feat: Implement standard CORS support by chakravardhan · Pull Request #303 · kubernetes-sigs/ingress2gateway

chakravardhan · 2026-01-16T12:28:21Z

What type of PR is this?

/kind feature

What this PR does / why we need it:
This is the first PR in a stacked series. This PR focuses on the internal infrastructure and providing robust, standard-compliant CORS support. It enables users to migrate complex CORS configurations seamlessly to HTTPRoute filters.

Supported Annotations & Mappings

This PR adds a conversion mapping for the following Nginx annotations to Gateway API HTTPRouteFilterCORS fields:

Nginx Annotation	Gateway API Field (`HTTPRoute.filters.cors`)	Default Behavior (if unset)
`nginx.ingress.kubernetes.io/enable-cors`	(Enables Filter)	Must be `"true"` to enable.
`cors-allow-origin`	`allowOrigins`	`*`
`cors-allow-methods`	`allowMethods`	`GET, PUT, POST, DELETE, PATCH, OPTIONS`
`cors-allow-headers`	`allowHeaders`	Nginx Standard List (DNT, Keep-Alive, User-Agent, etc.)
`cors-expose-headers`	`exposeHeaders`	(Empty)
`cors-allow-credentials`	`allowCredentials`	`true` (Matches Nginx default)
`cors-max-age`	`maxAge`	`1728000` (Matches Nginx default)

New flags -

Flag: --allow-experimental-gw-api
Purpose: Controls whether Experimental Gateway API fields are included in the output.
Behavior: Defaults to false. Must be explicitly set to generated CORS configuration, as it is considered an advanced/experimental feature in this tool context.

Which issue(s) this PR fixes:
Fixes #

Does this PR introduce a user-facing change?:

Implemented support for Nginx CORS annotations (enable-cors, allow-origin, allow-methods, allow-headers, expose-headers, allow-credentials, max-age) mapping to Gateway API CORS filters with strict Nginx default compliance.

linux-foundation-easycla · 2026-01-16T12:28:29Z

The committers listed above are authorized under a signed CLA.

✅ login: chakravardhan / name: Chakri Dudyala (13ee306, 20e35cb, 35436c0, 553f08e, 5ba7b44, 7617d56, 7e5bb15, 7f3f1f8, c32a341, d954234, dc8048e, de8117d, e2a72fa, e4760c5, e9dd1b0, feaff80)

k8s-ci-robot · 2026-01-16T12:28:30Z

Welcome @chakravardhan!

It looks like this is your first PR to kubernetes-sigs/ingress2gateway 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/ingress2gateway has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-01-16T12:28:31Z

Hi @chakravardhan. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Stevenjin8 · 2026-01-21T15:51:14Z

+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+func corsFeature(_ []networkingv1.Ingress, _ map[types.NamespacedName]map[string]int32, ir *providerir.ProviderIR) field.ErrorList {


Sorry, there isn't a lot of precedent for this and I haven't had time to update the docs, but the Cors filter is currently experimental (https://gateway-api.sigs.k8s.io/geps/gep-1767/), so it seems a bit early to add it to ingress2gateway.

We could implement it now, but the flow would look a little different. You would follow the flow of something like #288 where we create the IR in the provider and then populate the fields in the common emitter. We would also have to add a feature flag/argument to the common emitter --allow-alpha-gw-api

Also, take a look at this PR: #305 that has the structure I'm looking for. Also, I'm going to ask you to sign yourself up as a codeowner of the GCE emitter if you want to add code there.

I have implemented the --allow-alpha-gw-api flag in the root command and wired it through to the CommonEmitter.

By default (flag false), the CommonEmitter now actively filters out experimental features like CORS filters from the IR before it reaches the specific emitter.

When --allow-alpha-gw-api is passed, CORS filters are preserved and output.

Ack. I will check PR #305 and follow up with a separate PR to add myself to the OWNERS file for the GCE emitter components once this infrastructure lands.

@chakravardhan could you look at #305? The flow right now is add the CORSFilter in the provider and strip it out in the CommonEmitter before it gets sent to the final emitter. But what if the final emitter is Envoy Gateway and they want to implement it using their CORS filter. Also, structuring it like #305 will help us in the future because we will know what was parsed and what wasn't.

Understood, Adopting a structure like #305. Let me know if this looks good

@chakravardhan. Thanks, this is almost what I'm looking for, but it would be ideal to not touch ProviderIR. See applyBodySizeToEmitterIR here https://github.com/kubernetes-sigs/ingress2gateway/pull/305/files

I've modified code similar to the mentioned PR above by adding this method applyCorsToEmitterIR. Kindly check this approach and let us know if this aligns well. Thanks! @Stevenjin8

bexxmodd

Left one comment regarding flag value. The rest LGTM

Co-authored-by: Steven Jin <stevenjin8@gmail.com>

chakravardhan · 2026-02-04T19:48:29Z

@chakravardhan lints are failing.

Fixed now!

k8s-ci-robot · 2026-02-05T16:05:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bexxmodd, chakravardhan, kkk777-7, Stevenjin8

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Stevenjin8]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kkk777-7 · 2026-02-05T16:07:18Z

LGTM, thanks!

/lgtm

* feat: Implement PR1 Infrastructure and Standard CORS support * refactor(gce): rename upsell to update and fix duplicate * Address review comments: delete gce_converter, add --allow-alpha-gw-api flag * fix(gce): unconditionally set GatewayClassName to gke-l7-global-external-managed * fix(ingressnginx): improve cors-max-age parsing validation * feat: make GCE GatewayClassName configurable via flag * Update pkg/i2gw/emitter_intermediate/intermediate_representation.go Co-authored-by: Steven Jin <stevenjin8@gmail.com> * Fix build error by removing usage of removed Gce field * feat(gce): implement conditional logic for --gce-gateway-class-name * refactor: Move CORS filtering from common emitter to standard emitter * chore: revert GCE and GatewayClassName changes to focus on CORS * Cleanup: remove implicit emitter flag association * Address PR comments: Refactor CORS to CommonEmitter and cleanup * Revert standard.go to match main branch * Revert conversion.go to match main branch * Fix gosec lint errors from cors changes --------- Co-authored-by: Steven Jin <stevenjin8@gmail.com>

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Jan 16, 2026

k8s-ci-robot requested a review from rikatz January 16, 2026 12:28

k8s-ci-robot requested a review from Stevenjin8 January 16, 2026 12:28

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 16, 2026

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 16, 2026

chakravardhan changed the title ~~feat: Implement PR1 Infrastructure and Standard CORS support~~ feat: Implement standard CORS support Jan 16, 2026

chakravardhan mentioned this pull request Jan 20, 2026

feat: add session affinity support #310

Closed

rajashish mentioned this pull request Jan 20, 2026

Feat/gke session cookie #312

Closed

chakravardhan changed the title ~~feat: Implement standard CORS support~~ feat: Implement standard CORS support and GCE Infra Jan 21, 2026

Stevenjin8 reviewed Jan 21, 2026

View reviewed changes

Comment thread pkg/i2gw/emitter_intermediate/intermediate_representation.go Outdated

Stevenjin8 reviewed Jan 21, 2026

View reviewed changes

Comment thread pkg/i2gw/emitters/gce/gce.go Outdated

Stevenjin8 reviewed Jan 21, 2026

View reviewed changes

Comment thread pkg/i2gw/providers/ingressnginx/gce_converter.go Outdated

Stevenjin8 reviewed Jan 21, 2026

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 23, 2026

bexxmodd reviewed Jan 26, 2026

View reviewed changes

Comment thread pkg/i2gw/providers/ingressnginx/cors.go

Comment thread pkg/i2gw/emitters/gce/gce.go Outdated

Comment thread pkg/i2gw/providers/ingressnginx/cors.go Outdated

chakravardhan force-pushed the feature/pr1-infrastructure-cors branch from dba4e03 to 153ea57 Compare January 27, 2026 09:01

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 27, 2026

chakravardhan requested a review from Stevenjin8 January 27, 2026 09:04

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jan 27, 2026

chakravardhan requested a review from bexxmodd January 27, 2026 19:21

bexxmodd reviewed Jan 28, 2026

View reviewed changes

Comment thread cmd/print.go Outdated

bexxmodd approved these changes Jan 28, 2026

View reviewed changes

Stevenjin8 reviewed Jan 28, 2026

View reviewed changes

Comment thread cmd/print.go Outdated

chakravardhan and others added 11 commits February 4, 2026 19:23

fix(ingressnginx): improve cors-max-age parsing validation

e9dd1b0

feat: make GCE GatewayClassName configurable via flag

dc8048e

Update pkg/i2gw/emitter_intermediate/intermediate_representation.go

7f3f1f8

Co-authored-by: Steven Jin <stevenjin8@gmail.com>

Fix build error by removing usage of removed Gce field

35436c0

feat(gce): implement conditional logic for --gce-gateway-class-name

d954234

refactor: Move CORS filtering from common emitter to standard emitter

7617d56

chore: revert GCE and GatewayClassName changes to focus on CORS

e4760c5

Cleanup: remove implicit emitter flag association

553f08e

Address PR comments: Refactor CORS to CommonEmitter and cleanup

5ba7b44

Revert standard.go to match main branch

c32a341

Revert conversion.go to match main branch

de8117d

chakravardhan force-pushed the feature/pr1-infrastructure-cors branch from 1255b61 to ff083d3 Compare February 4, 2026 19:29

chakravardhan requested review from LiorLieberman, robscott and youngnick as code owners February 4, 2026 19:29

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 4, 2026

Fix gosec lint errors from cors changes

20e35cb

chakravardhan force-pushed the feature/pr1-infrastructure-cors branch from ff083d3 to 20e35cb Compare February 4, 2026 19:34

chakravardhan temporarily deployed to release February 4, 2026 19:35 — with GitHub Actions Inactive

Stevenjin8 approved these changes Feb 5, 2026

View reviewed changes

kkk777-7 approved these changes Feb 5, 2026

View reviewed changes

k8s-ci-robot assigned kkk777-7 Feb 5, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 5, 2026

k8s-ci-robot merged commit 61b94a7 into kubernetes-sigs:main Feb 5, 2026
5 checks passed

kkk777-7 mentioned this pull request Feb 7, 2026

Feat cors eg #342

Closed

Stevenjin8 mentioned this pull request Feb 11, 2026

ingress2gateway 1.0 effort tracking issue #276

Closed

Conversation

chakravardhan commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Supported Annotations & Mappings

New flags -

Uh oh!

linux-foundation-easycla Bot commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jan 16, 2026

Uh oh!

k8s-ci-robot commented Jan 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chakravardhan Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bexxmodd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chakravardhan commented Feb 4, 2026

Uh oh!

k8s-ci-robot commented Feb 5, 2026

Uh oh!

kkk777-7 commented Feb 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

chakravardhan commented Jan 16, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Jan 16, 2026 •

edited

Loading

chakravardhan Feb 2, 2026 •

edited

Loading