Configuring Shared VPC

This page describes the Shared VPC network and host project requirements for Cloud Composer.

Shared VPC enables organizations to establish budgeting and access control boundaries at the project level while allowing for secure and efficient communication using private IPs across those boundaries. In the Shared VPC configuration, Cloud Composer can invoke services hosted in other Google Cloud projects in the same organization without exposing services to the public Internet.

Important notice

  • Shared VPC requires that you designate a host project to which networks and subnetworks belong and a service project, which is attached to the host project. When Cloud Composer participates in a Shared VPC, the Cloud Composer environment is in the service project.
  • To set up Shared VPC, select the following IP ranges in the host project:
    • Primary IP Range of the subnet used by GKE nodes that Cloud Composer uses as its compute layer
    • Secondary IP Range for GKE Services
    • Secondary IP Range for GKE Pods
  • Secondary IP Ranges cannot overlap with any other secondary ranges in this VPC.
  • Ensure that secondary ranges are large enough to accommodate the cluster's size and anticipated growth. For example, the network prefixes of the secondary ranges for a 3-node Cloud Composer environment should be no longer than:

    • Pods: /22
    • Services: /27

    See Creating a VPC-native cluster for guidelines on configuring secondary ranges for Pods and Services.

  • The primary address range of the subnet should accommodate anticipated growth and account for the reserved IP addresses. Using the previous 3-node environment example, the network prefix of the subnet's primary address range should be no longer than /29.


  1. Find the following project IDs and project numbers:
    • Host project: The project that contains the Shared VPC network.
    • Service project: The project that contains the Cloud Composer environment.
  2. Prepare your organization.
  3. Enable the GKE API in your host and service projects.

Host project configuration

  1. Choose one of the following options to allocate and configure networking resources. For each option, you must name the secondary IP ranges for pods and services.

  2. Set up Shared VPC and attach a service project, which you will use to host Cloud Composer environments. If the Shared VPC already exists, go directly to the Attaching a service project step. When attaching a project, leave the default VPC Network permissions in place.

  3. Grant the compute.networkUser role to the Google APIs service account ( at the project level. This is a requirement for managed instance groups used with Shared VPC, which GKE uses, because tasks like instance creation are performed by this type of service account.

  4. In the host project, grant the compute.networkUser role to the GKE service accounts ( To do this, go to the VPC networks list and select the target network. This permission needs to be granted at the network level to allow the service account to set up the VPC peering arcitecture required by Cloud Composer.

  5. Grant the Host Service Agent User role to the GKE Service Account of the service project. This allows the GKE Service Account of the service project to use the GKE Service Account of the host project to configure shared network resources.

  6. If this is the first Cloud Composer environment in the current project, you must first provision the Composer Agent Service Account: gcloud beta services identity create

  7. Grant Composer Agent Service Account ( a role of Composer Shared VPC Agent in case of Private IP environments or a role of Compute Network User in case of Public IP Composer environments.

You've completed Shared VPC network configuration for the host project.

What's next

Using the Cloud SDK, create a Cloud Composer environment and provide the host project's network and subnetwork as configuration parameters.