Pada 15 September 2026, semua lingkungan Cloud Composer 1 dan Cloud Composer 2 versi 2.0.x akan mencapai akhir masa pakainya yang direncanakan, dan Anda tidak akan dapat menggunakannya. Sebaiknya rencanakan migrasi ke Cloud Composer 3.
Penyamaran IP adalah bentuk penafsiran alamat jaringan (NAT) yang digunakan untuk
melakukan penafsiran alamat IP many-to-one. Hal ini memungkinkan beberapa klien untuk
mengakses tujuan dari satu alamat IP.
Cloud Composer menjalankan beban kerja Anda di GKE. Agar dapat berfungsi dengan benar, VM memerlukan rentang IP untuk node (VM) serta Pod dan Layanan GKE. Saat DAG dan tugas Airflow
berkomunikasi dengan layanan lain, keduanya menggunakan IP Pod dan rentang IP Pod ini harus
dapat dirutekan ke dan dari tujuan apa pun yang berinteraksi dengan tugas.
Dengan agen IP Masquerade, Anda memiliki opsi untuk menerjemahkan alamat IP Pod ke alamat IP node, sehingga tujuan dan layanan yang ditargetkan dari DAG dan tugas Airflow hanya menerima paket dari alamat IP node, bukan alamat IP Pod. Hal ini berguna di lingkungan yang hanya mengharapkan untuk
menerima paket dari alamat IP node atau jika rentang IP Pod tidak
dapat dirutekan di luar cluster.
Selain itu, Anda dapat menggunakan agen Penyamaran IP untuk menyimpan rentang jaringan dalam
konfigurasi jaringan. Misalnya, Anda dapat menggunakan rentang jaringan
terpisah untuk Pod di dalam cluster lingkungan dan menyamarkan traffic ini
sebagai berasal dari rentang alamat IP node. Dengan cara ini, Anda menghemat ruang alamat IP
dalam satu rentang dengan menggunakan alamat IP dari rentang yang berbeda untuk Pod di
cluster lingkungan Anda.
Contoh:
Anda menggunakan rentang 10.0.0.0/8 untuk VM dan hanya rentang ini yang diizinkan oleh
aturan firewall Anda.
Untuk menyimpan rentang jaringan, Anda menggunakan rentang yang berbeda (misalnya,
192.168.0.0/16) untuk Pod di cluster lingkungan Anda.
Agar dapat terhubung ke layanan apa pun dari Pod (pekerja Airflow), penyamaran IP
diperlukan; jika tidak, layanan akan menerima traffic dari
192.168.0.0/16 dan menghentikannya karena aturan firewall. Dengan mengaktifkan dan mengonfigurasi agen IP Masquerade, layanan akan mendapatkan permintaan dari 10.0.0.0/8, yang diterima.
Sebelum memulai
Anda tidak dapat mengaktifkan agen Penyamaran IP di konsol Google Cloud .
Untuk menggunakan fitur ini, Anda harus membuat lingkungan dengan GKE
versi 1.22.7 atau yang lebih baru.
Agen IP Masquerade tidak tersedia untuk lingkungan yang dibuat
di versi GKE sebelumnya, meskipun GKE
diupgrade ke versi 1.22.7 dan yang lebih baru.
Jika Anda mengaktifkan agen Penyamaran IP, EgressNatPolicy GKE default akan diganti dengan definisi Cloud Composer. Jika agen IP Masquerade tidak diaktifkan, traffic keluar tidak akan disamarkan dan akan menggunakan EgressNatPolicy GKE default.
Mengaktifkan agen Penyamaran IP untuk lingkungan yang ada
Anda tidak dapat mengaktifkan agen IP Masquerade untuk lingkungan yang ada.
Mengaktifkan agen Penyamaran IP saat membuat lingkungan
Anda dapat mengaktifkan agen Penyamaran IP saat membuat lingkungan.
Untuk mengetahui informasi selengkapnya tentang cara membuat lingkungan Cloud Composer,
lihat Membuat lingkungan.
Konsol
Anda tidak dapat mengaktifkan agen Penyamaran IP di konsol Google Cloud .
gcloud
Saat Anda membuat lingkungan, argumen --enable-ip-masq-agent
akan mengaktifkan agen IP Masqerade.
LOCATION dengan region tempat lingkungan tersebut berada.
ENVIRONMENT_NAME dengan nama lingkungan.
Contoh:
// POST https://composer.googleapis.com/v1/{parent=projects/*/locations/*}/environments{"name":"projects/example-project/locations/us-central1/environments/example-environment","config":{"softwareConfig":{"imageVersion":"composer-2.13.9-airflow-2.10.5"},"nodeConfig":{"enableIpMasqAgent":true}}}
Terraform
Saat Anda membuat lingkungan, kolom enable_ip_masq_agent
di blok node_config akan mengaktifkan agen IP Masqerade.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-26 UTC."],[[["\u003cp\u003eThe IP Masquerade agent in Cloud Composer allows multiple clients to access a destination from a single IP address, translating Pod IP addresses to node IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eEnabling the IP Masquerade agent is recommended to manage IP address shortages and ensure that services only receive packets from node IP addresses, which is useful when Pod IP ranges are not routable outside of the cluster.\u003c/p\u003e\n"],["\u003cp\u003eYou can only enable the IP Masquerade agent during the creation of a new environment with GKE version 1.22.7 or later, and it cannot be enabled for existing environments.\u003c/p\u003e\n"],["\u003cp\u003eThe IP Masquerade agent can be enabled via the \u003ccode\u003egcloud\u003c/code\u003e command-line tool, the API, or Terraform, using specific configurations for each method, but not through the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eWhen configuring the IP Masquerade agent, non-masquerade destinations must at least include the cluster's node and Pod IP address ranges due to Cloud Composer enabling intranode visibility.\u003c/p\u003e\n"]]],[],null,["# Enable the IP Masquerade agent in Cloud Composer environments\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/change-networking-type#comparison \"View this page for Cloud Composer 3\") \\| **Cloud Composer 2** \\| [Cloud Composer 1](/composer/docs/composer-1/enable-ip-masquerade-agent \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page describes how to enable the IP Masquerade agent for your environment.\n| **Important:** Consider using the IP Masquerade agent if your project is impacted by the shortage of IP addresses. By enabling the IP Masquerade agent, you can use your environment's cluster IP addresses to communicate with external services.\n\nAbout the IP Masquerade agent in Cloud Composer\n-----------------------------------------------\n\nCloud Composer supports\nthe [IP Masquerade agent](/kubernetes-engine/docs/how-to/ip-masquerade-agent) for your environments.\n\n*IP masquerading* is a form of network address translation (NAT) used to\nperform many-to-one IP address translations. This allows multiple clients to\naccess a destination from a single IP address.\n\nCloud Composer runs your workloads on GKE. For\ncorrect function, it requires IP ranges for nodes (VMs) as well as\nGKE Pods and Services. When Airflow DAGs and tasks\ncommunicate with other services, they use Pod IPs and these Pod IP ranges need\nto be routable to and from any destinations that the tasks interact with.\n\nWith the IP Masquerade agent, you have the option to translate Pod IP\naddresses to node IP addresses, so that destinations and services targeted\nfrom Airflow DAGs and tasks only receive packets from node IP addresses\ninstead of Pod IP addresses. This is useful in environments that expect to\nonly receive packets from node IP addresses or where Pod IP ranges are not\nroutable outside of the cluster.\n\nIn addition, you can use the IP Masquerade agent to save network ranges in\nyour networking configuration. For example, you can use a separate network\nrange for Pods inside your environment's cluster and masquerade this traffic\nas coming from the node IP address range. In this way, you save IP address\nspace in one range by using IP addresses from a different range for Pods in\nyour environment's cluster.\n\nFor example:\n\n1. You use the `10.0.0.0/8` range for VMs and only this range is allowed by\n your firewall rules.\n\n2. To save network ranges, you use a different range (for example,\n `192.168.0.0/16`) for Pods in your environment's cluster.\n\n3. To be able to connect to any service from a Pod (Airflow worker), IP\n masquerading is needed; otherwise the service receives traffic from\n `192.168.0.0/16` and drops it because of a firewall rule. With the IP\n Masquerade agent enabled and configured, the service gets requests from\n `10.0.0.0/8`, which are accepted.\n\nBefore you begin\n----------------\n\n- It is not possible to enable the IP Masquerade agent in Google Cloud console.\n\n- To use this feature, you must create an environment with GKE\n 1.22.7 or later version.\n\n- The IP Masquerade agent is not available for environments that were created\n in earlier GKE versions, even if GKE was\n upgraded to 1.22.7 and later versions.\n\n- If you enable the IP Masquerade agent, the default\n [GKE's EgressNatPolicy](/kubernetes-engine/docs/how-to/egress-nat-policy-ip-masq-autopilot) will be\n replaced with Cloud Composer's definition. If the IP Masquerade\n agent is not enabled, the outgoing traffic won't be masqueraded and will\n use the default GKE's EgressNatPolicy.\n\nEnable the IP Masquerade agent for an existing environment\n----------------------------------------------------------\n\nIt is not possible to enable the IP Masquerade agent for an existing\nenvironment.\n\nEnable the IP Masquerade agent when creating an environment\n-----------------------------------------------------------\n\nYou can enable the IP Masquerade agent when you create an environment.\n\nFor more information about creating Cloud Composer environments,\nsee [Create environment](/composer/docs/composer-2/create-environments). \n\n### Console\n\nIt is not possible to enable the IP Masquerade agent in Google Cloud console.\n\n### gcloud\n\nWhen you create an environment, the `--enable-ip-masq-agent` argument\nenables the IP Masqerade agent. \n\n gcloud composer environments create \u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --image-version composer-2.14.0-airflow-2.10.5 \\\n --enable-ip-masq-agent\n\nReplace:\n\n- `ENVIRONMENT_NAME` with the name of the environment.\n- `LOCATION` with the region where the environment is located.\n\nExample: \n\n gcloud composer environments create example-environment \\\n --location us-central1 \\\n --image-version composer-2.14.0-airflow-2.10.5 \\\n --enable-ip-masq-agent\n\n### API\n\nConstruct an [`environments.create`](/composer/docs/reference/rest/v1/projects.locations.environments/create) API request.\nSpecify the configuration in the [`Environment`](/composer/docs/reference/rest/v1/projects.locations.environments#Environment)\nresource. \n\n {\n \"name\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/environments/\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e\",\n \"config\": {\n \"softwareConfig\": {\n \"imageVersion\": \"composer-2.14.0-airflow-2.10.5\"\n },\n \"nodeConfig\": {\n \"enableIpMasqAgent\": true\n }\n }\n }\n\nReplace:\n\n- `PROJECT_ID` with the [Project ID](/resource-manager/docs/creating-managing-projects).\n- `LOCATION` with the region where the environment is located.\n- `ENVIRONMENT_NAME` with the environment name.\n\nExample: \n\n // POST https://composer.googleapis.com/v1/{parent=projects/*/locations/*}/environments\n\n {\n \"name\": \"projects/example-project/locations/us-central1/environments/example-environment\",\n \"config\": {\n \"softwareConfig\": {\n \"imageVersion\": \"composer-2.14.0-airflow-2.10.5\"\n },\n \"nodeConfig\": {\n \"enableIpMasqAgent\": true\n }\n }\n }\n\n### Terraform\n\nWhen you create an environment, the `enable_ip_masq_agent`\nfield in the `node_config` block enables the IP Masqerade agent. \n\n resource \"google_composer_environment\" \"example_environment\" {\n provider = google-beta\n name = \"\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e\"\n region = \"\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n\n config {\n software_config {\n image_version = \"composer-2.14.0-airflow-2.10.5\"\n }\n node_config {\n enable_ip_masq_agent = true\n }\n }\n\nReplace:\n\n- `ENVIRONMENT_NAME` with the name of the environment.\n- `LOCATION` with the region where the environment is located.\n\nExample: \n\n resource \"google_composer_environment\" \"example_environment\" {\n provider = google-beta\n name = \"example-environment\"\n region = \"us-central1\"\n\n config {\n software_config {\n image_version = \"composer-2.14.0-airflow-2.10.5\"\n }\n node_config {\n enable_ip_masq_agent = true\n }\n }\n }\n\nConfigure the IP Masquerade agent\n---------------------------------\n\n| **Caution:** Cloud Composer enables [intranode visibility](/kubernetes-engine/docs/how-to/intranode-visibility) on GKE clusters. Therefore, non-masquerade destinations must at least include the cluster's node and Pod IP address range(s).\n\nFor more information about using and configuring the IP Masquerade agent in\nCloud Composer 2, see\n[Use Egress NAT Policy to configure IP masquerade in Autopilot clusters](/kubernetes-engine/docs/how-to/egress-nat-policy-ip-masq-autopilot).\n\n\nWhat's next\n-----------\n\n- [Create an environment](/composer/docs/composer-2/create-environments)\n- [Configure Shared VPC networking](/composer/docs/composer-2/configure-shared-vpc)\n- [Configure Private IP networking](/composer/docs/composer-2/configure-private-ip)"]]
