Configuring Shared VPC

This page describes the Shared VPC network and host project requirements for Cloud Composer.

Shared VPC enables organizations to establish budgeting and access control boundaries at the project level while allowing for secure and efficient communication using private IPs across those boundaries. In the context of a Cloud Composer environment, using a Shared VPC network means that workflows can invoke services hosted in other Google Cloud Platform projects in the same organization without exposing services to the public Internet.

Before you begin

  • Shared VPC is in Beta and requires the gcloud beta composer environments create command or the v1beta1 REST, or RPC API for Cloud Composer environment creation.

  • Shared VPC requires that you designate a host project to which networks and subnetworks belong and a service project, which is attached to the host project. When Cloud Composer participates in a Shared VPC, the Cloud Composer environment is in the service project.

  • You must configure the subnetwork that the Cloud Composer environment connects to for Alias IPs with the following two secondary IP ranges:

    • Pods: composer-pods
    • Services: composer-services
  • Ensure that the secondary ranges are large enough to accommodate the cluster's size and anticipated growth. For example, the network prefixes of the secondary ranges for a 3-node Cloud Composer environment should be no longer than:

    • Pods: /22
    • Services: /24
  • Because you cannot share a secondary range between environments and secondary ranges require a unique name for the subnet, each Cloud Composer environment that participates in a Shared VPC requires its own subnet. The primary address range of the subnet should accommodate anticipated growth and account for the reserved IP addresses. Using the previous 3-node environment example, the network prefix of the subnet's primary address range should be no longer than /29.

Configuring the host project

  1. Find the following project IDs and project numbers:
    • Host project: The project that contains the Shared VPC network.
    • Service project: The project that contains the Cloud Composer environment.
  2. Prepare your organization.
  3. Enable the GKE API in your host and service projects.
  4. Choose one of the following options to allocate and configure networking resources. For each option, you must name the secondary IP ranges composer-pods and composer-services.
  5. On the subnetwork, enable Shared VPC and grant the compute.networkUser role to the GKE service accounts.
  6. On the host project, grant the Host Service Agent User role to the GKE service robot.

You've completed Shared VPC network configuration for the host project.

What's next

Using the Cloud SDK, create a Cloud Composer environment and provide the host project's network and subnetwork as configuration parameters.

Was this page helpful? Let us know how we did:

Send feedback about...

Cloud Composer