환경의 Airflow 구성요소가 인터넷에 액세스할 수 있습니다. 기본 네트워킹 유형입니다.
공개 IP 환경의 Airflow 구성요소는 자동으로 할당된 공개 IP 주소와 포트에서 아웃바운드 연결을 설정합니다.
공개 IP 환경에서 미리 정해진 IP 주소와 포트를 사용하려면 환경에 VPC 네트워크를 연결하고 비공개 IP로 전환하면 됩니다.
이 경우 Cloud Composer는 Google 서비스로 향하는 트래픽을 제외한 모든 트래픽을 이 네트워크를 통해 라우팅합니다.
비공개 IP 네트워킹:
환경의 Airflow 구성요소가 인터넷에 액세스할 수 없습니다.
비공개 IP 환경은 private.googleapis.com 범위를 통해 비공개 Google 액세스를 구성하며, 이 범위에서 지원되는 Google API, 서비스, 도메인에 액세스할 수 있습니다.
private.googleapis.com을 통해 사용할 수 있는 서비스 및 도메인에 관한 자세한 내용과 목록은 가상 프라이빗 클라우드 문서의 네트워크 구성을 참조하세요.
VPC 서비스 제어가 있는 비공개 IP 환경은 restricted.googleapis.com 범위를 통해 비공개 Google 액세스를 구성하며, 이 범위에서 지원되는 Google API, 서비스, 도메인에 액세스할 수 있습니다.
restricted.googleapis.com을 통해 사용할 수 있는 서비스 및 도메인에 관한 자세한 내용과 목록은 가상 프라이빗 클라우드 문서의 네트워크 구성을 참조하세요.
두 가지 네트워킹 유형 외에도 모든 유형의 환경에서 커스텀 VPC 네트워크에 대한 액세스를 사용 설정하거나 중지할 수 있습니다. VPC 네트워크 구성 방법에 따라 비공개 IP 환경은 VPC 네트워크를 통해 인터넷에 액세스할 수 있습니다.
Cloud Composer 2 네트워킹과 Cloud Composer 3 비교
Cloud Composer 3에서는 비공개 IP 환경을 구성할 필요가 없습니다.
다음 Cloud Composer 2 네트워킹 기능은 Cloud Composer 3에서 더 이상 관련이 없습니다.
비공개 IP 네트워킹 구성. IP 범위, 네트워크를 지정하거나 연결 및 방화벽 규칙을 구성할 필요가 없습니다.
환경에서 http_proxy 및 https_proxy환경 변수를 설정할 수 있습니다. 이러한 표준 Linux 변수는 지정된 프록시로 트래픽을 라우팅하기 위해 환경 클러스터의 컨테이너에서 실행되는 웹 클라이언트에 사용됩니다.
NO_PROXY 변수는 기본적으로 Google 도메인 및 localhost 목록으로 설정되므로 프록시에서 제외됩니다.
.google.com,.googleapis.com,metadata.google.internal,localhost. 이 구성을 사용하면 Google 서비스 트래픽을 처리하도록 프록시가 구성되지 않은 경우 http_proxy 및 https_proxy 환경 변수가 설정된 환경을 만들 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-26(UTC)"],[[["\u003cp\u003eCloud Composer 3 offers two networking types: Public IP, which allows internet access, and Private IP, which restricts internet access but enables connections to Google services through specific ranges.\u003c/p\u003e\n"],["\u003cp\u003ePublic IP environments have default outbound internet access, while Private IP environments access Google services through \u003ccode\u003eprivate.googleapis.com\u003c/code\u003e or \u003ccode\u003erestricted.googleapis.com\u003c/code\u003e ranges and can gain internet access if configured with a VPC network.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer 3 simplifies Private IP configurations compared to Cloud Composer 2, eliminating the need for manual settings of IP ranges, networks, or Private Service Connect.\u003c/p\u003e\n"],["\u003cp\u003eThe networking type of a Cloud Composer 3 environment can be switched between Public IP and Private IP using the Google Cloud console, \u003ccode\u003egcloud\u003c/code\u003e command-line tool, API requests, or Terraform configurations.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n**Cloud Composer 3** \\| [Cloud Composer 2](/composer/docs/composer-2/configure-private-ip \"View this page for Cloud Composer 2\") \\| [Cloud Composer 1](/composer/docs/composer-1/configure-private-ip \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page explains the difference between Private IP and Public IP environment\nnetworking types in Cloud Composer 3 and provides instructions for switching\nthe networking type of your environment.\n\nIf you want to disable or enable internet access only when installing PyPI packages, see\n[Configure internet access when installing PyPI packages](/composer/docs/composer-3/packages-internet-access).\n\nIf you want to enable access to your VPC network from your environment,\nsee [Connect an environment to a VPC network](/composer/docs/composer-3/connect-vpc-network).\n\nAbout environment networking types\n\nCloud Composer 3 uses two environment networking types:\n\n- *Public IP networking*:\n\n - Airflow components of the environment can access the\n internet. This is the default networking type.\n\n - Airflow components in Public IP environments establish outbound\n connections from automatically allocated public IP addresses and ports.\n If you want your Public IP environments to use predetermined IP\n addresses and ports, you can do so through\n [connecting a VPC network](/composer/docs/composer-3/connect-vpc-network) to your environment\n and [switching it to Private IP](#change-networking-type).\n In this case, Cloud Composer routes all traffic except\n traffic to Google services through this network.\n\n- *Private IP networking*:\n\n - Airflow components of the environment don't have access to\n the internet.\n\n - Private IP environments configure Private Google Access through the\n `private.googleapis.com` range, which enables access to\n Google APIs, services, and domains supported by this range.\n\n For more information and the list of services and domains available\n through `private.googleapis.com`, see\n [Network configuration](/vpc/docs/configure-private-google-access-hybrid#config-choose-domain)\n in the Virtual Private Cloud documentation.\n - [Private IP environments with VPC Service Controls](/composer/docs/composer-3/configure-vpc-sc) configure\n Private Google Access through the `restricted.googleapis.com`\n range, which enables access to Google APIs, services, and domains supported by this range.\n\n For more information and the list of services and domains available\n through `restricted.googleapis.com`, see\n [Network configuration](/vpc/docs/configure-private-google-access-hybrid#config-choose-domain)\n in the Virtual Private Cloud documentation.\n\nIn addition to two networking types, you can\n[enable or disable access to a custom VPC network](/composer/docs/composer-3/connect-vpc-network) for\nany type of environment. Depending on how you configure your VPC network, a\nPrivate IP environment can gain access the internet through you VPC network.\n\nCloud Composer 2 networking compared to Cloud Composer 3\n\nIn Cloud Composer 3, Private IP environments require no configuration.\n\nThe following Cloud Composer 2 networking features are no longer relevant in\nCloud Composer 3:\n\n- [Configuring Private IP networking](/composer/docs/composer-2/configure-private-ip). You don't\n need to specify IP ranges, networks, or configure connectivity and firewall\n rules.\n\n- [Configuring Private Service Connect](/composer/docs/composer-2/configure-private-service-connect).\n You don't need to set ranges for Private Service Connect\n in Cloud Composer 3.\n\n | **Note:** [Custom VPC network attachments](/composer/docs/composer-3/connect-vpc-network) in Cloud Composer 3 are based on Private Service Connect. This implementation is **not related** to how Private Service Connect is used in Cloud Composer 2 (for connectivity between the environment's cluster and the resources located in the tenant project). In Cloud Composer 3, network attachments are used differently, you don't need to reflect your Cloud Composer 2 networking setup in them.\n- [Using privately used public IP ranges](/composer/docs/composer-2/configure-privately-used-public-ip). This feature provided an\n option to extend the available IP ranges, which are not required in\n Cloud Composer 3.\n\n- [Using the IP Masquerade agent](/composer/docs/composer-2/enable-ip-masquerade-agent). You don't need to configure\n cluster connectivity in Cloud Composer 3.\n\n- [Configuring authorized networks](/composer/docs/composer-2/configure-authorized-networks). It is not\n possible to access the environment's cluster in Cloud Composer 3.\n\nChange environment networking type \n\nConsole\n\n1. In the Google Cloud console, go to the **Environments** page.\n\n [Go to Environments](https://console.cloud.google.com/composer/environments)\n2. In the list of environments, click the name of your environment.\n The **Environment details** page opens.\n\n3. Go to the **Environment configuration** tab.\n\n4. In the **Networking configuration** section, find the\n **Networking type** item and click **Edit**.\n\n5. In the **Networking type** dialog, select:\n\n - **Public IP environment (default)** for Public IP networking.\n - **Private IP environment** for Private IP networking.\n6. Click **Save**.\n\ngcloud\n\nThe Following Google Cloud CLI arguments change the environment's\nnetworking type:\n\n- `--enable-private-environment`: changes to Private IP networking.\n- `--disable-private-environment`: changes to Public IP networking (default).\n\nChange to Private IP networking: \n\n gcloud beta composer environments update \u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --enable-private-environment\n\nChange to Public IP networking: \n\n gcloud beta composer environments update \u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --disable-private-environment\n\nReplace the following:\n\n- `ENVIRONMENT_NAME`: the name of the environment.\n- `LOCATION`: the region where the environment is located.\n\nExample (Private IP): \n\n gcloud beta composer environments update example-environment \\\n --location us-central1 \\\n --enable-private-environment\n\nExample (Public IP): \n\n gcloud beta composer environments update example-environment \\\n --location us-central1 \\\n --disable-private-environment\n\nAPI\n\n1. Create an [`environments.patch`](/composer/docs/reference/rest/v1beta1/projects.locations.environments/patch) API request.\n\n2. In this request:\n\n 1. In the `updateMask` parameter, specify\n the `config.private_environment_config.enable_private_environment`\n mask.\n\n 2. In the request body, in the `enablePrivateEnvironment` field:\n\n - Specify `true` to change to Private IP networking.\n - Specify `false` to change to Public IP networking (default).\n\nExample (Private IP): \n\n // PATCH https://composer.googleapis.com/v1beta1/projects/example-project/\n // locations/us-central1/environments/example-environment?updateMask=\n // config.private_environment_config.enable_private_environment\n\n \"config\": {\n \"privateEnvironmentConfig\": {\n \"enablePrivateEnvironment\": true\n }\n }\n\nTerraform\n\nThe `enable_private_environment` field in the `config` block specifies the\nenvironment's networking type:\n\n- `true`: Private IP networking.\n- `false` or omitted: Public IP networking (default).\n\n resource \"google_composer_environment\" \"example\" {\n provider = google-beta\n name = \"\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e\"\n region = \"\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n\n config {\n\n enable_private_environment = \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRIVATE_IP_STATUS\u003c/span\u003e\u003c/var\u003e\n\n }\n }\n\nReplace the following:\n\n- `ENVIRONMENT_NAME`: the name of your environment.\n- `LOCATION`: the region where the environment is located.\n- `PRIVATE_IP_STATUS`: `true` for Private IP, `false` for Public IP\n\nExample (Private IP): \n\n resource \"google_composer_environment\" \"example\" {\n provider = google-beta\n name = \"example-environment\"\n region = \"us-central1\"\n\n config {\n\n enable_private_environment = true\n\n ... other configuration parameters\n }\n }\n\nConfigure proxy server variables **Important:** Routing with proxy variables is done on a best-effort basis. **There's no guarantee that every request goes through the proxy** . Instead, we recommend to route traffic by [attaching a VPC network](/composer/docs/composer-3/connect-vpc-network) to your environment and configuring traffic routing rules in this network.\n\nYou can set `http_proxy` and `https_proxy` [environment variables](/composer/docs/composer-3/set-environment-variables)\nin your environment. These standard Linux variables are used by web clients\nthat run in containers of your environment's cluster to route traffic through\nthe specified proxies.\n\nThe `NO_PROXY` variable by default is set to a list of Google domains and\n`localhost` so that they are excluded from proxying:\n`.google.com,.googleapis.com,metadata.google.internal,localhost`. This\nconfiguration makes it possible to create an environment with set `http_proxy`\nand `https_proxy` environment variables in cases when the proxy isn't\nconfigured to handle traffic to Google services.\n\nWhat's next\n\n- [Configure VPC Service Controls](/composer/docs/composer-3/configure-vpc-sc)"]]
