2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/gateway-api.git synced 2026-02-07 12:45:37 +00:00
Repository for the next iteration of composite service (e.g. Ingress) and load balancing APIs.
Find a file
DamianSawicki 8ecfe98081
CORS: HTTPCORSFilter and GEP 1767 clean-ups (#4506)
* Remove implementation-specific methods/headers

Previously, the GEP mentioned allowing "implementatio-specific default
methods and headers". It's not obvious what that means, but my
understanding is that this would allow implementations to arbitrarily
add certain values (not specified by the user) to the headers
Access-Control-Allow-Methods and Access-Control-Request-Headers`.
It does not seem to be needed. We can revisit this aspect
if it turns out otherwise.

Signed-off-by: Damian Sawicki <dsawicki@google.com>

* Unify gep-1767 and httproute_types.go

It seems that not all changes in GEP 1767 were correctly reflected in
apis/v1/httproute_types.go. This is now fixed.

Signed-off-by: Damian Sawicki <dsawicki@google.com>

* Allow specific Allow-Origin despite wildcard

As per
https://github.com/kubernetes-sigs/gateway-api/pull/4494#discussion_r2770157900
Mozilla has an example where in response to an uncredentialed request,
the server responds with `Access-Control-Allow-Origin: *`.

However, responding with the value of the Origin from the request is
also valid (and the only allowed behavior for credentialed requests),
and it is the behavior of some implementations as per
b1a7a927b0/conformance/tests/httproute-cors.go (L399-L401)
so let's relax the requirement in the GEP to allow it.

* Allow specific Allow-Methods despite wildcard

As per
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Methods#syntax
wildcard is a valid value for the Access-Control-Allow-Methods header.

However, as per
 * https://github.com/envoyproxy/envoy/issues/8218
 * https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Methods#browser_compatibility
the wildcard was not universally supported by browsers in 2019,
and hence many implementations don't use the wildcard.

Signed-off-by: Damian Sawicki <dsawicki@google.com>

* Reword comment for allowHeaders to match methods

Signed-off-by: Damian Sawicki <dsawicki@google.com>

* Copy validation for * from allowMethods to headers

This uniformizes the validation for allowMethods and allowHeaders by
requiring that when '*' appears in allowHeaders, it must be the only
value in the list.

Signed-off-by: Damian Sawicki <dsawicki@google.com>

* Add section on wildcards to GEP 1767

Signed-off-by: Damian Sawicki <dsawicki@google.com>

* Update GEP 1767 metadata with new PR

Signed-off-by: Damian Sawicki <dsawicki@google.com>

---------

Signed-off-by: Damian Sawicki <dsawicki@google.com>
2026-02-07 01:00:30 +05:30
.github build(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#4501) 2026-02-06 13:08:37 +05:30
.openvex/templates Spelling (#3400) 2025-02-12 10:32:22 -08:00
apis CORS: HTTPCORSFilter and GEP 1767 clean-ups (#4506) 2026-02-07 01:00:30 +05:30
apisx ListenerSet: Promote to standard (#4499) 2026-02-06 05:08:29 +05:30
applyconfiguration CORS: HTTPCORSFilter and GEP 1767 clean-ups (#4506) 2026-02-07 01:00:30 +05:30
CHANGELOG chore(1.4.1): CHANGELOG and version updates (#4317) 2025-12-03 21:08:20 -08:00
config/crd CORS: HTTPCORSFilter and GEP 1767 clean-ups (#4506) 2026-02-07 01:00:30 +05:30
conformance TLSRoute: Add conformance test for with nonexistent BackendRef (#4507) 2026-02-06 22:56:32 +05:30
docker Upgrade K8s dependencies to 1.35 (#4376) 2026-01-08 07:39:38 +05:30
docs chore: remove Gateway API survey banner (#3548) 2025-01-13 09:18:32 -08:00
examples TLSRoute: Promote to standard (#4439) 2026-02-06 05:36:30 +05:30
geps CORS: HTTPCORSFilter and GEP 1767 clean-ups (#4506) 2026-02-07 01:00:30 +05:30
gwctl Remove gwctl code from gateway-api repository. New development will happen in kubernetes-sigs/gwctl (#3338) 2024-09-16 20:35:14 +01:00
hack build(deps): bump pymdown-extensions (#4470) 2026-01-30 16:55:45 +05:30
pkg CORS: HTTPCORSFilter and GEP 1767 clean-ups (#4506) 2026-02-07 01:00:30 +05:30
roles Spelling (#4279) 2025-12-08 17:15:33 -08:00
site-src fix(ingress-migration-guide): create rule blocks for each host (#4435) 2026-02-06 13:08:30 +05:30
tests fix: update pattern for wellKnownCACertificates (#4459) 2026-02-06 12:40:31 +05:30
tools TLSRoute: Promote to standard (#4439) 2026-02-06 05:36:30 +05:30
.custom-gcl.yml Update KAL and fix new findings (#4461) 2026-02-05 11:36:30 +05:30
.gitattributes Renaming stable channel to standard channel 2022-06-07 20:00:30 +00:00
.gitignore Add a link validator and fix broken links (#4363) 2025-12-23 16:38:33 +05:30
.golangci-kal.yml Update KAL and fix new findings (#4461) 2026-02-05 11:36:30 +05:30
.golangci.yml Bump golangci-lint to the latest version (v2) (#4377) 2026-01-02 23:38:35 +05:30
.yamllint.yaml Automate GEP TOC generation and validate (#4075) 2025-09-17 07:42:13 -07:00
CHANGELOG.md Splitting Changelogs for each minor version (#3060) 2024-05-07 08:11:49 -07:00
cloudbuild.yaml Update cloudbuild.yaml 2022-11-21 12:51:01 +08:00
code-of-conduct.md Initial commit 2019-11-01 16:33:33 -04:00
CONTRIBUTING.md docs: fix typo in CONTRIBUTING.md and README.md (#4395) 2026-01-07 03:45:39 +05:30
crd-ref-docs.yaml Updating deps to k8s 1.32 and go 1.24 (#3697) 2025-03-21 10:56:32 -07:00
go.mod bump libraries manually before RC (#4495) 2026-02-06 02:04:30 +05:30
go.sum bump libraries manually before RC (#4495) 2026-02-06 02:04:30 +05:30
go.work Upgrade K8s dependencies to 1.35 (#4376) 2026-01-08 07:39:38 +05:30
LICENSE revamp readme to point to relevant resources 2020-10-29 10:24:07 -05:00
Makefile Add a link validator and fix broken links (#4363) 2025-12-23 16:38:33 +05:30
mkdocs.yml fix redirect for the old security-model link (#4465) 2026-01-29 12:05:49 +05:30
nav.yml Add security considerations guide, update security model (#4219) 2026-01-26 23:33:49 +05:30
netlify.toml Updating deps to k8s 1.32 and go 1.24 (#3697) 2025-03-21 10:56:32 -07:00
OWNERS chore: remove mesh leads from * reviews 2022-12-06 15:18:33 -05:00
OWNERS_ALIASES Add snorwin as conformance reviewer (#4436) 2026-01-22 11:09:28 +05:30
README.md docs: fix typo in CONTRIBUTING.md and README.md (#4395) 2026-01-07 03:45:39 +05:30
RELEASE.md Move GEPs out of ToC and re-add provisional (#4277) 2025-12-05 13:42:56 -08:00
RELEASE_MANAGEMENT.md Update deadline extension policy (#4111) 2025-09-25 21:22:16 -07:00
SECURITY_CONTACTS Update OWNERS, OWNERS_ALIASES and SECURITY_CONTACTS. 2019-11-01 16:57:13 -04:00

Kubernetes Gateway API

The Gateway API is a part of SIG Network, and this repository contains the specification and Custom Resource Definitions (CRDs).

Status

The latest supported version is v1 as released by the v1.4.1 release of this project.

This version of the API has GA level support for the following resources:

  • v1.GatewayClass
  • v1.Gateway
  • v1.HTTPRoute
  • v1.GRPCRoute
  • v1.BackendTLSPolicy

For all the other APIs and their support levels please consult the spec.

Documentation

Website

The API specification and detailed documentation is available on the project website: https://gateway-api.sigs.k8s.io.

Concepts

To get started, please read through API concepts and Security model. These documents give the necessary background to understand the API and the use-cases it targets.

Getting started

Once you have a good understanding of the API at a higher-level, check out getting started to install your first Gateway controller and try out one of the guides.

References

For a complete API reference, please refer to:

Gateway API conformance

If you are developing a Gateway API implementation and want to run conformance tests against your project and eventually submit the proof of conformance, visit the conformance documentation for the test suite documentation, and the conformance reports readme to see the reports submission rules. If you are a user who wants to explore the features supported by the various implementations, navigate the conformance reports

Contributing

Community meeting schedule, notes and developer guide can be found on the community page. Our Kubernetes Slack channel is #sig-network-gateway-api.

Code of conduct

Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.