<p>I am running into an CORS issue with an Angular front-end and a C# REST layer running in k8s. I have a general understanding in CORS and understand the error message below means. I need help fixing it.</p>

<p>Error from the UI.</p>

<blockquote>
  <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://auth-svc:8080/api/auth" rel="nofollow noreferrer">http://auth-svc:8080/api/auth</a>.</p>
</blockquote>

<p>In the cluster I have a database, .net core RESTful API and a Angular UI (running on nginx) running with a service for each pod. I am communicating to each layer in the stack via the service name and port.</p>

<p>I have enabled any orgin in my REST Layer, which is from what I understand kind of a bad practice.</p>

<pre><code>        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            //app.UseHttpsRedirection();

            app.UseRouting();
            app.UseCors(x =&gt; x.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
            app.UseAuthorization();

            app.UseEndpoints(endpoints =&gt;
            {
                endpoints.MapControllers();
            });
        }
</code></pre>

<p>I have looked into a few different ways of doing this, one example being here:
<a href="https://stackoverflow.com/questions/30720303/angular-c-cors-issue">Angular/C# CORS Issue</a></p>

<p>What I am failing to understand is how to do this in a "production safe" way. Meaning if this was a production environment how would I enable the communication between the UI/REST and enforce good security practices for my environments inside a cluster? Even if it is not possible on my environment, it would be helpful to know what I should be shooting for instead of "just making it work".</p>

<p>Thanks!</p>

Nick Orlowski
<p>When putting an app together in kubernetes, you would typicall try to make all services available on the same domain using <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> definitions.</p>

<p>For example, if you have a backend service + deployment for a .NET app hosting APIs and a service + deployment hosting your frontend (e.g. nginx + build output of <code>ng build --prod</code>), it could look like:</p>

<pre><code>apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   name: my-application
 spec:
   rules:
   - host: www.example.com
     http:
       paths:
       - path: /api
         backend:
           serviceName: api-service
           servicePort: 80
       - path: /
         backend:
           serviceName: frontend
           servicePort: 80
</code></pre>

<p>Such a setup would eliminate cross-origin issues since for the browser using the site, all URLs would be on the same origin.</p>

<p>For developing for such an environment, it makes sense to use Angular's <a href="https://angular.io/guide/build#proxying-to-a-backend-server" rel="nofollow noreferrer">proxy integration</a> so <code>ng serve</code> would also set up forwarding the <code>/api</code> routes to an appropriate development endpoint.</p>

<p>Some ingress controllers also support setting CORS headers on endpoints made available over HTTP, so you would not set them in the API service but on the infrastructure / deployment configuration that defines your cluster-external HTTP endpoints and routing. See <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#enable-cors" rel="nofollow noreferrer">these annotations for the nginx ingress controller</a> for example.</p>
