cors: add unmatched_preflights (#3171)

* cors: add forward_not_matching_preflights

* rename

* update with rama's comment

* use Enum instead of bool

* address john's suggestion

Author: zirain

kubernetes/customresourcedefinitions.gen.yaml

@@ -1366,6 +1366,22 @@ message CorsPolicy {
   // (not the preflight) using credentials. Translates to
   // `Access-Control-Allow-Credentials` header.
   google.protobuf.BoolValue allow_credentials = 6;
+
+  // Indicates whether preflight requests not matching the configured 
+  // allowed origin shouldn't be forwarded to the upstream. 
+  // Default is forward to upstream.
+  UnmatchedPreflights unmatched_preflights = 8;
+
+  enum UnmatchedPreflights {
+    // Default to FORWARD
+    UNSPECIFIED = 0;
+    // Preflight requests not matching the configured allowed origin
+    // will be forwarded to the upstream.
+    FORWARD = 1;
+    // Preflight requests not matching the configured allowed origin
+    // will not be forwarded to the upstream.
+    IGNORE = 2;
+  }
 }
 
 // HTTPFaultInjection can be used to specify one or more faults to inject

networking/v1/virtual_service.pb.go

@@ -1367,6 +1367,22 @@ message CorsPolicy {
   // (not the preflight) using credentials. Translates to
   // `Access-Control-Allow-Credentials` header.
   google.protobuf.BoolValue allow_credentials = 6;
+
+  // Indicates whether preflight requests not matching the configured 
+  // allowed origin shouldn't be forwarded to the upstream. 
+  // Default is forward to upstream.
+  UnmatchedPreflights unmatched_preflights = 8;
+
+  enum UnmatchedPreflights {
+    // Default to FORWARD
+    UNSPECIFIED = 0;
+    // Preflight requests not matching the configured allowed origin
+    // will be forwarded to the upstream.
+    FORWARD = 1;
+    // Preflight requests not matching the configured allowed origin
+    // will not be forwarded to the upstream.
+    IGNORE = 2;
+  }
 }
 
 // HTTPFaultInjection can be used to specify one or more faults to inject