Repository navigation
Real EU gateway data (42 clusters) + release via assets - #1
Merged
Merged
Conversation
Replaces the placeholder scaffold with the LLMGateway Clusters fleet. The wiki renders paired NAT addresses as one unseparated string (18.119.53.2363.130.37.65). Several split more than one way with every candidate parsing as valid IPv4, so each was resolved against AWS ip-ranges.json, GCP cloud.json and Azure service tags, accepting a split only when both addresses fall inside the region the row claims. Two do not split the way they look: tfy-aws-fra-gtw -> 3.65.93.12 + 63.181.139.3 tfy-aws-hnd-gtw -> 54.238.73.1 + 18.178.26.39 Two wiki region codes are also wrong and corrected here: mad is eu-south-2 (not ap-south-2) and zrh is eu-central-2 (not eu-central-1). Adds a status field: 15 clusters are live with a published endpoint, 27 have NAT addresses allocated but no endpoint yet. Both are published so customers can allowlist ahead of a region activating. hostname is now required only for live entries, and must agree with its airport_code. Control-plane IPs for both planes, and the US gateway fleet, are still to come; those files are absent rather than stubbed.
The org ruleset on main requires pull requests, so the release workflow's commit-and-push step could never succeed. Rather than ask for a bot bypass, stop tracking dist/ at all: it is a build artifact, CI builds it and attaches it to the release, and gh creates the tag at the merge commit. The diff baseline for release notes now comes from the previous release's nat-ips.json asset rather than from git, so old releases must not be deleted. Consumer URLs are unaffected - they already pointed at release assets.
The diff job builds the base branch's data/ with the PR's build.py, so this PR's new required status field made the baseline build crash with KeyError. Read gateway-only keys defensively, and mark the job continue-on-error: it exists to render a reviewer-facing diff, and validate is the real gate.
Proposed IP changesAllowlist 28 new addresses before they start carrying traffic, 15 days after this release. EU ·
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8a9e73a. Configure here.
…thub Per review: - status is gone. A cluster without a published endpoint simply has no hostname, which carries the same information without a second field to keep in sync. live_count/provisioned_count drop out of the envelope too. - CONTRIBUTING.md removed; the README already covers the edit flow and the wiki transcription hazard. - scripts/ moved to .github/scripts/, matching truefoundry/models. The move broke ROOT, which was parent.parent and is now parents[2]. validate.py failed loudly on the missing schema, but build.py just produced an empty build - in CI that would have published a release saying there is nothing to allowlist. build.py now refuses to run when data/ yields no files.
dunefro
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the placeholder scaffold with the LLMGateway Clusters fleet, and reworks releases so they don't need to push to
main.Data
42 gateway clusters on
*.gateway.truefoundry.ai, intodata/eu/gateway.json. 15 live, 27 provisioned.The wiki's NAT cells are corrupted — paired addresses render as one unseparated string (
18.119.53.2363.130.37.65). Several split more than one way and every candidate parses as valid IPv4, so none of these were eyeballed. Each was resolved against AWSip-ranges.json, GCPcloud.jsonand Azure service tags, accepting a split only when both addresses fall inside the region the row claims. All 42 resolved; zero ambiguous.Two do not split the way they look:
tfy-aws-fra-gtw3.65.93.126+3.181.139.33.65.93.12+63.181.139.3tfy-aws-hnd-gtw54.238.73.11+8.178.26.3954.238.73.1+18.178.26.393.181.139.3and8.178.26.39are in no AWS range at all.Two wiki region codes are wrong and are corrected here, both confirmed the same way:
tfy-aws-mad-gtw:ap-south-2→eu-south-2tfy-aws-zrh-gtw:eu-central-1→eu-central-2Worth fixing on the wiki too.
Schema
Adds
status(live|provisioned). 27 clusters have NAT addresses allocated but no published endpoint, sohostnameis now required only forliveentries, and must agree with itsairport_code. Both statuses are published — allowlisting a provisioned IP costs nothing and avoids an urgent firewall change when a region activates.Release mechanics
The ruleset on
mainrequires PRs, so the old commit-dist-back-to-main step could never succeed.dist/is now untracked; CI builds it and attaches it to the release, andghcreates the tag at the merge commit. Diff baseline comes from the previous release's asset, so old releases must not be deleted.Still missing
data/eu/control-plane.json,data/us/control-plane.json,data/us/gateway.json— not on the source page. Absent rather than stubbed.Not yet decided
Whether to publish the 27 provisioned regions at all. They're included with
status: provisioned; say the word and I'll filter to the 15 live ones.Note
Medium Risk
Customers must switch allowlist URLs/format from legacy
nat-ips.jsonto per-plane releases; incorrect NAT data would break customer firewall rules, though CI validation and rollup checks reduce that risk.Overview
Replaces the placeholder NAT IP repo layout with a hostname-centric IP ranges model and ships real EU AI Gateway egress allowlists.
Data & schema: Source of truth moves from
data/<plane>/*.jsontoeu/ip-ranges.jsonandus/ip-ranges.json(US empty for now). Endpoints are keyed byhostnameandnat_ips, with optionalairport_codefor PoPs and rollup hostnames likegateway.truefoundry.ai/eu.gateway.truefoundry.ai. Placeholder entries, combinednat-ips.json, and the oldschema/+ rootscripts/are removed.Tooling: New JSON Schema under
.github/schema/, with validate/build/release-notes scripts under.github/scripts/. Validation enforces ordering, public CIDRs, and that geolocated gatewaynat_ipsmatch the union of their airport endpoints.Release & CI:
dist/is generated only in CI (gitignored)—no commit back tomain. Releases are created withghat the merge commit, attacheu.json/us.json(+.txt), diff against the previous release’s assets, and skip publishing when no addresses changed. README documents the 15-day activation window for new IPs.Reviewed by Cursor Bugbot for commit 7b13c09. Bugbot is set up for automated code reviews on this repo. Configure here.