Add X-Dot-Client-App header to all ONTAP REST and ZAPI requests.

Author: vivakeram

storage_drivers/ontap/api/azgo/common.go

@@ -29,6 +29,10 @@ import (
 	"github.com/netapp/trident/utils/errors"
 )
 
+// ClientAppHeader is the HTTP header name ONTAP uses to identify the calling
+// application. Mirrored from the parent api package to avoid an import cycle.
+const ClientAppHeader = "X-Dot-Client-App"
+
 type ZAPIRequest interface {
 	ToXML() (string, error)
 }
@@ -242,6 +246,7 @@ func (o *ZapiRunner) SendZapiWithContext(ctx context.Context, r ZAPIRequest) (*h
 		return nil, err
 	}
 	req.Header.Set("Content-Type", "application/xml")
+	req.Header.Set(ClientAppHeader, "Trident/"+tridentconfig.OrchestratorVersion.ShortString())
 	if o.ClientCertificate == "" || o.ClientPrivateKey == "" {
 		req.SetBasicAuth(o.Username, o.Password)
 	}

storage_drivers/ontap/api/azgo/common_test.go

@@ -154,6 +154,12 @@ func TestZapiRunner_ExecuteUsing_Parallel_MC(t *testing.T) {
 	// Test parallel calls to ExecuteUsing with MC name changes
 	zRunner := CreateTestZapiRunner(1)
 	mockTransport := RoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		// Every outgoing ZAPI request must carry the X-Dot-Client-App header
+		// so ONTAP can track per-app usage (TRID-19776).
+		assert.NotEmpty(t, req.Header.Get(ClientAppHeader),
+			"ZAPI request must include X-Dot-Client-App header")
+		assert.True(t, strings.HasPrefix(req.Header.Get(ClientAppHeader), "Trident"),
+			"X-Dot-Client-App header must start with 'Trident'")
 		return &http.Response{
 			StatusCode: http.StatusOK,
 			Body:       io.NopCloser(strings.NewReader(mockZapiErrorVserverNotFound)),
@@ -177,3 +183,27 @@ func TestZapiRunner_ExecuteUsing_Parallel_MC(t *testing.T) {
 	// Check the SVM name, it should be one of the expected values
 	assert.True(t, zRunner.svm == "svm-1-mc" || zRunner.svm == "svm-1")
 }
+
+// TestSendZapiWithContext_SetsClientAppHeader verifies every ZAPI request
+// carries the X-Dot-Client-App header in the expected "Trident/<version>" format.
+func TestSendZapiWithContext_SetsClientAppHeader(t *testing.T) {
+	zRunner := CreateTestZapiRunner(1)
+	var gotHeader string
+	mockTransport := RoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		gotHeader = req.Header.Get(ClientAppHeader)
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Body:       io.NopCloser(strings.NewReader(mockZapiErrorVserverNotFound)),
+			Header:     make(http.Header),
+		}, nil
+	})
+	zRunner.httpClient = &http.Client{
+		Transport: drivers.NewLimitedRetryTransport(semaphore.NewWeighted(1), mockTransport, ""),
+	}
+
+	_, _ = zRunner.SendZapi(&VolumeCreateRequest{})
+	assert.True(t, strings.HasPrefix(gotHeader, "Trident/"),
+		"SendZapi must stamp the X-Dot-Client-App header as Trident/<version>, got: %s", gotHeader)
+	assert.NotEqual(t, "Trident/", gotHeader,
+		"X-Dot-Client-App header must include a non-empty version")
+}

storage_drivers/ontap/api/client_app_transport.go

@@ -0,0 +1,41 @@
+// Copyright 2026 NetApp, Inc. All Rights Reserved.
+
+package api
+
+import (
+	"net/http"
+
+	tridentconfig "github.com/netapp/trident/config"
+)
+
+// ClientAppHeader is the HTTP header name ONTAP uses to identify the calling
+// application. ONTAP exposes it via `security session request-statistics
+// show-by-application`, allowing admins to track and rate-limit per-app usage.
+const ClientAppHeader = "X-Dot-Client-App"
+
+// ClientAppHeaderValue returns the value to send in the X-Dot-Client-App header
+// for every REST/ZAPI request Trident issues to ONTAP, e.g. "Trident/26.06.0".
+func ClientAppHeaderValue() string {
+	return "Trident/" + tridentconfig.OrchestratorVersion.ShortString()
+}
+
+// ClientAppTransport is an http.RoundTripper that stamps the X-Dot-Client-App
+// header onto every outgoing request before delegating to a base transport.
+type ClientAppTransport struct {
+	base  http.RoundTripper
+	value string
+}
+
+// NewClientAppTransport wraps base so every request it sends carries the
+// X-Dot-Client-App header set to value.
+func NewClientAppTransport(base http.RoundTripper, value string) *ClientAppTransport {
+	return &ClientAppTransport{base: base, value: value}
+}
+
+// RoundTrip clones the request (per RoundTripper semantics) and sets the
+// X-Dot-Client-App header before handing off to the base transport.
+func (t *ClientAppTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	r := req.Clone(req.Context())
+	r.Header.Set(ClientAppHeader, t.value)
+	return t.base.RoundTrip(r)
+}

storage_drivers/ontap/api/client_app_transport_test.go

@@ -0,0 +1,96 @@
+// Copyright 2026 NetApp, Inc. All Rights Reserved.
+
+package api
+
+import (
+	"io"
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	tridentconfig "github.com/netapp/trident/config"
+)
+
+// roundTripFunc adapts a function into an http.RoundTripper for tests.
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+// TestClientAppHeaderValue verifies the computed header value matches the
+// documented format "Trident/<OrchestratorVersion.ShortString()>".
+func TestClientAppHeaderValue(t *testing.T) {
+	want := "Trident/" + tridentconfig.OrchestratorVersion.ShortString()
+	assert.Equal(t, want, ClientAppHeaderValue())
+	assert.True(t, strings.HasPrefix(ClientAppHeaderValue(), "Trident/"),
+		"header value must start with 'Trident/'")
+}
+
+// TestClientAppHeaderName locks in the header name required by ONTAP.
+func TestClientAppHeaderName(t *testing.T) {
+	assert.Equal(t, "X-Dot-Client-App", ClientAppHeader)
+}
+
+// TestClientAppTransport_RoundTrip verifies the transport stamps the header
+// on every outgoing request.
+func TestClientAppTransport_RoundTrip(t *testing.T) {
+	const want = "Trident/26.06.0"
+
+	var seen atomic.Int32
+	base := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		seen.Add(1)
+		assert.Equal(t, want, r.Header.Get("X-Dot-Client-App"))
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Body:       io.NopCloser(strings.NewReader("")),
+			Header:     make(http.Header),
+		}, nil
+	})
+
+	tr := NewClientAppTransport(base, want)
+
+	for i := 0; i < 3; i++ {
+		req, err := http.NewRequest(http.MethodGet, "http://example.invalid/api", nil)
+		assert.NoError(t, err)
+		resp, err := tr.RoundTrip(req)
+		assert.NoError(t, err)
+		assert.NotNil(t, resp)
+		_ = resp.Body.Close()
+
+		// The caller's original request must not be mutated (RoundTripper contract).
+		assert.Empty(t, req.Header.Get("X-Dot-Client-App"),
+			"caller's request header must not be mutated")
+	}
+
+	assert.Equal(t, int32(3), seen.Load(), "base transport should be called once per RoundTrip")
+}
+
+// TestClientAppTransport_OverwritesExistingHeader verifies a pre-set header
+// on the incoming request is overwritten with our value (without mutating the
+// caller's request object).
+func TestClientAppTransport_OverwritesExistingHeader(t *testing.T) {
+	const want = "Trident/26.06.1"
+
+	base := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		assert.Equal(t, want, r.Header.Get("X-Dot-Client-App"))
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Body:       io.NopCloser(strings.NewReader("")),
+			Header:     make(http.Header),
+		}, nil
+	})
+
+	tr := NewClientAppTransport(base, want)
+	req, err := http.NewRequest(http.MethodGet, "http://example.invalid/api", nil)
+	assert.NoError(t, err)
+	req.Header.Set("X-Dot-Client-App", "SomeOther/1.0")
+
+	resp, err := tr.RoundTrip(req)
+	assert.NoError(t, err)
+	_ = resp.Body.Close()
+
+	assert.Equal(t, "SomeOther/1.0", req.Header.Get("X-Dot-Client-App"),
+		"caller's request header must be left alone")
+}

storage_drivers/ontap/api/ontap_rest.go

@@ -199,6 +199,8 @@ func NewRestClient(ctx context.Context, config ClientConfig, SVM, driverName str
 	transport = drivers.NewLimitedRetryTransport(
 		drivers.NewSemaphore(config.ManagementLIF, drivers.ONTAPRequestLimit), transport, ContextRequestTargetONTAP,
 	)
+	// Stamp the X-Dot-Client-App header on every request so ONTAP can track per-app usage.
+	transport = NewClientAppTransport(transport, ClientAppHeaderValue())
 	result.httpClient = &http.Client{
 		Transport: transport,
 	}
@@ -215,6 +217,10 @@ func NewRestClient(ctx context.Context, config ClientConfig, SVM, driverName str
 		}
 		rClient.SetLogger(apiLogger)
 		rClient.SetDebug(config.DebugTraceFlags["api"])
+		// Also install our transport on the go-openapi runtime so the header is
+		// applied to any REST call path that does not explicitly set
+		// params.HTTPClient on the generated operation params.
+		rClient.Transport = transport
 	}
 
 	return result, nil