diff --git a/docs/website/content/v0.4/en/configuration/v1alpha1.md b/docs/website/content/v0.4/en/configuration/v1alpha1.md
index b90b34625..65fba1cf8 100644
--- a/docs/website/content/v0.4/en/configuration/v1alpha1.md
+++ b/docs/website/content/v0.4/en/configuration/v1alpha1.md
@@ -597,6 +597,21 @@ extraManifests:
 
 ```
 
+#### extraManifestHeaders
+
+A map of key value pairs that will be added while fetching the ExtraManifests.
+
+Type: `map`
+
+Examples:
+
+```yaml
+extraManifestHeaders:
+  Token: "1234567"
+  X-ExtraInfo: info
+
+```
+
 #### adminKubeconfig
 
 Settings for admin kubeconfig generation.
diff --git a/internal/app/bootkube/assets.go b/internal/app/bootkube/assets.go
index 6eb2b8da1..eddcf0bbe 100644
--- a/internal/app/bootkube/assets.go
+++ b/internal/app/bootkube/assets.go
@@ -234,13 +234,13 @@ func generateAssets(config runtime.Configurator) (err error) {
 
 	// If "custom" is the CNI, we expect the user to supply one or more urls that point to CNI yamls
 	if config.Cluster().Network().CNI().Name() == constants.CustomCNI {
-		if err = fetchManifests(config.Cluster().Network().CNI().URLs()); err != nil {
+		if err = fetchManifests(config.Cluster().Network().CNI().URLs(), map[string]string{}); err != nil {
 			return err
 		}
 	}
 
 	if len(config.Cluster().ExtraManifestURLs()) > 0 {
-		if err = fetchManifests(config.Cluster().ExtraManifestURLs()); err != nil {
+		if err = fetchManifests(config.Cluster().ExtraManifestURLs(), config.Cluster().ExtraManifestHeaderMap()); err != nil {
 			return err
 		}
 	}
@@ -265,7 +265,7 @@ func altNamesFromURLs(urls []string) *tlsutil.AltNames {
 }
 
 // fetchManifests will lay down manifests in the provided urls to the bootkube assets directory
-func fetchManifests(urls []string) error {
+func fetchManifests(urls []string, headers map[string]string) error {
 	ctx := context.Background()
 
 	var result *multierror.Error
@@ -286,6 +286,12 @@ func fetchManifests(urls []string) error {
 			Client: http.DefaultClient,
 		}
 
+		httpGetter.Header = make(http.Header)
+
+		for k, v := range headers {
+			httpGetter.Header.Add(k, v)
+		}
+
 		getter.Getters["http"] = httpGetter
 		getter.Getters["https"] = httpGetter
 
diff --git a/pkg/config/cluster/cluster.go b/pkg/config/cluster/cluster.go
index 7c5b0a674..86d4265e6 100644
--- a/pkg/config/cluster/cluster.go
+++ b/pkg/config/cluster/cluster.go
@@ -32,6 +32,7 @@ type Cluster interface {
 	PodCheckpointer() PodCheckpointer
 	CoreDNS() CoreDNS
 	ExtraManifestURLs() []string
+	ExtraManifestHeaderMap() map[string]string
 	AdminKubeconfig() AdminKubeconfig
 }
 
diff --git a/pkg/config/types/v1alpha1/v1alpha1_configurator.go b/pkg/config/types/v1alpha1/v1alpha1_configurator.go
index 8ca35a17b..db167b908 100644
--- a/pkg/config/types/v1alpha1/v1alpha1_configurator.go
+++ b/pkg/config/types/v1alpha1/v1alpha1_configurator.go
@@ -429,6 +429,11 @@ func (c *ClusterConfig) ExtraManifestURLs() []string {
 	return c.ExtraManifests
 }
 
+// ExtraManifestHeaderMap implements the Configurator interface.
+func (c *ClusterConfig) ExtraManifestHeaderMap() map[string]string {
+	return c.ExtraManifestHeaders
+}
+
 // PodCheckpointer implements the Configurator interface.
 func (c *ClusterConfig) PodCheckpointer() cluster.PodCheckpointer {
 	if c.PodCheckpointerConfig == nil {
diff --git a/pkg/config/types/v1alpha1/v1alpha1_types.go b/pkg/config/types/v1alpha1/v1alpha1_types.go
index c5810202e..ba20a5f62 100644
--- a/pkg/config/types/v1alpha1/v1alpha1_types.go
+++ b/pkg/config/types/v1alpha1/v1alpha1_types.go
@@ -343,6 +343,14 @@ type ClusterConfig struct {
 	//         - "https://www.mysweethttpserver.com/manifest2.yaml"
 	ExtraManifests []string `yaml:"extraManifests,omitempty"`
 	//   description: |
+	//     A map of key value pairs that will be added while fetching the ExtraManifests.
+	//   examples:
+	//     - |
+	//       extraManifestHeaders:
+	//         Token: "1234567"
+	//         X-ExtraInfo: info
+	ExtraManifestHeaders map[string]string `yaml:"extraManifestHeaders,omitempty"`
+	//   description: |
 	//     Settings for admin kubeconfig generation.
 	//     Certificate lifetime can be configured.
 	//   examples: