[anishbista60]

Description of your changes

• This PR support to pass the authorization header as the part of kubernetes secret. Previously, we have to hardcode the token in the Application CR and now we can pass the reference of the secret and it take that token from k8s secret.

Fixes kubevela/kubevela#7104

I have:

• Read and followed KubeVela's contribution process.
• Related Docs updated properly. In a new feature or configuration option, an update to the documentation is necessary.
• Run make reviewable to ensure this PR is ready for review.
• Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

Special notes for your reviewer

---

Summary by cubic

Allow pkg/providers/http to read HTTP headers (e.g., Authorization) from Kubernetes Secrets via headersFromSecret, removing hardcoded tokens in Application CRs and simplifying config.

• New Features
  • Added headersFromSecret to the CUE schema, Go Request, and chart request definition; each entry uses {header, secret, key}.
  • Resolves header values at runtime via KubeClient using the process context namespace; defaults Content-Type: application/json when no headers are set.
  • Clear errors when KubeClient is missing, the Secret is not found, or the key is missing.
  • Added unit tests (success, missing secret/key, namespace resolution) and an e2e test with a mock server to verify Authorization injection.

^{Written for commit 51ddef2. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.19%. Comparing base (d7db9c4) to head (51ddef2).
⚠️ Report is 17 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/providers/http/http.go	90.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #229      +/-   ##
==========================================
+ Coverage   62.49%   68.19%   +5.70%     
==========================================
  Files          62       67       +5     
  Lines        4415     5486    +1071     
==========================================
+ Hits         2759     3741     +982     
- Misses       1324     1356      +32     
- Partials      332      389      +57     

Flag	Coverage Δ
e2etests	24.49% <50.00%> (?)
unit-test	61.88% <90.00%> (-0.61%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[anishbista60]

Testing locally:

I switched to PR kubevela/kubevela#7194. Then I changed to go mod file

replace (
	github.com/kubevela/workflow => /home/anish60/workflow
)

Ran make core-install, def-install, core-run

Once, controller is ready, Apply the manifest

  apiVersion: v1
  kind: Secret
  metadata:
    name: api-credentials
    namespace: default
  type: Opaque
  stringData:
    token: "Bearer sk-supersecret-12345"

---  
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: httpbin
    namespace: default
  spec:
    replicas: 1
    selector:
      matchLabels: {app: httpbin}
    template:
      metadata:
        labels: {app: httpbin}
      spec:
        containers:
          - name: httpbin
            image: kennethreitz/httpbin
            ports:
              - containerPort: 80
---
  apiVersion: v1
  kind: Service
  metadata:
    name: httpbin
    namespace: default
  spec:
    selector: {app: httpbin}
    ports:
      - port: 80  
        targetPort: 80
---

  apiVersion: core.oam.dev/v1beta1
  kind: Application
  metadata:
    name: demo-request-step
    namespace: default
  spec:
    components: []
    workflow:
      steps:
        - name: notify
          type: request
          outputs:
            - name: authHeader
              valueFrom: response
          properties:
            url: http://localhost:8081/headers
            method: GET
            headersFromSecret:
              - name: Authorization
                secret: api-credentials
                key: token
                namespace: default

Make sure to portforward the service at port 8081

After that Application CR would look like below

apiVersion: core.oam.dev/v1beta1
kind: Application
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"annotations":{},"name":"demo-request-step","namespace":"default"},"spec":{"components":[],"workflow":{"steps":[{"name":"notify","outputs":[{"name":"authHeader","valueFrom":"response"}],"properties":{"headersFromSecret":[{"key":"token","name":"Authorization","namespace":"default","secret":"api-credentials"}],"method":"GET","url":"http://localhost:8081/headers"},"type":"request"}]}}}
    oam.dev/kubevela-version: UNKNOWN
  creationTimestamp: "2026-06-21T07:56:33Z"
  finalizers:
  - app.oam.dev/resource-tracker-finalizer
  generation: 1
  name: demo-request-step
  namespace: default
  resourceVersion: "780838"
  uid: e52942ef-fedf-4a36-b24e-6e0d01ed37da
spec:
  components: []
  workflow:
    steps:
    - name: notify
      outputs:
      - name: authHeader
        valueFrom: response
      properties:
        headersFromSecret:
        - key: token
          name: Authorization
          namespace: default
          secret: api-credentials
        method: GET
        url: http://localhost:8081/headers
      type: request
status:
  conditions:
  - lastTransitionTime: "2026-06-21T07:56:33Z"
    reason: Available
    status: "True"
    type: Parsed
  - lastTransitionTime: "2026-06-21T07:56:33Z"
    reason: Available
    status: "True"
    type: Revision
  - lastTransitionTime: "2026-06-21T07:56:33Z"
    reason: Available
    status: "True"
    type: Policy
  - lastTransitionTime: "2026-06-21T07:56:33Z"
    reason: Available
    status: "True"
    type: Render
  - lastTransitionTime: "2026-06-21T07:56:33Z"
    reason: Available
    status: "True"
    type: Workflow
  - lastTransitionTime: "2026-06-21T07:56:33Z"
    reason: ReconcileSuccess
    status: "True"
    type: Ready
  latestRevision:
    name: demo-request-step-v1
    revision: 1
    revisionHash: 819fb21900658cb0
  observedGeneration: 1
  status: running
  workflow:
    appRevision: demo-request-step-v1
    contextBackend:
      apiVersion: v1
      kind: ConfigMap
      name: workflow-demo-request-step-context
      namespace: default
      uid: 6ccd4e9e-08ed-498a-944d-c3ea65bfb823
    endTime: "2026-06-21T07:56:33Z"
    finished: true
    mode: StepByStep-DAG
    startTime: "2026-06-21T07:56:33Z"
    status: succeeded
    steps:
    - firstExecuteTime: "2026-06-21T07:56:33Z"
      id: zj77pshkwv
      lastExecuteTime: "2026-06-21T07:56:33Z"
      name: notify
      phase: succeeded
      type: request
    suspend: false
    terminated: false

This creates the configmap as well with data field that contain token

Name:         workflow-demo-request-step-context
Namespace:    default
Labels:       <none>
Annotations:  vela.io/startTime: 2026-06-21 13:26:33.096781116 +0530 IST m=+62.769867856

Data
====
vars:
----
authHeader: {
  headers: {
    "Accept-Encoding": "gzip"
    Authorization:     "Bearer sk-supersecret-12345"
    "Content-Type":    "application/json"
    Host:              "localhost:8081"
    "User-Agent":      "Go-http-client/1.1"
  }
}



BinaryData
====

Events:  <none>

[cubic-dev-ai]

1 issue found across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[anishbista60]

/cc @Chaitanyareddy0702 @jerrinfrancis

[briankane]

Thanks @anishbista60 ! Looks great. Excited to make use of this