对于专用 IP 环境，Cloud Composer 仅会为您的环境中的代管式 Google Kubernetes Engine 和 Cloud SQL 虚拟机分配专用 IP (RFC 1918) 地址，从而导致无法通过公共互联网对这些代管式虚拟机进行入站访问。您也可以选择以不公开方式使用的公共 IP 地址和 IP 伪装代理来节省 IP 地址空间，并使用非 RFC 1918 地址。
默认情况下，在专用 IP 环境中，Cloud Composer 工作流没有出站互联网访问权限。对 Google Cloud API 和服务的访问不受 Google 专用网络路由的影响。
VPC 原生 GKE 集群
当您创建环境时，Cloud Composer 会在 Google 管理的租户项目和您的客户项目之间分配环境的资源。
对于专用 IP 环境，Cloud Composer 会在客户项目中针对您的环境创建一个 VPC 原生 GKE 集群。
VPC 原生集群使用 VPC 网络内置的别名 IP 路由机制，进而让 VPC 能够管理 pod 路由。当您使用 VPC 原生集群时，GKE 会自动选择次要范围。如有特定的网络要求，您还可以在创建环境期间为 GKE pod 和 GKE 服务配置次要范围。
专用 IP Cloud Composer 环境
您可以在创建环境时选择专用 IP 环境。使用专用 IP 意味着环境中的 GKE 和 Cloud SQL 虚拟机不会被分配公共 IP 地址，并且只能通过 Google 的内部网络进行通信。
创建专用 IP 环境时，您的环境的 GKE 集群会配置为专用集群，并且 Cloud SQL 实例会配置专用 IP。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-29。"],[[["\u003cp\u003ePrivate IP Cloud Composer environments assign only private IP addresses to managed Google Kubernetes Engine and Cloud SQL VMs, preventing inbound access from the public internet.\u003c/p\u003e\n"],["\u003cp\u003eIn Private IP environments, Cloud Composer workflows typically lack outbound internet access, though access to Google Cloud APIs and services remains unaffected because they use Google's private network.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer creates a VPC-native GKE cluster within your customer project for Private IP environments, utilizing Alias IP routing for pod management.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments configure the GKE cluster as a private cluster and the Cloud SQL instance for private IP, isolating traffic between the environment's GKE cluster and Cloud SQL database from the public internet.\u003c/p\u003e\n"],["\u003cp\u003eAccessing the control plane in a Private IP Cloud Composer environment's GKE cluster can be done via a VM in the same region and VPC network with full Cloud API access, or by enabling public endpoint access and adding authorized networks.\u003c/p\u003e\n"]]],[],null,["# Private IP environments\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/change-networking-type#comparison \"View this page for Cloud Composer 3\") \\| **Cloud Composer 2** \\| [Cloud Composer 1](/composer/docs/composer-1/private-ip-environments \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides information about Private IP Cloud Composer environments.\n\nFor Private IP environments, Cloud Composer assigns only private IP\n([RFC 1918](https://www.ietf.org/rfc/rfc1918.txt)) addresses to the managed Google Kubernetes Engine and\nCloud SQL VMs in your environment, resulting in no inbound access to\nthose managed VMs from the public internet. As an option, you can also use [privately used public IP addresses](/composer/docs/composer-2/configure-privately-used-public-ip)\nand [the IP Masquerade agent](/composer/docs/composer-2/enable-ip-masquerade-agent) to save the IP address\nspace and to use non-RFC 1918 addresses.\n\nBy default, in a Private IP environment, Cloud Composer workflows\ndo not have outbound internet access. Access to Google Cloud APIs and\nservices is not affected by routing over Google's private network.\n\nVPC-native GKE cluster\n----------------------\n\nWhen you create an environment, Cloud Composer\n[distributes your environment's resources](/composer/docs/composer-2/environment-architecture)\nbetween a Google-managed [tenant](/service-infrastructure/docs/glossary#tenant) project and your customer project.\n\nFor a Private IP environment, Cloud Composer creates\na VPC-native GKE cluster for your environment\nin your customer project.\n\nVPC-native clusters use [Alias IP routing](/vpc/docs/alias-ip) built\ninto the VPC network, enabling the VPC to\nmanage routing for pods. When you use VPC-native clusters,\nGKE automatically chooses a secondary range. For specific\nnetworking requirements, you can also\n[configure the secondary ranges](/composer/docs/composer-2/configure-private-ip#secondary-range)\nfor your GKE pods and GKE services when you\ncreate an environment.\n\nPrivate IP Cloud Composer environment\n-------------------------------------\n\nYou can select a Private IP environment when you create an environment.\nUsing private IP means that the GKE and Cloud SQL\nVMs in your environment are not assigned public IP addresses and\ncommunicate only over Google's internal network.\n\nWhen you create a Private IP environment, the GKE cluster for\nyour environment is [configured as a private cluster](/kubernetes-engine/docs/how-to/private-clusters),\nand the Cloud SQL instance is [configured for private IP](/sql/docs/postgres/private-ip).\n\nIf your Private IP environment\n[uses Private Service Connect](/composer/docs/composer-2/configure-private-service-connect),\nyour customer project's VPC network and your tenant project's\nVPC network connect through a PSC endpoint.\n\nIf your Private IP environment uses VPC peerings, Cloud Composer\ncreates a peering connection between your customer project's\nVPC network and your tenant project's VPC\nnetwork.\n\n\nWith private IP enabled for your environment, the IP traffic between your\nenvironment's GKE cluster and Cloud SQL\ndatabase is private, thus isolating your workflows from the public\ninternet.\n\nThis additional layer of security affects how you connect to these resources\nand how your environment accesses external resources. Using private IP\ndoes not affect how you access Cloud Storage or your Airflow webserver over the public IP.\n\n### GKE cluster\n\nUsing a private GKE cluster enables you to control\n[access to the cluster's control plane](/kubernetes-engine/docs/concepts/private-cluster-concept)\n(cluster nodes do not have public IP addresses).\n\nWhen you create a private IP Cloud Composer environment, you specify whether\nor not access to the control plane is public and its IP range. The control\nplane IP range must not overlap with any subnetwork in your\nVPC network.\n| **Caution:** In Cloud Composer versions before 2.4.0, you need access to the control plane of your environment's cluster to [run Airflow CLI commands](/composer/docs/composer-2/access-airflow-cli).\n\n### Cloud SQL\n\nBecause the Cloud SQL instance does not have\na public IP address, the Cloud SQL traffic inside your Private IP\nenvironment is not exposed to the public internet.\n\nCloud Composer configures Cloud SQL to accept incoming\nconnections through private service access. You can access the\nCloud SQL instance on your VPC network by using its private IP\naddress.\n\n### Public internet access for your workflows\n\nOperators and operations that require access to resources on unauthorized\nnetworks or on the public internet can fail. For example, the Dataflow Python\noperation requires a public internet connection to download Apache Beam from pip.\n\nAllowing VMs without external IP addresses and private GKE\nclusters to connect to the internet requires [Cloud NAT](/nat/docs/overview).\n\nTo use Cloud NAT,\n[create a NAT configuration](/nat/docs/gke-example#create-nat) using Cloud Router\nfor the VPC network and region that your\nprivate IP Cloud Composer environment is in.\n\nWhat's next\n-----------\n\n- [Configure Private IP networking](/composer/docs/composer-2/configure-private-ip)\n- [Create an environment](/composer/docs/composer-2/create-environments)"]]
