[SergK]

Summary

Bitbucket Cloud refuses SSH on bitbucket.org from 2026-11-12 (brownouts) and fully after 2026-12-10. HTTPS stays on bitbucket.org. Host keys do not change. Jira: EPMDEDP-17500.

GitServer.spec.gitHost stays bitbucket.org. The operator maps the host for SSH only:

SSHHost(gitProvider, gitHost)
  if gitProvider == bitbucket and gitHost equals "bitbucket.org" (case-insensitive)
    return "ssh.bitbucket.org"
  return gitHost

 GetProjectGitUrl              # clone, push, branch checks, stale check
   GetSSHUrl
+    SSHHost
   GetHTTPSUrl                 # unchanged: gitHost
 checkConnectionToGitServer
   extractSshData
+    SSHHost
 put_gitwebrepourl             # unchanged: https://<gitHost>/<project>

 ssh-known-hosts ConfigMap (includeDefaultProviders: true)
   bitbucket.org     ecdsa | ed25519 | rsa
+  ssh.bitbucket.org ecdsa | ed25519 | rsa   # same keys, https://bitbucket.org/site/ssh

CRD field text, chart README, values.yaml and docs/ssh-known-hosts.md list ssh.bitbucket.org.

Evidence

• Before: GetSSHUrl(bitbucket, bitbucket.org, "workspace/repo") → git@bitbucket.org:workspace/repo.git
  After: → git@ssh.bitbucket.org:workspace/repo.git (TestGetSSHUrl)
• TestSSHHost: bitbucket.org and BitBucket.org map; ssh.bitbucket.org, bitbucket.example.com and github + bitbucket.org stay unchanged.
• Test_extractSshData_bitbucketCloudUsesSSHHost: connection check dials ssh.bitbucket.org.
• make lint: 0 issues. go test ./...: pass, except pkg/webhook (needs envtest; fails on the base branch too).

Merge Danger

Door: two-way

Revert restores the bitbucket.org SSH host. No CR or stored data changes.

Blast Radius: Bitbucket Cloud SSH

GitServers with gitProvider: bitbucket and gitHost: bitbucket.org connect to ssh.bitbucket.org:22 after rollout. Requires outbound TCP 22 to ssh.bitbucket.org. Installations with knownHosts.includeDefaultProviders: false must add ssh.bitbucket.org to knownHosts.entries, or the GitServer reports connected: false. Self-hosted Bitbucket, GitHub, GitLab and Gerrit: no change.

[epmd-edp]

Pipeline review-codebase-operator-master-lxprm — ✗ Failed

Status	Task	Duration
✓ Passed	github-set-pending-status	5s
✗ Failed	fetch-repository	11s
✓ Passed	github-report-pipeline-status	5s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.

✗ fetch-repository / clone — exit code 1, last 100 log lines

+ '[' false '=' true ]
+ '[' true '=' true ]
+ cp -R /workspace/ssh-directory /tekton/home/.ssh
+ chmod 700 /tekton/home/.ssh
+ echo 
+ chmod -R 400 /tekton/home/.ssh/id_rsa /tekton/home/.ssh/secretString /tekton/home/.ssh/token
+ '[' false '=' true ]
+ CHECKOUT_DIR=/workspace/output/source
+ '[' true '=' true ]
+ cleandir
+ '[' -d /workspace/output/source ]
+ test -z 
+ test -z 
+ test -z 
+ /ko-app/git-init '-url=git@github.com:epam/edp-codebase-operator.git' '-revision=EPMDEDP-17500-bitbucket-ssh-host' '-refspec=' '-path=/workspace/output/source' '-sslVerify=true' '-submodules=true' '-depth=2' '-sparseCheckoutDirectories='
{"level":"warn","ts":1793891399.1166112,"caller":"git/git.go:278","msg":"URL(\"git@github.com:epam/edp-codebase-operator.git\") appears to need SSH authentication but no SSH credentials have been provided"}
{"level":"error","ts":1793891400.245647,"caller":"git/git.go:55","msg":"Error running git [fetch --recurse-submodules=yes --depth=2 origin --update-head-ok --force EPMDEDP-17500-bitbucket-ssh-host]: exit status 128\nWarning: Permanently added 'github.com,140.82.121.3' (ECDSA) to the list of known hosts.\r\nfatal: couldn't find remote ref EPMDEDP-17500-bitbucket-ssh-host\n","stacktrace":"github.com/tektoncd/pipeline/pkg/git.run\n\tgithub.com/tektoncd/pipeline/pkg/git/git.go:55\ngithub.com/tektoncd/pipeline/pkg/git.Fetch\n\tgithub.com/tektoncd/pipeline/pkg/git/git.go:150\nmain.main\n\tgithub.com/tektoncd/pipeline/cmd/git-init/main.go:53\nruntime.main\n\truntime/proc.go:225"}
{"level":"fatal","ts":1793891400.2457044,"caller":"git-init/main.go:54","msg":"Error fetching git repository: failed to fetch [EPMDEDP-17500-bitbucket-ssh-host]: exit status 128","stacktrace":"main.main\n\tgithub.com/tektoncd/pipeline/cmd/git-init/main.go:54\nruntime.main\n\truntime/proc.go:225"}