Configuring Shared VPC

Cloud Composer 1 | Cloud Composer 2

This page describes the Shared VPC network and host project requirements for Cloud Composer.

Shared VPC enables organizations to establish budgeting and access control boundaries at the project level while allowing for secure and efficient communication using private IPs across those boundaries. In the Shared VPC configuration, Cloud Composer can invoke services hosted in other Google Cloud projects in the same organization without exposing services to the public internet.

Guidelines for Shared VPC

Service and Host Projects for Cloud Composer
Figure 1. Service and Host Projects for Cloud Composer
  • Shared VPC requires that you designate a host project to which networks and subnetworks belong and a service project, which is attached to the host project. When Cloud Composer participates in a Shared VPC, the Cloud Composer environment is in the service project.

  • To set up Shared VPC, select the following IP ranges in the host project:

    • Primary IP Range of the subnet used by GKE nodes that Cloud Composer uses as its Compute Engine layer.
    • Secondary IP Range for GKE services.
    • Secondary IP Range for GKE pods.
  • Secondary IP Ranges cannot overlap with any other secondary ranges in this VPC.

  • Ensure that secondary ranges are large enough to accommodate the cluster's size and your environment scaling.

    See Creating a VPC-native cluster for guidelines on configuring secondary ranges for pods and services.

  • The primary address range of the subnet should accommodate anticipated growth and account for the reserved IP addresses.

  • If you use the IP Masquerate Agent and the Private IP configuration for your environments, then add the IP ranges of Nodes and Pods to the nonMasqueradeCIDRs section of the ip-masq-agent ConfigMap. For more information, see Configuring an IP masquerade agent.

Preparation

  1. Find the following project IDs and project numbers:

    • Host project: The project that contains the Shared VPC network.
    • Service project: The project that contains the Cloud Composer environment.
  2. Prepare your organization.

  3. Enable the GKE API in your host and service projects.

  4. If you configure Cloud Composer in Private IP mode or in Private IP mode within VPC SC then follow the instructions related to configuring DNS and Firewall rules as described in Private IP instructions and VPC SC instructions

Configure the host project

Configure the host project as described further.

(Private IP) Enable Private Google Access

If you plan to use Private IP environments, then enable Private Google Access for the subnet in the host project. You can do so on the next step, when you configure networking resources for a new or an already existing subnet.

If you plan to use Public IP environments, we still recommend enabling Private Google Access for the subnet in the host project. If you choose not to use Private Google Access, then make you are not blocking traffic that otherwise the Implied IPv4 allow egress Firewall rule would allow - this is needed to reach *.googleapis.com endpoints successfully.

Configure networking resources

Choose one of the following options to allocate and configure networking resources. For each option, you must name the secondary IP ranges for pods and services.

Set up Shared VPC and attach the service project

  1. If not already done, Set up Shared VPC. If you already have set up Shared VPC, skip to the next step.

  2. Attach the service project, which you use to host Cloud Composer environments.

    When attaching a project, leave the default VPC Network permissions in place.

Edit permissions for the Google APIs service account

In the host project, edit permissions for the Google APIs service account, SERVICE_PROJECT_NUMBER@cloudservices.gserviceaccount.com.

For this account, add another role, compute.networkUser at the project level. This is a requirement for managed instance groups used with Shared VPC because this type of service account performs tasks such as instance creation.

Edit permissions for GKE service accounts

In the host project, edit permissions for the GKE service accounts, service-SERVICE_PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com.

For each service account, add another role, compute.networkUser.

Grant this role at the subnet level to allow a service account to set up the VPC peerings required by Cloud Composer. Please note, that in this case you will need to explicitly specify the subnetwork to be used by the environment, since the GKE cluster may lack permissions to find it within the network.

As an alternative, you can grant this role for the whole host project. In this case, the service project's GKE service account has permissions to use any subnet in the host project.

Edit permissions for the GKE Service Account of the service project

In the host project, edit permissions for the GKE Service Account of the service project.

For this account, add another role, Host Service Agent User.

This allows the GKE Service Account of the service project to use the GKE Service Account of the host project to configure shared network resources.

Configure connectivity to *.pkg.dev

In the host project, make sure that DNS *.pkg.dev resolves to the range you defined for Private Google Access. The following example will use 199.36.153.4/30.

To do that, create a new zone as: CNAME *.pkg.dev -> pkg.dev. A pkg.dev. -> 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7

Edit permissions for the Composer Agent Service Account

  1. In the service project, if this is the first Cloud Composer environment, then provision the Composer Agent Service Account: gcloud beta services identity create --service=composer.googleapis.com.

  2. In the host project:

    1. Edit permissions for the Composer Agent Service Account, service-SERVICE_PROJECT_NUMBER@cloudcomposer-accounts.iam.gserviceaccount.com)

    2. For this account, add another role:

      • For Private IP environments, add the Composer Shared VPC Agent role.

      • For Public IP environments, add the Compute Network User role.

You've completed the Shared VPC network configuration for the host project.

What's next