-service-connect-services#create-endpoint).\n\n| **Note:** If the [Domain Restricted Sharing (DRS) organizational policy](/resource-manager/docs/organization-policy/org-policy-constraints) is enabled in your project, Cloud Composer 2 still uses the Private IP architecture. Only Cloud Composer 1 uses a different type of architecture when DRS is enabled.\n\nHighly resilient Private IP architecture\n----------------------------------------\n\n[](/static/composer/docs/images/composer-2-private-ip-psc-high-resilience-architecture.svg) **Figure 3.** Highly resilient Private IP Cloud Composer environment resources in the tenant project and the customer project (click to enlarge)\n\nHighly resilient (Highly Available) Cloud Composer environments are\nmulti-zonal environments that use built-in redundancy and failover\nmechanisms that reduce the environment's susceptibility to zonal failures and\nsingle point of failure outages.\n\nIn this type of Private IP environment:\n\n- A Cloud SQL component of your environment has a primary instance and a standby instance that are distributed between zones.\n- Your environment runs two Airflow schedulers, two web servers, and if triggerers are used, a minimum of two (up to ten total) triggerers. These pairs of components run in two separate zones.\n- The minimum number of workers is set to two, and your environment's cluster distributes worker instances between zones. In case of a zonal outage, affected worker instances are rescheduled in a different zone.\n\nIntegration with Cloud Logging and Cloud Monitoring\n---------------------------------------------------\n\nCloud Composer integrates with Cloud Logging and\nCloud Monitoring of your Google Cloud project, so that you have a\ncentral place to view [Airflow and DAG logs](/composer/docs/composer-2/view-logs).\n\nCloud Monitoring collects and ingests metrics, events, and metadata\nfrom Cloud Composer to\n[generate insights through dashboards and charts](/composer/docs/composer-2/monitor-environments).\n\nBecause of the streaming nature of Cloud Logging, you can view logs emitted by Airflow components immediately instead of waiting for Airflow logs to appear in the Cloud Storage bucket of your environment.\n\nTo limit the number of logs in your Google Cloud project,\nyou can [stop all logs ingestion](/logging/docs/exclusions#stop-logs). Do not\ndisable Logging.\n\nWhat's next\n-----------\n\n- [Create an environment](/composer/docs/composer-2/create-environments)\n- [Versioning overview](/composer/docs/composer-versioning-overview)"]]
