How to configure firewall rules for Cloud Composer

foreign [Music] you'll learn about the firewall rules involved with Cloud composer and how to configure them correctly to avoid failures while creating a composer environment let's begin by looking at the list of firewall rules that may be required for creating a cloud composer environment these firewall rules make sure that no firewall rules cause failures like when you have a firewall rule that the nice whole Iris traffic in this video I'll walk you through the firewall routes involved with stealth composer show how to create them and finally I'll create a cloud composer environment first your Cloud composer environment must resolve the IP addresses of Google services for this you must configure public DNS or Cloud DNS in your project if you choose to configure public DNS keep in mind that you will need to resolve several public serving IP addresses and you'd have to adjust firewall rules accordingly with Cloud DNS you only need to configure connectivity to Google apis and services through private.googleapis.com or restricted.googleapis.com hence gold Cloud recommends configuring Cloud DNS to configure Cloud DNS refer to the following documentation I configured Cloud DNS for private.googleapis.com in my project as shown here moving on the second firewall rule enables the traffic from the nodes in your environment's GK cluster to reach the private Google api's IP range if you are not using VPC service controls or the restricted Google api's IP range if you are using VPC service controls depending on which one you have configured in Cloud DNS note that you need the default internet gateway to contact the services other firewall rule that allows egress for TCP Port 443 set the destination to the IP range you chose in this example I'll add the IP range to point to private Google apis let's create that firewall rule in the Google console go to VPC Network firewall click on create firewall rule at the top right give the firewall rule a name I'll specify composer Google services optionally you can give the roller description you can also enable logs if you want to use them for troubleshooting select a network I'll create my environment under my net so I choose that I'll leave the default priority of 1000 select egress and allow you must apply this Rule and all other rules I cover in this video to one of these targets a network tag that you will apply to your environment your environment service account or all instances in the network where you create your environment I'll apply my firewall rule to a network tag called my tag and the destination filter will be the private Google apis IP range that is 199.36.153.8 30. Skip Source filter is not new allow TCP Port 443 finally click on create there you go the firewall role is created next step is to allow nodes to communicate with each other for this add a firewall rule that allows egress for all TCP and UDP ports set the destination to the environment subnet primary IP range the subnet primary IP range is the same as the null IP range in this environment the range is 10.128.0.0 20. after adding this firewall rule here's how it looks now allow connectivity from nodes to ports in your environments cluster for this add a firewall load that allows egress for all TCP and UDP ports set the destination to the Pod secondary IP range this is how it looks after adding this firewall rule next allow connectivity from the notes to the gke control plane IP range for this Allah firewall rule that allows egress for on TCP and UDP Port set the destination to the GK control plane IP range after adding this firewall rule the list of roles will look as shown here finally it is recommended that your private IP environments communicate internally through private service connect instead of VPC bearings private service connect PSE connects the composer service project and the composer tenant Project without the use of VPC pairings PSC is preferred over VPC pairings because VPC bearings have limitations that can become more evident in large-scale networks PSE is the default option for private IP environments by default when you create a composite environment the environment subnet will be used for the PSE endpoint you only need a firewall rule for PSE if you want to use a different subnetwork for the PSE endpoint in my example I'll use the default option yay you have successfully configured all the firewall rules all right now that you have configured the firewall rules create a cloud composer environment congratulations you have successfully created a private IP Cloud composer environment in a project with configured firewall rules before concluding I would like to share a couple of caveats if your project has non-default firewall rules that is overridden implied firewall rules or modified pre-populated rules then you should configure firewall rules or if your project has a firewall rule that denies or lingers traffic then Cloud composer might fail to create an environment to avoid such issues you can Define The Selective allow rules shown on this video and give them a higher priority than the denied egress rule for more information about composer firewall rules check out this documentation thank you for watching [Music] foreign foreign