Cloudflare servers don't own IPs anymore – so how do they connect to the Internet?

What this post added

This post details the evolution of Cloudflare's egress network design. It explains the challenges of using anycast for egress traffic and the shift from a unicast IP per server model to a more complex system. The post introduces the need for differentiating traffic types (trusted vs. untrusted, country-tagged) and the resulting explosion in required IP addresses. It then discusses two extreme solutions (each server owns all IPs vs. one server owns IPs) and proposes a third, hybrid way that leverages IP address management and routing strategies to handle diverse traffic types while maintaining the benefits of anycast for ingress traffic. This includes strategies for managing IP address cardinality and cost, particularly for IPv4.