fix(helmfile): Add cluster.networking.proxies. Deployments need to set this if their load balancer or reverse proxy IPs are not part of the cluster.networking.cidr.

docs/getting-started.md

@@ -199,6 +199,16 @@ cluster:
       - "127.0.0.0/8"
 ```
 
+If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
+explicitly configure the related IPs or IP ranges:
+
+```yaml
+cluster:
+  networking:
+    incomingCIDR:
+      - "172.16.0.0/12"
+```
+
 ### Ingress
 
 By default, the `ingressClassName` is empty to choose your default ingress controller. You may want to customize it by

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -37,7 +37,7 @@ configuration:
     port: {{ .Values.cache.nextcloud.port | quote }}
   collabora:
     # internalWopiUrl: ""
-    wopiAllowlist: {{ join " " .Values.cluster.networking.cidr | quote }}
+    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
   database:
     host: {{ .Values.databases.nextcloud.host | quote }}
     port: {{ .Values.databases.nextcloud.port | quote }}

helmfile/environments/default/cluster.yaml

@@ -18,11 +18,14 @@ cluster:
     # Kubernetes cluster network CIDRs.
     cidr:
       - "10.0.0.0/8"
+    # IP addresses or IP ranges of the reverse proxy / load balancer to restrict the requesting source
+    # for defined services.
+    incomingCIDR: []
     # Ingress-gateway IP - only relevant for "NodePort" cluster services.
     # When ingress and egress gateway use different ips, which results that pods can't self-discover their incoming ip,
     # you need to provide the public (load-balanced) ingress gateways ip address.
     ingressGatewayIP: ""
-    # LoadBalancer status fiel - only relevant for "LoadBalancer" cluster services.
+    # LoadBalancer status field - only relevant for "LoadBalancer" cluster services.
     # The IP/DNS of your load-balancer will be fetched for some components from 'status' map of services.
     # Most providers use '.status.loadBalancer.ingress[0].ip' to store public ip. You can modify the chosen field here.
     loadBalancerStatusField: "ip"