Ansible Galaxy IPs

Get Help
1

Trying to pull down Ansible Galaxy roles. Getting errors. Is there a CIDR block to whitelist for Ansible Galaxy? I couldnt find any IPs to whitelist. Had my FW team whitelist galaxy.ansible.com and still failing. Tried wget as well and couldnt download the .tar. Any help is appreciated.

Using ansible-galaxy
ERROR! Failed to download collection tar from ‘default’ due to the following unforeseen error: <urlopen error [Errno 104] Connection reset by peer>. <urlopen error [Errno 104] Connection reset by peer>

Using wget
GnuTLS: Error in the pull function.
Unable to establish SSL connection.

2

It looks like it is configured with round robin DNS?

dig galaxy.ansible.com +short
172.67.68.251
104.26.0.234
104.26.1.234

Try adding the IP addresses above to the allow list?

3

Same error after adding those to the FW.

ERROR! Failed to download collection tar from ‘default’ due to the following unforeseen error: <urlopen error [Errno 104] Connection reset by peer>. <urlopen error [Errno 104] Connection reset by peer>

4

Downloads are served through aws s3, from ansible-galaxy.s3.amazonaws.com. The documentation we have indicates to not restrict based on IP, but based on hostnames, unless you have something that will continuously update rules based on the current resolution instead.

2 Likes
5

So I just need to have the FW team white list ansible-galaxy.s3.amazonaws.com? Tried having them *.ansible.com, but that didnt work.