對於私人 IP 環境，Cloud Composer 只會為環境中的代管 Google Kubernetes Engine 和 Cloud SQL VM 指派私人 IP (RFC 1918) 位址，使得這些代管 VM 無法從公開網際網路存取。您也可以選擇使用私人使用的公開 IP 位址和IP 偽裝代理程式，以節省 IP 位址空間並使用非 RFC 1918 位址。
根據預設，在私人 IP 環境中，Cloud Composer 工作流程無法存取外部網際網路，但仍可透過 Google 的私人網路存取 Google Cloud API 和服務。
虛擬私人雲端原生 GKE 叢集
當您建立環境時，Cloud Composer 會將環境的資源分配至 Google 代管的用戶群專案和客戶專案。
針對私人 IP 環境，Cloud Composer 會在客戶專案中，為您的環境建立虛擬私有雲原生 GKE 叢集。
虛擬私有雲原生叢集會使用虛擬私有雲網路內建的別名 IP 轉送功能，讓虛擬私有雲可為 pod 管理轉送。使用虛擬私人雲端原生叢集時，GKE 會自動選擇次要範圍。如有特定網路需求，您也可以在建立環境時，為 GKE Pod 和 GKE 服務設定次要範圍。
私人 IP Cloud Composer 環境
您可以在建立環境時選取私人 IP 環境。使用私人 IP 即表示環境中的 GKE 和 Cloud SQL VM 未獲指派公開 IP 位址，且只能透過 Google 的內部網路通訊。
建立私人 IP 環境時，環境的 GKE 叢集會設為私人叢集，Cloud SQL 執行個體則會設為私人 IP。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-29 (世界標準時間)。"],[[["\u003cp\u003ePrivate IP Cloud Composer environments assign only private IP addresses to managed Google Kubernetes Engine and Cloud SQL VMs, preventing inbound access from the public internet.\u003c/p\u003e\n"],["\u003cp\u003eIn Private IP environments, Cloud Composer workflows typically lack outbound internet access, though access to Google Cloud APIs and services remains unaffected because they use Google's private network.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer creates a VPC-native GKE cluster within your customer project for Private IP environments, utilizing Alias IP routing for pod management.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments configure the GKE cluster as a private cluster and the Cloud SQL instance for private IP, isolating traffic between the environment's GKE cluster and Cloud SQL database from the public internet.\u003c/p\u003e\n"],["\u003cp\u003eAccessing the control plane in a Private IP Cloud Composer environment's GKE cluster can be done via a VM in the same region and VPC network with full Cloud API access, or by enabling public endpoint access and adding authorized networks.\u003c/p\u003e\n"]]],[],null,["# Private IP environments\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/change-networking-type#comparison \"View this page for Cloud Composer 3\") \\| **Cloud Composer 2** \\| [Cloud Composer 1](/composer/docs/composer-1/private-ip-environments \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides information about Private IP Cloud Composer environments.\n\nFor Private IP environments, Cloud Composer assigns only private IP\n([RFC 1918](https://www.ietf.org/rfc/rfc1918.txt)) addresses to the managed Google Kubernetes Engine and\nCloud SQL VMs in your environment, resulting in no inbound access to\nthose managed VMs from the public internet. As an option, you can also use [privately used public IP addresses](/composer/docs/composer-2/configure-privately-used-public-ip)\nand [the IP Masquerade agent](/composer/docs/composer-2/enable-ip-masquerade-agent) to save the IP address\nspace and to use non-RFC 1918 addresses.\n\nBy default, in a Private IP environment, Cloud Composer workflows\ndo not have outbound internet access. Access to Google Cloud APIs and\nservices is not affected by routing over Google's private network.\n\nVPC-native GKE cluster\n----------------------\n\nWhen you create an environment, Cloud Composer\n[distributes your environment's resources](/composer/docs/composer-2/environment-architecture)\nbetween a Google-managed [tenant](/service-infrastructure/docs/glossary#tenant) project and your customer project.\n\nFor a Private IP environment, Cloud Composer creates\na VPC-native GKE cluster for your environment\nin your customer project.\n\nVPC-native clusters use [Alias IP routing](/vpc/docs/alias-ip) built\ninto the VPC network, enabling the VPC to\nmanage routing for pods. When you use VPC-native clusters,\nGKE automatically chooses a secondary range. For specific\nnetworking requirements, you can also\n[configure the secondary ranges](/composer/docs/composer-2/configure-private-ip#secondary-range)\nfor your GKE pods and GKE services when you\ncreate an environment.\n\nPrivate IP Cloud Composer environment\n-------------------------------------\n\nYou can select a Private IP environment when you create an environment.\nUsing private IP means that the GKE and Cloud SQL\nVMs in your environment are not assigned public IP addresses and\ncommunicate only over Google's internal network.\n\nWhen you create a Private IP environment, the GKE cluster for\nyour environment is [configured as a private cluster](/kubernetes-engine/docs/how-to/private-clusters),\nand the Cloud SQL instance is [configured for private IP](/sql/docs/postgres/private-ip).\n\nIf your Private IP environment\n[uses Private Service Connect](/composer/docs/composer-2/configure-private-service-connect),\nyour customer project's VPC network and your tenant project's\nVPC network connect through a PSC endpoint.\n\nIf your Private IP environment uses VPC peerings, Cloud Composer\ncreates a peering connection between your customer project's\nVPC network and your tenant project's VPC\nnetwork.\n\n\nWith private IP enabled for your environment, the IP traffic between your\nenvironment's GKE cluster and Cloud SQL\ndatabase is private, thus isolating your workflows from the public\ninternet.\n\nThis additional layer of security affects how you connect to these resources\nand how your environment accesses external resources. Using private IP\ndoes not affect how you access Cloud Storage or your Airflow webserver over the public IP.\n\n### GKE cluster\n\nUsing a private GKE cluster enables you to control\n[access to the cluster's control plane](/kubernetes-engine/docs/concepts/private-cluster-concept)\n(cluster nodes do not have public IP addresses).\n\nWhen you create a private IP Cloud Composer environment, you specify whether\nor not access to the control plane is public and its IP range. The control\nplane IP range must not overlap with any subnetwork in your\nVPC network.\n| **Caution:** In Cloud Composer versions before 2.4.0, you need access to the control plane of your environment's cluster to [run Airflow CLI commands](/composer/docs/composer-2/access-airflow-cli).\n\n### Cloud SQL\n\nBecause the Cloud SQL instance does not have\na public IP address, the Cloud SQL traffic inside your Private IP\nenvironment is not exposed to the public internet.\n\nCloud Composer configures Cloud SQL to accept incoming\nconnections through private service access. You can access the\nCloud SQL instance on your VPC network by using its private IP\naddress.\n\n### Public internet access for your workflows\n\nOperators and operations that require access to resources on unauthorized\nnetworks or on the public internet can fail. For example, the Dataflow Python\noperation requires a public internet connection to download Apache Beam from pip.\n\nAllowing VMs without external IP addresses and private GKE\nclusters to connect to the internet requires [Cloud NAT](/nat/docs/overview).\n\nTo use Cloud NAT,\n[create a NAT configuration](/nat/docs/gke-example#create-nat) using Cloud Router\nfor the VPC network and region that your\nprivate IP Cloud Composer environment is in.\n\nWhat's next\n-----------\n\n- [Configure Private IP networking](/composer/docs/composer-2/configure-private-ip)\n- [Create an environment](/composer/docs/composer-2/create-environments)"]]
