Native CORS support on GKE Gateway: Offloading cross-origin policy management to infrastructure

Cross-origin resource sharing (CORS) is a security feature enforced by web browsers that prevents unauthorized cross-origin requests. This is necessary to protect users from malicious scripts trying to access data from distinct origins. However, modern application architectures often require cross-origin communication, such as single-page applications, mobile clients, and embedded web components that need to fetch data and stream AI model inferences across separate domains, subdomains, and ports.

Implementing CORS in each backend service introduces redundant application logic, increases preflight request processing overhead, and leads to configuration sprawl and drift across microservices. To address this, Google has introduced native CORS support directly in the GKE Gateway and Inference Gateway load balancers. This offloads CORS management from individual backend applications to the load balancer, which terminates OPTIONS preflight requests at the network edge and injects required response headers.

The CORS filter in HTTPRoute allows configuring policies declaratively, specifying allowed origins, methods, headers, credentials, and caching behavior. Security considerations dictate careful attention to allowOrigins and allowCredentials interactions, with explicit domain lists preferred over wildcards for authenticated APIs. This Preview release supports single-cluster GKE Gateway deployments across various GatewayClasses, including regional and global external load balancers.

However, multi-cluster gateways and combining CORS filters with RequestRedirect filters are not supported.