[Spectrum] Document IP Access Rules blocking health checks

[stechedo]

Summary

Split out of #30683 at the reviewer's request — see this comment:

Could we just hold the IP Access Rules + health checks section? I need a bit more time to verify the mechanism, but I don't want to block everything else.

Changes

• spectrum/reference/troubleshooting.mdx — New "Health checks fail when IP Access Rules are enabled" section (symptoms/cause/solution) covering the allowlist-model blocking Cloudflare's health check probes.
• spectrum/reference/configuration-options.mdx — Caution callout under IP Access rules warning about health check impact, plus a note that Custom Rules (WAF) do not apply to TCP/UDP Spectrum applications.
• load-balancing/additional-options/spectrum.mdx — Matching caution callout in the Monitors step of the Spectrum load balancing setup guide.

Content area

Spectrum, Load Balancing

[cloudflare-docs-bot]

Review

⚠️ 1 warning found in commit 72a155a.

Fix in your agent

Fix the following review findings in PR #32137 (https://github.com/cloudflare/cloudflare-docs/pull/32137).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, fix all legitimate findings. For any you decide to skip,
post a comment on this PR with the finding ID and your reasoning.

---

## Code Review

### Warnings (1)

#### CR-589005d5775b · Technically misleading alternative
- **File:** `src/content/docs/spectrum/reference/troubleshooting.mdx` line 47
- **Issue:** The added paragraph suggests using a TCP health check type as an alternative to allowlisting Cloudflare IPs. Because IP Access Rules evaluate every incoming connection to the Spectrum application, switching the health check protocol from HTTP to TCP does not bypass the block; the TCP connection from a blocked Cloudflare health check probe will still be rejected.
- **Fix:** Clarify that the alternative requires removing or changing IP Access Rules, and that moving access control to the origin is what allows health checks to succeed—not changing the health check type. If IP Access Rules remain enabled with an allowlist, any health check type must still allow Cloudflare’s probe IPs.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

Warnings (1)

File

Issue

spectrum/reference/troubleshooting.mdx line 47

Technically misleading alternative — The added paragraph suggests using a TCP health check type as an alternative to allowlisting Cloudflare IPs. Because IP Access Rules evaluate every incoming connection to the Spectrum application, switching the health check protocol from HTTP to TCP does not bypass the block; the TCP connection from a blocked Cloudflare health check probe will still be rejected. Fix: Clarify that the alternative requires removing or changing IP Access Rules, and that moving access control to the origin is what allows health checks to succeed—not changing the health check type. If IP Access Rules remain enabled with an allowlist, any health check type must still allow Cloudflare’s probe IPs.

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.