Set VaultConnection headers on the vault client

controllers/vaultconnection_controller.go

@@ -73,6 +73,7 @@ func (r *VaultConnectionReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		Address:         o.Spec.Address,
 		SkipTLSVerify:   o.Spec.SkipTLSVerify,
 		TLSServerName:   o.Spec.TLSServerName,
+		Headers:         o.Spec.Headers,
 	}
 
 	var errs error

internal/vault/client.go

@@ -606,6 +606,7 @@ func (c *defaultClient) init(ctx context.Context, client ctrlclient.Client,
 		VaultNamespace:  authObj.Spec.Namespace,
 		K8sNamespace:    connObj.Namespace,
 		CACertSecretRef: connObj.Spec.CACertSecretRef,
+		Headers:         connObj.Spec.Headers,
 	}
 
 	vc, err := MakeVaultClient(ctx, cfg, client)

internal/vault/config.go

@@ -9,7 +9,7 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/vault/api"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
@@ -35,6 +35,8 @@ type ClientConfig struct {
 	TLSServerName string
 	// VaultNamespace is the namespace in Vault to auth to
 	VaultNamespace string
+	// Headers are http headers to set on the Vault client
+	Headers map[string]string
 }
 
 // MakeVaultClient creates a Vault api.Client from a ClientConfig.
@@ -96,6 +98,9 @@ func MakeVaultClient(ctx context.Context, cfg *ClientConfig, client ctrlclient.C
 	if cfg.VaultNamespace != "" {
 		c.SetNamespace(cfg.VaultNamespace)
 	}
+	for k, v := range cfg.Headers {
+		c.AddHeader(k, v)
+	}
 
 	return c, nil
 }

internal/vault/config_test.go

@@ -72,6 +72,17 @@ func TestMakeVaultClient(t *testing.T) {
 			CACert:        nil,
 			expectedError: nil,
 		},
+		"headers": {
+			vaultConfig: &ClientConfig{
+				Headers: map[string]string{
+					"X-Proxy-Setting": "yes",
+					"Y-Proxy-Setting": "no",
+				},
+				VaultNamespace: "vault-test-namespace",
+			},
+			CACert:        nil,
+			expectedError: nil,
+		},
 	}
 
 	for name, tc := range tests {
@@ -116,7 +127,25 @@ func TestMakeVaultClient(t *testing.T) {
 					require.NoError(t, err)
 					assert.True(t, tlsConfig.RootCAs.Equal(expectedCertPool), "The CA cert in the client doesn't match the expected cert")
 				}
+
+				expectedHeaders := makeVaultHttpHeaders(t, tc.vaultConfig.VaultNamespace, tc.vaultConfig.Headers)
+				assert.Equal(t, expectedHeaders, vaultClient.Headers(), "The headers in the client don't match the expected headers")
 			}
 		})
 	}
 }
+
+func makeVaultHttpHeaders(t *testing.T, namespace string, headers map[string]string) http.Header {
+	t.Helper()
+
+	h := make(http.Header)
+	for k, v := range headers {
+		h.Set(k, v)
+	}
+	h.Set("X-Vault-Request", "true")
+	if len(namespace) > 0 {
+		h.Set(vconsts.NamespaceHeaderName, namespace)
+	}
+
+	return h
+}