running ~10k pods on unique subdomains, the main bottleneck we hit is that browsers don't support wildcard subdomains in the Access-Control-Allow-Origin header. we had to handle this at the ingress layer by validating the origin against a regex and reflecting it back dynamically. static headers just don't work for this.

this is also a standard approach for nginx:

    location / {
      if ($http_origin ~ "^https?://(www\.)?doma.in$") {
        add_http_header Access-Control-Allow-Origin "$http_origin";
     } 
   }

(2020)

The lack of word wrapping, that we have grown so accustomed to on the Web, makes this article nearly illegible.

Fixed! Thanks for the heads-up. I'm used to writing in Korean where wrapping is rarely an issue, so I missed this during the English migration. It's updated now—thanks for the patience!

I’m dealing with this now actually. So good timing.

I'm guessing in 2026, your favorite LLM and it just gives you the answer

True, LLMs are great at giving immediate fixes. My goal with this post was to provide the 'why' and the underlying structure that helps you debug it even when the LLM gives you a hallucinated config :)