Bitbucket cannot connect to self-hosted runners

[Janneman Nortje]

Hi there, does anyone know if the source IP's of Bitbucket changed as the current IP whitelist we have is not allowing bitbucket pipelines to make an ssh connection to our self-hosted bitbucket runners? This started this morning 20 Nov 2024.

[Theodora Boudale]

Hi Janneman and welcome to the community!

We have made some changes, but I am confused by the following:

bitbucket pipelines to make an ssh connection to our self-hosted bitbucket runners

Do your builds run on Atlassian's infrastructure and have trouble connecting to your servers? Or do they run on your own servers with a self-hosted Bitbucket runner?

If your builds run on Atlassian's infrastructure:

We have recently updated our 1x/2x size option builds to operate from new, broader IP ranges.

For teams who need their builds to run from a more restricted set of IP addresses, we recommend using the atlassian-ip-ranges configuration available with our 4x/8x steps. This option provides enhanced security by limiting the IP addresses to a smaller, more manageable list. You can find more details about this configuration here. This configuration does not need to apply to all steps in a pipeline, just the steps that access secure resources.

Please Note: Opting for larger step sizes (4x/8x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

You can view the complete list of IP addresses used by the 1x/2x steps (or 4x/8x steps that have not been explicitly flagged to use atlassian-ip-ranges) in this JSON format. This list can be explicitly filtered for EC2 or S3 resources located in us-east-1 and us-west-2. We do not recommend or support adding these IP addresses into your firewall configuration.

Important Note: Relying solely on IP-based firewalls for securing your infrastructure is not recommended. Instead, consider implementing secure authentication methods for any services exposed to Bitbucket Pipelines, such as using OpenID Connect (OIDC).

If your builds run with a self-hosted Bitbucket runner behind a firewall:

We recommend upgrading the runner to the latest version if you haven't done so already:

• https://www.atlassian.com/blog/bitbucket/bitbucket-pipelines-runner-upgrade-required

The blog post has a section about Changes to IP Allowlisting.

If you're still experiencing issues with a self-hosted runner, it would be helpful to know:

1. The type of runner are you using and the version of the runner.

2. What operation fails, errors from commands that fail during the build, and errors from the runner's log (please sanitize private data in the log, if any, prior to sharing).

Kind regards,
Theodora