Global control plane

[dunefro]

Note

Medium Risk
Customers must switch allowlists from eu.json to global.json and add new control-plane CIDRs; release/PR diff logic depends on eu→global migration behaving correctly.

Overview
Replaces the EU control plane with a global control plane (global/ and global.json on Pages/releases) and documents that the former EU plane is now global. Build, validate, release notes, and CI path filters are updated accordingly, with backward-compatible diffs when the previous release or PR base still used eu.json / eu/.

Publishes control-plane egress on wildcard hostnames: *.truefoundry.cloud (two NAT IPs) in global/ip-ranges.json and *.us.truefoundry.cloud (one IP) in us/ip-ranges.json, which was previously empty. The JSON schema and validator now allow an optional *. prefix on hostnames only for control_plane endpoints.

Ships a proper GitHub Pages landing page (.github/pages/index.html) instead of the inline minimal HTML in the release workflow—download cards for global/US, live counts from JSON, copy-URL buttons, and allowlist guidance for gateway hostnames.

^{Reviewed by Cursor Bugbot for commit 4a28a46. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Proposed IP changes

Allowlist 3 new addresses before they start carrying traffic, 15 days after this release.

GLOBAL · *.truefoundry.cloud

Added:

• 52.50.208.12/32
• 52.57.120.24/32

US · *.us.truefoundry.cloud

Added:

• 32.188.54.155/32

---

Full list

• GLOBAL (30 addresses): https://github.com/truefoundry/ip-ranges/releases/download/vpr-5/global.json
• US (1 addresses): https://github.com/truefoundry/ip-ranges/releases/download/vpr-5/us.json
• Plain text, one CIDR per line: swap .json for .txt.
• Always-latest: https://truefoundry.github.io/ip-ranges/global.json

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4a28a46. Configure here.}

[cursor]

Pages drops published EU allowlist URLs

Medium Severity

The Pages deploy now publishes only global.json and global.txt, so the previously advertised always-latest URLs eu.json and eu.txt disappear on the next deploy. Allowlist automation still fetching those files will start getting 404s.

Additional Locations (2)

• .github/pages/index.html#L109-L112
• README.md#L13-L15

 

^{Triggered by learned rule: Pages is always-latest; Releases are pinned}

^{Reviewed by Cursor Bugbot for commit 4a28a46. Configure here.}