CDN migration: what you need to know

Last updated: July 2, 2026

On August 31st, we're switching the CDN that serves downloads.spacelift.io from AWS CloudFront to Cloudflare. The change has zero downtime.

If you don't use IP allowlists or firewalls to control outbound traffic, you don't need to do anything.

What's changing

We're moving the CDN that serves downloads.spacelift.io to Cloudflare. Everything else stays the same. The only thing that changes is the IP addresses your network will connect to.

What we serve from here

  • Launcher and worker binaries

  • Helm charts

  • Kubernetes worker pool controller manifests

  • Spacelift Kubernetes operator manifests

  • Pulumi plugins

  • VCS agent binaries

Self-hosted runs include all binaries in the distribution, so those keep working regardless.

Who needs to act

You need to update your IP allowlist/firewall rules if you control outbound traffic AND you use private worker pools or otherwise access any of the resources listed above.
You're unaffected if:

  1. You don't restrict outbound network traffic, or

  2. You use self-hosted deployments only

What to do

Step 1: Get Cloudflare's IP ranges
Visit https://www.cloudflare.com/ips/ and download the current IPv4 and IPv6 CIDR blocks.


Step 2: Update your allowlist
Add all of Cloudflare's IP ranges to your allowlist before August 31st. The exact process depends on your network setup

Need help?

If you're unsure whether you're affected, or if you hit issues after the switchover, reach out to support. Include details about your network setup and what you're trying to access.