What are we doing?
We'll start a gradual rollout of changing our A records in DNS starting at 22:00 UTC on Sunday, July 29 2018 to point to new IP addresses. The rollout is expected to be completed for all our customers two weeks later, i.e by the 15th of August.
There will not be any downtime for this migration, and most people will not have to do anything differently because of this migration.
Why are we doing this?
Bitbucket has seen amazing growth over recent years, with millions of users working in Bitbucket to build better software. As part of that, we are planning a Cloud migration which will allow us to:
- Take advantage of more auto-scaling capabilities in the Cloud
- Easily add/remove network services capacity
- Co-locate with our Atlassian PaaS platform that supports Jira, Confluence, StatusPage, and other Atlassian products
- Scale Bitbucket's infrastructure to meet future demand
- Our new Cloud IP address space, along with some underlying network improvements, would make response times noticeably faster for some users, depending on location
- Just as important, these changes make it easier for us to improve upstream network connectivity and load balancing
How will this affect you?
Most users will not have to do anything special for this migration. Your DNS servers should pick up the new IPs within a few minutes of the migration, and your systems should start using the new IPs right away. We'll keep the old IPs running for a few weeks afterwards just in case, though.
Firewall considerations
If you control inbound or outbound access with a firewall, then you may need to update your configuration. Please whitelist these new IPs now; you should be able to remove the old IPs after the migration is complete.
New destination IP addresses for bitbucket.org, bitbucket.com, api.bitbucket.org, bitbucket.io, bytebucket.org, altssh.bitbucket.org will be:
- IPv4: 18.205.93.0/25, 18.234.32.128/25, and 13.52.5.0/25
- IPv6: 2406:da00:ff00::0/96*
Note: this IPv6 range includes subnets that are not necessary owned by Atlassian, but is the longest subnet that matches *all* Bitbucket IPv6 Atlassian IPs. We will post a list of the exact IPv6 addresses at https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html soon.
Webhooks IPs will remain unchanged as per https://confluence.atlassian.com/bitbucket/manage-webhooks-735643732.html
SSH considerations
Our server's SSH key is not changing, so most SSH clients will continue to work without interruption. However, a small number of users may see a warning similar to this when they push or pull over SSH:
Warning: the RSA host key for 'bitbucket.org' differs from the key for the IP address '18.205.93.1'
The warning message will also tell you which lines in your ~/.ssh/known_hosts need to change. Open that file in your favorite editor, remove or comment out those lines, then retry your push or pull.
Additional resources
- Atlassian Public IP ranges JSON: https://ip-ranges.atlassian.com/ (will be updated with the new addresses as part of the new IPs rollout)
- https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html (will be updated with the new addresses as part of the new IPs rollout)
