feat: support pod host aliases

sionsmith · sionsmith · commit 02d3059af3f6 · 2026-06-03T09:45:39.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## Unreleased
+
+### Added
+
+- Add `spec.template.pod.hostAliases` support for `KafkaBackup` and `KafkaRestore` job pods. Fixes [#22](https://github.com/osodevops/strimzi-backup-operator/issues/22).
+
 ## 0.2.5 - 2026-05-17
 
 ### Changed
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -19,7 +19,7 @@ path = "src/bin/crdgen.rs"
 # Kubernetes
 kube = { version = "0.95", features = ["runtime", "derive", "client"] }
 kube-runtime = "0.95"
-k8s-openapi = { version = "0.23", features = ["v1_30"] }
+k8s-openapi = { version = "0.23", features = ["v1_30", "schemars"] }
 
 # Async runtime
 tokio = { version = "1", features = ["full", "signal"] }
diff --git a/README.md b/README.md
@@ -32,7 +32,7 @@ The **Kafka Backup Operator** solves these problems with a purpose-built Kuberne
 - **Retention policies** — automatic pruning of old backups by count or age
 - **Compression** — gzip, snappy, lz4, or zstd compression for storage efficiency
 - **Prometheus metrics** — built-in observability with backup/restore counters, duration histograms, and storage gauges
-- **Pod template customisation** — full control over backup/restore Job pods (affinity, tolerations, security context, environment variables)
+- **Pod template customisation** — full control over backup/restore Job pods (affinity, tolerations, host aliases, security context, environment variables)
 - **Azure Workload Identity** — native support for passwordless Azure authentication
 
 ## Architecture
diff --git a/config/examples/kafka-backup-s3.yaml b/config/examples/kafka-backup-s3.yaml
@@ -68,3 +68,10 @@ spec:
     limits:
       cpu: "2"
       memory: "4Gi"
+
+  template:
+    pod:
+      hostAliases:
+        - ip: "10.10.0.5"
+          hostnames:
+            - "s3.internal"
diff --git a/config/examples/kafka-restore-pitr.yaml b/config/examples/kafka-restore-pitr.yaml
@@ -53,3 +53,10 @@ spec:
     limits:
       cpu: "4"
       memory: "8Gi"
+
+  template:
+    pod:
+      hostAliases:
+        - ip: "10.10.0.5"
+          hostnames:
+            - "s3.internal"
diff --git a/deploy/crds/kafkabackups.yaml b/deploy/crds/kafkabackups.yaml
@@ -667,8 +667,6 @@ spec:
                         description: Container security context (pass-through to k8s SecurityContext)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - securityContext
                     type: object
                   pod:
                     description: Pod-level overrides
@@ -678,6 +676,23 @@ spec:
                         description: Pod affinity rules (pass-through to k8s Affinity)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
+                      hostAliases:
+                        description: Pod host aliases (pass-through to k8s HostAlias)
+                        items:
+                          description: HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.
+                          properties:
+                            hostnames:
+                              description: Hostnames for the above IP address.
+                              items:
+                                type: string
+                              type: array
+                            ip:
+                              description: IP address of the host file entry.
+                              type: string
+                          required:
+                          - ip
+                          type: object
+                        type: array
                       imagePullSecrets:
                         description: Image pull secrets
                         items:
@@ -709,9 +724,6 @@ spec:
                           type: object
                           x-kubernetes-preserve-unknown-fields: true
                         type: array
-                    required:
-                    - affinity
-                    - securityContext
                     type: object
                 type: object
               topics:
diff --git a/deploy/crds/kafkarestores.yaml b/deploy/crds/kafkarestores.yaml
@@ -465,8 +465,6 @@ spec:
                         description: Container security context (pass-through to k8s SecurityContext)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - securityContext
                     type: object
                   pod:
                     description: Pod-level overrides
@@ -476,6 +474,23 @@ spec:
                         description: Pod affinity rules (pass-through to k8s Affinity)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
+                      hostAliases:
+                        description: Pod host aliases (pass-through to k8s HostAlias)
+                        items:
+                          description: HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.
+                          properties:
+                            hostnames:
+                              description: Hostnames for the above IP address.
+                              items:
+                                type: string
+                              type: array
+                            ip:
+                              description: IP address of the host file entry.
+                              type: string
+                          required:
+                          - ip
+                          type: object
+                        type: array
                       imagePullSecrets:
                         description: Image pull secrets
                         items:
@@ -507,9 +522,6 @@ spec:
                           type: object
                           x-kubernetes-preserve-unknown-fields: true
                         type: array
-                    required:
-                    - affinity
-                    - securityContext
                     type: object
                 type: object
               topicMapping:
diff --git a/deploy/helm/strimzi-backup-operator/crds/kafkabackups.yaml b/deploy/helm/strimzi-backup-operator/crds/kafkabackups.yaml
@@ -667,8 +667,6 @@ spec:
                         description: Container security context (pass-through to k8s SecurityContext)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - securityContext
                     type: object
                   pod:
                     description: Pod-level overrides
@@ -678,6 +676,23 @@ spec:
                         description: Pod affinity rules (pass-through to k8s Affinity)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
+                      hostAliases:
+                        description: Pod host aliases (pass-through to k8s HostAlias)
+                        items:
+                          description: HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.
+                          properties:
+                            hostnames:
+                              description: Hostnames for the above IP address.
+                              items:
+                                type: string
+                              type: array
+                            ip:
+                              description: IP address of the host file entry.
+                              type: string
+                          required:
+                          - ip
+                          type: object
+                        type: array
                       imagePullSecrets:
                         description: Image pull secrets
                         items:
@@ -709,9 +724,6 @@ spec:
                           type: object
                           x-kubernetes-preserve-unknown-fields: true
                         type: array
-                    required:
-                    - affinity
-                    - securityContext
                     type: object
                 type: object
               topics:
diff --git a/deploy/helm/strimzi-backup-operator/crds/kafkarestores.yaml b/deploy/helm/strimzi-backup-operator/crds/kafkarestores.yaml
@@ -465,8 +465,6 @@ spec:
                         description: Container security context (pass-through to k8s SecurityContext)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
-                    required:
-                    - securityContext
                     type: object
                   pod:
                     description: Pod-level overrides
@@ -476,6 +474,23 @@ spec:
                         description: Pod affinity rules (pass-through to k8s Affinity)
                         type: object
                         x-kubernetes-preserve-unknown-fields: true
+                      hostAliases:
+                        description: Pod host aliases (pass-through to k8s HostAlias)
+                        items:
+                          description: HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.
+                          properties:
+                            hostnames:
+                              description: Hostnames for the above IP address.
+                              items:
+                                type: string
+                              type: array
+                            ip:
+                              description: IP address of the host file entry.
+                              type: string
+                          required:
+                          - ip
+                          type: object
+                        type: array
                       imagePullSecrets:
                         description: Image pull secrets
                         items:
@@ -507,9 +522,6 @@ spec:
                           type: object
                           x-kubernetes-preserve-unknown-fields: true
                         type: array
-                    required:
-                    - affinity
-                    - securityContext
                     type: object
                 type: object
               topicMapping:
diff --git a/docs/strimzi-backup-operator-prd.md b/docs/strimzi-backup-operator-prd.md
@@ -217,6 +217,10 @@ spec:
           prometheus.io/port: "9090"
       affinity: {}
       tolerations: []
+      hostAliases:
+        - ip: "10.10.0.5"
+          hostnames:
+            - "s3.internal"
       securityContext:
         runAsNonRoot: true
         runAsUser: 1001
@@ -335,6 +339,10 @@ spec:
       metadata:
         labels:
           custom-label: restore-pod
+      hostAliases:
+        - ip: "10.10.0.5"
+          hostnames:
+            - "s3.internal"
 
 status:
   conditions:
diff --git a/src/crd/common.rs b/src/crd/common.rs
@@ -1,4 +1,5 @@
 use chrono::{DateTime, Utc};
+use k8s_openapi::api::core::v1::HostAlias;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
@@ -389,20 +390,23 @@ pub struct PodOverrides {
     pub metadata: Option<PodMetadata>,
     /// Pod affinity rules (pass-through to k8s Affinity)
     #[schemars(schema_with = "free_form_object")]
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub affinity: Option<serde_json::Value>,
     /// Pod tolerations (pass-through to k8s Tolerations)
     #[schemars(schema_with = "free_form_object_array")]
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub tolerations: Vec<serde_json::Value>,
     /// Pod security context (pass-through to k8s PodSecurityContext)
     #[schemars(schema_with = "free_form_object")]
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<serde_json::Value>,
     /// Image pull secrets
     #[schemars(schema_with = "free_form_object_array")]
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub image_pull_secrets: Vec<serde_json::Value>,
+    /// Pod host aliases (pass-through to k8s HostAlias)
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_aliases: Vec<HostAlias>,
 }
 
 #[derive(Clone, Debug, Default, Deserialize, Serialize, JsonSchema)]
@@ -425,7 +429,7 @@ pub struct ContainerOverrides {
     pub env: Vec<serde_json::Value>,
     /// Container security context (pass-through to k8s SecurityContext)
     #[schemars(schema_with = "free_form_object")]
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<serde_json::Value>,
 }
 
diff --git a/src/jobs/templates.rs b/src/jobs/templates.rs
@@ -349,6 +349,10 @@ pub fn apply_pod_template(pod_spec: &mut PodSpec, template: Option<&CrdPodTempla
                 pod_spec.image_pull_secrets = Some(secrets);
             }
         }
+
+        if !pod_overrides.host_aliases.is_empty() {
+            pod_spec.host_aliases = Some(pod_overrides.host_aliases.clone());
+        }
     }
 
     if let Some(container_overrides) = &tmpl.container {
diff --git a/tests/integration/backup_test.rs b/tests/integration/backup_test.rs
@@ -1,3 +1,4 @@
+use k8s_openapi::api::core::v1::HostAlias;
 use kafka_backup_operator::adapters::backup_config::build_backup_config_yaml;
 use kafka_backup_operator::crd::common::*;
 use kafka_backup_operator::crd::kafka_backup::*;
@@ -95,6 +96,22 @@ fn sample_cluster() -> ResolvedKafkaCluster {
     }
 }
 
+fn host_alias_template() -> PodTemplateSpec {
+    PodTemplateSpec {
+        pod: Some(PodOverrides {
+            host_aliases: vec![HostAlias {
+                ip: "10.10.0.5".to_string(),
+                hostnames: Some(vec![
+                    "s3.internal".to_string(),
+                    "minio.internal".to_string(),
+                ]),
+            }],
+            ..Default::default()
+        }),
+        container: None,
+    }
+}
+
 #[test]
 fn test_backup_config_generation() {
     let backup = sample_backup();
@@ -245,6 +262,61 @@ fn test_backup_cronjob_uses_configured_service_account() {
             && env.value.as_deref() == Some("kafka_backup=debug,rdkafka=info")));
 }
 
+#[test]
+fn test_backup_jobs_apply_template_host_aliases() {
+    let mut backup = sample_backup();
+    backup.spec.template = Some(host_alias_template());
+    let cluster = sample_cluster();
+
+    let job = build_backup_job(
+        &backup,
+        "daily-backup-20260213-020000",
+        "daily-backup-config",
+        &cluster,
+        &ResolvedAuth::None,
+        Some("strimzi-backup-operator"),
+    )
+    .unwrap();
+
+    let pod_spec = job.spec.as_ref().unwrap().template.spec.as_ref().unwrap();
+    let host_aliases = pod_spec.host_aliases.as_ref().unwrap();
+    assert_eq!(host_aliases.len(), 1);
+    assert_eq!(host_aliases[0].ip, "10.10.0.5");
+    assert_eq!(
+        host_aliases[0].hostnames.as_ref().unwrap(),
+        &vec!["s3.internal".to_string(), "minio.internal".to_string()]
+    );
+
+    let cronjob = build_backup_cronjob(
+        &backup,
+        "daily-backup-config",
+        &cluster,
+        &ResolvedAuth::None,
+        Some("strimzi-backup-operator"),
+    )
+    .unwrap();
+
+    let cron_pod_spec = cronjob
+        .spec
+        .as_ref()
+        .unwrap()
+        .job_template
+        .spec
+        .as_ref()
+        .unwrap()
+        .template
+        .spec
+        .as_ref()
+        .unwrap();
+    let cron_host_aliases = cron_pod_spec.host_aliases.as_ref().unwrap();
+    assert_eq!(cron_host_aliases.len(), 1);
+    assert_eq!(cron_host_aliases[0].ip, "10.10.0.5");
+    assert_eq!(
+        cron_host_aliases[0].hostnames.as_ref().unwrap(),
+        &vec!["s3.internal".to_string(), "minio.internal".to_string()]
+    );
+}
+
 #[test]
 fn test_backup_with_tls_auth() {
     let mut backup = sample_backup();
diff --git a/tests/integration/restore_test.rs b/tests/integration/restore_test.rs
