How to allowlist Bitbucket's IP addresses

[gojanpaolo]

Hi! The installation guide says to

allowlist Bitbucket's IP addresses

But how do we actually do this?

I tried setting this in the values.yaml to see that atlantis would stop working. But atlantis was still working. Meaning this is not the place to set the ip addresses

service:
  type: LoadBalancer
  loadBalancerSourceRanges:
    - 1.2.3.4/32

[gojanpaolo]

Ah, looks like that loadBalancerSourceRanges is the correct place to set it.

The reason atlantis was working even when I did not include bitbucket ip addresses is that the webhook was sending requests to the ingress address directly. I changed the webhook to send request to the service loadBalancer.ingress.ip instead and now I'm able to control which ip address can go through it

[gojanpaolo]

Is this the correct list of Bitbucket IP addresses to allow?

*** taken from: https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/#Outgoing-Connections

The atlantis docs says to look at Outbound IPv4 addresses in https://www.runatlantis.io/docs/security.html#bitbucket-cloud-bitbucket-org which doesn't seem to work

13.52.5.96/28
13.236.8.224/28
18.136.214.96/28
18.184.99.224/28
18.234.32.224/28
18.246.31.224/28
52.215.192.224/28
104.192.137.240/28
104.192.138.240/28
104.192.140.240/28
104.192.142.240/28
104.192.143.240/28
185.166.143.240/28
185.166.142.240/28

2401:1d80:3000:100::/61
2401:1d80:3000:200::/61
2401:1d80:3000:300::/61
2401:1d80:3000:400::/61
2401:1d80:3000:500::/61
2401:1d80:3000:600::/61
2401:1d80:3000:700::/61
2406:da18:809:e04::/63
2406:da18:809:e06::/64
2406:da1c:1e0:a204::/63
2406:da1c:1e0:a206::/64
2600:1f14:824:304::/63
2600:1f14:824:306::/64
2600:1f18:2146:e304::/63
2600:1f18:2146:e306::/64
2600:1f1c:cc5:2304::/63
2a05:d014:f99:dd04::/63
2a05:d014:f99:dd06::/64
2a05:d018:34d:5804::/63
2a05:d018:34d:5806::/64