From 8625682ce5377bc3ffd3aa4f16ee5aec7ea64948 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 14:30:09 -0700
Subject: [PATCH 01/10] Test script

---
 run-tests.sh | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100755 run-tests.sh

diff --git a/run-tests.sh b/run-tests.sh
new file mode 100755
index 00000000..88264248
--- /dev/null
+++ b/run-tests.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+# Track overall status
+STATUS=0
+LOG_DIR="logs"
+
+mkdir -p "$LOG_DIR"
+
+function sanitize() {
+  echo "$1" | tr ' /' '__'
+}
+
+function run_step() {
+  local name="$1"
+  local cmd="$2"
+  local log_file="$LOG_DIR/$(sanitize "$name").log"
+
+  echo -e "\n🔧 Running step: ${name}"
+  echo "    ↪ Logging to: $log_file"
+
+  if bash -c "$cmd" > "$log_file" 2>&1; then
+    echo -e "${GREEN}✅ Step succeeded: ${name}${NC}"
+  else
+    echo -e "${RED}❌ Step failed: ${name}${NC} (see $log_file)"
+    STATUS=1
+  fi
+}
+
+# Run steps
+run_step "Kubebuilder smoke and unit tests" "make test"
+run_step "Helm lint" "make helm-lint"
+run_step "Helm template" "make helm-template"
+run_step "End-to-end tests" "make e2e"
+
+# Final status
+echo ""
+if [ "$STATUS" -eq 0 ]; then
+  echo -e "${GREEN}🎉 All tests passed!${NC}"
+  exit 0
+else
+  echo -e "${RED}🔥 Some tests failed. Check logs in: $LOG_DIR${NC}"
+  exit 1
+fi
\ No newline at end of file

From 75eb94cfeee4d1e107c3e7370a1217e875355025 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 15:34:11 -0700
Subject: [PATCH 02/10] Accept DNSPolicy, DNSConfig (no test or API/docs
 updates yet).

---
 apis/druid/v1alpha1/druid_types.go | 16 ++++++++++++++++
 controllers/druid/handler.go       |  2 ++
 2 files changed, 18 insertions(+)

diff --git a/apis/druid/v1alpha1/druid_types.go b/apis/druid/v1alpha1/druid_types.go
index 0fd457ca..0e97ae6d 100644
--- a/apis/druid/v1alpha1/druid_types.go
+++ b/apis/druid/v1alpha1/druid_types.go
@@ -290,6 +290,14 @@ type DruidSpec struct {
 
 	// +optional
 	Auth druidapi.Auth `json:"auth,omitempty"`
+
+	// See v1.DNSPolicy for more details.
+	// +optional
+	DNSPolicy v1.DNSPolicy `json:"dnsPolicy,omitempty" protobuf:"bytes,6,opt,name=dnsPolicy,casttype=DNSPolicy"`
+
+	// See v1.PodDNSConfig for more details.
+	// +optional
+	DNSConfig *v1.PodDNSConfig `json:"dnsConfig,omitempty" protobuf:"bytes,26,opt,name=dnsConfig"`
 }
 
 // DruidNodeSpec Specification of `Druid` Node type and its configurations.
@@ -494,6 +502,14 @@ type DruidNodeSpec struct {
 	// Dynamic Configurations for Druid. Applied through the dynamic configuration API.
 	// +optional
 	DynamicConfig runtime.RawExtension `json:"dynamicConfig,omitempty"`
+
+	// See v1.DNSPolicy for more details.
+	// +optional
+	DNSPolicy v1.DNSPolicy `json:"dnsPolicy,omitempty" protobuf:"bytes,6,opt,name=dnsPolicy,casttype=DNSPolicy"`
+
+	// See v1.PodDNSConfig for more details.
+	// +optional
+	DNSConfig *v1.PodDNSConfig `json:"dnsConfig,omitempty" protobuf:"bytes,26,opt,name=dnsConfig"`
 }
 
 // ZookeeperSpec IGNORED (Future API): In order to make Druid dependency setup extensible from within Druid operator.
diff --git a/controllers/druid/handler.go b/controllers/druid/handler.go
index c47032cc..8fc251dc 100644
--- a/controllers/druid/handler.go
+++ b/controllers/druid/handler.go
@@ -1122,6 +1122,8 @@ func makePodSpec(nodeSpec *v1alpha1.DruidNodeSpec, m *v1alpha1.Druid, nodeSpecUn
 		SecurityContext:               firstNonNilValue(nodeSpec.PodSecurityContext, m.Spec.PodSecurityContext).(*v1.PodSecurityContext),
 		ServiceAccountName:            firstNonEmptyStr(nodeSpec.ServiceAccountName, m.Spec.ServiceAccount),
 		PriorityClassName:             firstNonEmptyStr(nodeSpec.PriorityClassName, m.Spec.PriorityClassName),
+		DNSPolicy:                     v1.DNSPolicy(firstNonEmptyStr(string(nodeSpec.DNSPolicy), string(m.Spec.DNSPolicy))),
+		DNSConfig:                     firstNonNilValue(nodeSpec.DNSConfig, m.Spec.DNSConfig).(*v1.PodDNSConfig),
 	}
 
 	addAdditionalContainers(m, nodeSpec, &spec)

From ea8a18ba8bfdaa5450a89822daa1e9b2c6b774fd Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 17:00:53 -0700
Subject: [PATCH 03/10] Adding tests for DNSPolicy.

---
 controllers/druid/handler_test.go             | 49 +++++++++++++++++++
 controllers/druid/testdata/druid-test-cr.yaml |  1 +
 2 files changed, 50 insertions(+)

diff --git a/controllers/druid/handler_test.go b/controllers/druid/handler_test.go
index bde1a877..1daae093 100644
--- a/controllers/druid/handler_test.go
+++ b/controllers/druid/handler_test.go
@@ -2,6 +2,7 @@ package druid
 
 import (
 	"io/ioutil"
+	"testing"
 
 	"github.com/ghodss/yaml"
 	. "github.com/onsi/ginkgo/v2"
@@ -213,3 +214,51 @@ func readAndUnmarshallResource(file string, res interface{}) error {
 	}
 	return nil
 }
+
+// TestPodSpecDNSPolicyResolution verifies DNSPolicy resolution in makePodSpec.
+func TestPodSpecDNSPolicyResolution(t *testing.T) {
+	tests := []struct {
+		name     string
+		nodeDNS  string
+		specDNS  string
+		expected corev1.DNSPolicy
+	}{
+		{"Both empty", "", "", corev1.DNSPolicy("")},
+		{"Only spec provided", "", "ClusterFirst", corev1.DNSPolicy("ClusterFirst")},
+		{"Only node provided", "Default", "", corev1.DNSPolicy("Default")},
+		{"Both provided, node wins", "Default", "ClusterFirst", corev1.DNSPolicy("Default")},
+	}
+
+	for _, tc := range tests {
+		tc := tc // capture current test case
+		t.Run(tc.name, func(t *testing.T) {
+			m := &druidv1alpha1.Druid{
+				Spec: druidv1alpha1.DruidSpec{
+					DNSPolicy: corev1.DNSPolicy(tc.specDNS),
+				},
+			}
+			nodeSpec := &druidv1alpha1.DruidNodeSpec{
+				DNSPolicy: corev1.DNSPolicy(tc.nodeDNS),
+			}
+			podSpec := makePodSpec(nodeSpec, m, "unique", "dummySHA")
+			if podSpec.DNSPolicy != tc.expected {
+				t.Errorf("expected DNSPolicy %q, got %q", tc.expected, podSpec.DNSPolicy)
+			}
+		})
+	}
+}
+
+// TestPodSpecDNSPolicyYAML validates that the generated PodSpec DNSPolicy matches the expected value,
+// using the druid-test-cr.yaml as the single input file.
+func TestPodSpecDNSPolicyYAML(t *testing.T) {
+	m, err := readDruidClusterSpecFromFile("testdata/druid-test-cr.yaml")
+	if err != nil {
+		t.Fatalf("failed to read cluster spec: %v", err)
+	}
+	nodeSpec := m.Spec.Nodes["middlemanagers"]
+	podSpec := makePodSpec(&nodeSpec, m, "unique", "dummySHA")
+	expectedDNSPolicy := corev1.DNSPolicy("ClusterFirst")
+	if podSpec.DNSPolicy != expectedDNSPolicy {
+		t.Errorf("expected DNSPolicy %q, got %q", expectedDNSPolicy, podSpec.DNSPolicy)
+	}
+}
diff --git a/controllers/druid/testdata/druid-test-cr.yaml b/controllers/druid/testdata/druid-test-cr.yaml
index d3197408..f29a4fb0 100644
--- a/controllers/druid/testdata/druid-test-cr.yaml
+++ b/controllers/druid/testdata/druid-test-cr.yaml
@@ -355,3 +355,4 @@ spec:
         limits:
           memory: "3Gi"
           cpu: "4"
+      dnsPolicy: ClusterFirst

From 2cc72add1bc28478e7e2c56a373d25ec19123adb Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 17:07:59 -0700
Subject: [PATCH 04/10] Add Kubebuilder generated files.

---
 apis/druid/v1alpha1/zz_generated.deepcopy.go  | 10 +++
 chart/crds/druid.apache.org_druids.yaml       | 80 +++++++++++++++++++
 config/crd/bases/druid.apache.org_druids.yaml | 80 +++++++++++++++++++
 3 files changed, 170 insertions(+)

diff --git a/apis/druid/v1alpha1/zz_generated.deepcopy.go b/apis/druid/v1alpha1/zz_generated.deepcopy.go
index 26253972..ea1550a2 100644
--- a/apis/druid/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/druid/v1alpha1/zz_generated.deepcopy.go
@@ -511,6 +511,11 @@ func (in *DruidNodeSpec) DeepCopyInto(out *DruidNodeSpec) {
 		}
 	}
 	in.DynamicConfig.DeepCopyInto(&out.DynamicConfig)
+	if in.DNSConfig != nil {
+		in, out := &in.DNSConfig, &out.DNSConfig
+		*out = new(v1.PodDNSConfig)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DruidNodeSpec.
@@ -700,6 +705,11 @@ func (in *DruidSpec) DeepCopyInto(out *DruidSpec) {
 	}
 	in.DynamicConfig.DeepCopyInto(&out.DynamicConfig)
 	out.Auth = in.Auth
+	if in.DNSConfig != nil {
+		in, out := &in.DNSConfig, &out.DNSConfig
+		*out = new(v1.PodDNSConfig)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DruidSpec.
diff --git a/chart/crds/druid.apache.org_druids.yaml b/chart/crds/druid.apache.org_druids.yaml
index 742756db..9bec0105 100644
--- a/chart/crds/druid.apache.org_druids.yaml
+++ b/chart/crds/druid.apache.org_druids.yaml
@@ -1501,6 +1501,46 @@ spec:
                 description: DisablePVCDeletionFinalizer Whether PVCs shall be deleted
                   on the deletion of the Druid cluster.
                 type: boolean
+              dnsConfig:
+                description: See v1.PodDNSConfig for more details.
+                properties:
+                  nameservers:
+                    description: |-
+                      A list of DNS name server IP addresses.
+                      This will be appended to the base nameservers generated from DNSPolicy.
+                      Duplicated nameservers will be removed.
+                    items:
+                      type: string
+                    type: array
+                  options:
+                    description: |-
+                      A list of DNS resolver options.
+                      This will be merged with the base options generated from DNSPolicy.
+                      Duplicated entries will be removed. Resolution options given in Options
+                      will override those that appear in the base DNSPolicy.
+                    items:
+                      description: PodDNSConfigOption defines DNS resolver options
+                        of a pod.
+                      properties:
+                        name:
+                          description: Required.
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  searches:
+                    description: |-
+                      A list of DNS search domains for host-name lookup.
+                      This will be appended to the base search paths generated from DNSPolicy.
+                      Duplicated search paths will be removed.
+                    items:
+                      type: string
+                    type: array
+                type: object
+              dnsPolicy:
+                description: See v1.DNSPolicy for more details.
+                type: string
               dynamicConfig:
                 description: Dynamic Configurations for Druid. Applied through the
                   dynamic configuration API.
@@ -3367,6 +3407,46 @@ spec:
                               type: string
                           type: object
                       type: object
+                    dnsConfig:
+                      description: See v1.PodDNSConfig for more details.
+                      properties:
+                        nameservers:
+                          description: |-
+                            A list of DNS name server IP addresses.
+                            This will be appended to the base nameservers generated from DNSPolicy.
+                            Duplicated nameservers will be removed.
+                          items:
+                            type: string
+                          type: array
+                        options:
+                          description: |-
+                            A list of DNS resolver options.
+                            This will be merged with the base options generated from DNSPolicy.
+                            Duplicated entries will be removed. Resolution options given in Options
+                            will override those that appear in the base DNSPolicy.
+                          items:
+                            description: PodDNSConfigOption defines DNS resolver options
+                              of a pod.
+                            properties:
+                              name:
+                                description: Required.
+                                type: string
+                              value:
+                                type: string
+                            type: object
+                          type: array
+                        searches:
+                          description: |-
+                            A list of DNS search domains for host-name lookup.
+                            This will be appended to the base search paths generated from DNSPolicy.
+                            Duplicated search paths will be removed.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    dnsPolicy:
+                      description: See v1.DNSPolicy for more details.
+                      type: string
                     druid.port:
                       description: DruidPort Used by the `Druid` process.
                       format: int32
diff --git a/config/crd/bases/druid.apache.org_druids.yaml b/config/crd/bases/druid.apache.org_druids.yaml
index 742756db..9bec0105 100644
--- a/config/crd/bases/druid.apache.org_druids.yaml
+++ b/config/crd/bases/druid.apache.org_druids.yaml
@@ -1501,6 +1501,46 @@ spec:
                 description: DisablePVCDeletionFinalizer Whether PVCs shall be deleted
                   on the deletion of the Druid cluster.
                 type: boolean
+              dnsConfig:
+                description: See v1.PodDNSConfig for more details.
+                properties:
+                  nameservers:
+                    description: |-
+                      A list of DNS name server IP addresses.
+                      This will be appended to the base nameservers generated from DNSPolicy.
+                      Duplicated nameservers will be removed.
+                    items:
+                      type: string
+                    type: array
+                  options:
+                    description: |-
+                      A list of DNS resolver options.
+                      This will be merged with the base options generated from DNSPolicy.
+                      Duplicated entries will be removed. Resolution options given in Options
+                      will override those that appear in the base DNSPolicy.
+                    items:
+                      description: PodDNSConfigOption defines DNS resolver options
+                        of a pod.
+                      properties:
+                        name:
+                          description: Required.
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    type: array
+                  searches:
+                    description: |-
+                      A list of DNS search domains for host-name lookup.
+                      This will be appended to the base search paths generated from DNSPolicy.
+                      Duplicated search paths will be removed.
+                    items:
+                      type: string
+                    type: array
+                type: object
+              dnsPolicy:
+                description: See v1.DNSPolicy for more details.
+                type: string
               dynamicConfig:
                 description: Dynamic Configurations for Druid. Applied through the
                   dynamic configuration API.
@@ -3367,6 +3407,46 @@ spec:
                               type: string
                           type: object
                       type: object
+                    dnsConfig:
+                      description: See v1.PodDNSConfig for more details.
+                      properties:
+                        nameservers:
+                          description: |-
+                            A list of DNS name server IP addresses.
+                            This will be appended to the base nameservers generated from DNSPolicy.
+                            Duplicated nameservers will be removed.
+                          items:
+                            type: string
+                          type: array
+                        options:
+                          description: |-
+                            A list of DNS resolver options.
+                            This will be merged with the base options generated from DNSPolicy.
+                            Duplicated entries will be removed. Resolution options given in Options
+                            will override those that appear in the base DNSPolicy.
+                          items:
+                            description: PodDNSConfigOption defines DNS resolver options
+                              of a pod.
+                            properties:
+                              name:
+                                description: Required.
+                                type: string
+                              value:
+                                type: string
+                            type: object
+                          type: array
+                        searches:
+                          description: |-
+                            A list of DNS search domains for host-name lookup.
+                            This will be appended to the base search paths generated from DNSPolicy.
+                            Duplicated search paths will be removed.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    dnsPolicy:
+                      description: See v1.DNSPolicy for more details.
+                      type: string
                     druid.port:
                       description: DruidPort Used by the `Druid` process.
                       format: int32

From 9d9d07f1b2c741774048155c489d23fea20df480 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 17:23:55 -0700
Subject: [PATCH 05/10] Remove local test script.

---
 run-tests.sh | 50 --------------------------------------------------
 1 file changed, 50 deletions(-)
 delete mode 100755 run-tests.sh

diff --git a/run-tests.sh b/run-tests.sh
deleted file mode 100755
index 88264248..00000000
--- a/run-tests.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-NC='\033[0m' # No Color
-
-# Track overall status
-STATUS=0
-LOG_DIR="logs"
-
-mkdir -p "$LOG_DIR"
-
-function sanitize() {
-  echo "$1" | tr ' /' '__'
-}
-
-function run_step() {
-  local name="$1"
-  local cmd="$2"
-  local log_file="$LOG_DIR/$(sanitize "$name").log"
-
-  echo -e "\n🔧 Running step: ${name}"
-  echo "    ↪ Logging to: $log_file"
-
-  if bash -c "$cmd" > "$log_file" 2>&1; then
-    echo -e "${GREEN}✅ Step succeeded: ${name}${NC}"
-  else
-    echo -e "${RED}❌ Step failed: ${name}${NC} (see $log_file)"
-    STATUS=1
-  fi
-}
-
-# Run steps
-run_step "Kubebuilder smoke and unit tests" "make test"
-run_step "Helm lint" "make helm-lint"
-run_step "Helm template" "make helm-template"
-run_step "End-to-end tests" "make e2e"
-
-# Final status
-echo ""
-if [ "$STATUS" -eq 0 ]; then
-  echo -e "${GREEN}🎉 All tests passed!${NC}"
-  exit 0
-else
-  echo -e "${RED}🔥 Some tests failed. Check logs in: $LOG_DIR${NC}"
-  exit 1
-fi
\ No newline at end of file

From 77885d0512deb6c2b68afb3a3ebf27613a140579 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 17:31:38 -0700
Subject: [PATCH 06/10] Set dnsPolicy: Default in e2e tests.

---
 e2e/configs/druid-cr.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/e2e/configs/druid-cr.yaml b/e2e/configs/druid-cr.yaml
index 977f8c89..8229f4d8 100644
--- a/e2e/configs/druid-cr.yaml
+++ b/e2e/configs/druid-cr.yaml
@@ -121,6 +121,7 @@ spec:
       valueFrom:
         fieldRef:
           fieldPath: metadata.namespace
+  dnsPolicy: Default
   nodes:
     brokers:
       # Optionally specify for running broker as Deployment

From b251ab7ab8fe45566aac783025c58a8711c7dc17 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Wed, 2 Apr 2025 18:01:14 -0700
Subject: [PATCH 07/10] Set dnsPolicy: ClusterFirst (the default value) in e2e
 tests.

---
 e2e/configs/druid-cr.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/e2e/configs/druid-cr.yaml b/e2e/configs/druid-cr.yaml
index 8229f4d8..635ad41f 100644
--- a/e2e/configs/druid-cr.yaml
+++ b/e2e/configs/druid-cr.yaml
@@ -121,7 +121,7 @@ spec:
       valueFrom:
         fieldRef:
           fieldPath: metadata.namespace
-  dnsPolicy: Default
+  dnsPolicy: ClusterFirst
   nodes:
     brokers:
       # Optionally specify for running broker as Deployment

From 3dfe670d4387b94e8687ebf50b1aed12ae9fac68 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Sat, 5 Apr 2025 08:25:52 -0700
Subject: [PATCH 08/10] Add support for custom PodDNSConfig

---
 controllers/druid/handler_test.go             | 93 ++++++++++++++++++-
 controllers/druid/testdata/druid-test-cr.yaml |  5 +
 e2e/configs/druid-cr.yaml                     |  5 +
 3 files changed, 101 insertions(+), 2 deletions(-)

diff --git a/controllers/druid/handler_test.go b/controllers/druid/handler_test.go
index 1daae093..55887c9d 100644
--- a/controllers/druid/handler_test.go
+++ b/controllers/druid/handler_test.go
@@ -2,6 +2,7 @@ package druid
 
 import (
 	"io/ioutil"
+	"reflect"
 	"testing"
 
 	"github.com/ghodss/yaml"
@@ -215,8 +216,96 @@ func readAndUnmarshallResource(file string, res interface{}) error {
 	return nil
 }
 
-// TestPodSpecDNSPolicyResolution verifies DNSPolicy resolution in makePodSpec.
-func TestPodSpecDNSPolicyResolution(t *testing.T) {
+func TestPodSpecDNSConfig(t *testing.T) {
+	tests := []struct {
+		name          string
+		nodeDNSConfig *corev1.PodDNSConfig
+		specDNSConfig *corev1.PodDNSConfig
+		expected      *corev1.PodDNSConfig
+	}{
+		{
+			name:          "Both nil",
+			nodeDNSConfig: nil,
+			specDNSConfig: nil,
+			expected:      nil,
+		},
+		{
+			name:          "Only spec provided",
+			nodeDNSConfig: nil,
+			specDNSConfig: &corev1.PodDNSConfig{
+				Nameservers: []string{"8.8.8.8"},
+				Searches:    []string{"example.com"},
+			},
+			expected: &corev1.PodDNSConfig{
+				Nameservers: []string{"8.8.8.8"},
+				Searches:    []string{"example.com"},
+			},
+		},
+		{
+			name: "Only node provided",
+			nodeDNSConfig: &corev1.PodDNSConfig{
+				Nameservers: []string{"1.1.1.1"},
+				Searches:    []string{"node.local"},
+			},
+			specDNSConfig: nil,
+			expected: &corev1.PodDNSConfig{
+				Nameservers: []string{"1.1.1.1"},
+				Searches:    []string{"node.local"},
+			},
+		},
+		{
+			name: "Both provided, node wins",
+			nodeDNSConfig: &corev1.PodDNSConfig{
+				Nameservers: []string{"1.1.1.1"},
+				Searches:    []string{"node.local"},
+			},
+			specDNSConfig: &corev1.PodDNSConfig{
+				Nameservers: []string{"8.8.8.8"},
+				Searches:    []string{"example.com"},
+			},
+			expected: &corev1.PodDNSConfig{
+				Nameservers: []string{"1.1.1.1"},
+				Searches:    []string{"node.local"},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			m := &druidv1alpha1.Druid{
+				Spec: druidv1alpha1.DruidSpec{
+					DNSConfig: tc.specDNSConfig,
+				},
+			}
+			nodeSpec := &druidv1alpha1.DruidNodeSpec{
+				DNSConfig: tc.nodeDNSConfig,
+			}
+			podSpec := makePodSpec(nodeSpec, m, "unique", "dummySHA")
+			if !reflect.DeepEqual(podSpec.DNSConfig, tc.expected) {
+				t.Errorf("expected DNSConfig %v, got %v", tc.expected, podSpec.DNSConfig)
+			}
+		})
+	}
+}
+
+func TestPodSpecDNSConfigYAML(t *testing.T) {
+	m, err := readDruidClusterSpecFromFile("testdata/druid-test-cr.yaml")
+	if err != nil {
+		t.Fatalf("failed to read cluster spec: %v", err)
+	}
+	nodeSpec := m.Spec.Nodes["middlemanagers"]
+	podSpec := makePodSpec(&nodeSpec, m, "unique", "dummySHA")
+	expectedDNSConfig := &corev1.PodDNSConfig{
+		Nameservers: []string{"10.0.0.53"},
+		Searches:    []string{"example.local"},
+	}
+	if !reflect.DeepEqual(podSpec.DNSConfig, expectedDNSConfig) {
+		t.Errorf("expected DNSConfig %v, got %v", expectedDNSConfig, podSpec.DNSConfig)
+	}
+}
+
+// TestPodSpecDNSPolicy verifies DNSPolicy resolution in makePodSpec.
+func TestPodSpecDNSPolicy(t *testing.T) {
 	tests := []struct {
 		name     string
 		nodeDNS  string
diff --git a/controllers/druid/testdata/druid-test-cr.yaml b/controllers/druid/testdata/druid-test-cr.yaml
index f29a4fb0..08fa2dc9 100644
--- a/controllers/druid/testdata/druid-test-cr.yaml
+++ b/controllers/druid/testdata/druid-test-cr.yaml
@@ -356,3 +356,8 @@ spec:
           memory: "3Gi"
           cpu: "4"
       dnsPolicy: ClusterFirst
+      dnsConfig:
+        Nameservers:
+          - 10.0.0.53
+        Searches:
+          - example.local
diff --git a/e2e/configs/druid-cr.yaml b/e2e/configs/druid-cr.yaml
index 635ad41f..09d75f3c 100644
--- a/e2e/configs/druid-cr.yaml
+++ b/e2e/configs/druid-cr.yaml
@@ -122,6 +122,11 @@ spec:
         fieldRef:
           fieldPath: metadata.namespace
   dnsPolicy: ClusterFirst
+  dnsConfig:
+    Nameservers:
+      - 10.0.0.53
+    Searches:
+      - example.local
   nodes:
     brokers:
       # Optionally specify for running broker as Deployment

From f5ec4b257822f9d857ed630f7167ab8caa8aee4b Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Sat, 5 Apr 2025 08:37:47 -0700
Subject: [PATCH 09/10] Remove leading capital letter in cr

---
 controllers/druid/testdata/druid-test-cr.yaml | 4 ++--
 e2e/configs/druid-cr.yaml                     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/controllers/druid/testdata/druid-test-cr.yaml b/controllers/druid/testdata/druid-test-cr.yaml
index 08fa2dc9..0cdc8a23 100644
--- a/controllers/druid/testdata/druid-test-cr.yaml
+++ b/controllers/druid/testdata/druid-test-cr.yaml
@@ -357,7 +357,7 @@ spec:
           cpu: "4"
       dnsPolicy: ClusterFirst
       dnsConfig:
-        Nameservers:
+        nameservers:
           - 10.0.0.53
-        Searches:
+        searches:
           - example.local
diff --git a/e2e/configs/druid-cr.yaml b/e2e/configs/druid-cr.yaml
index 09d75f3c..0fff78ce 100644
--- a/e2e/configs/druid-cr.yaml
+++ b/e2e/configs/druid-cr.yaml
@@ -123,9 +123,9 @@ spec:
           fieldPath: metadata.namespace
   dnsPolicy: ClusterFirst
   dnsConfig:
-    Nameservers:
+    nameservers:
       - 10.0.0.53
-    Searches:
+    searches:
       - example.local
   nodes:
     brokers:

From b82abd3cd40f7c98aab49fe038408f1ce2b64357 Mon Sep 17 00:00:00 2001
From: Eyal Yurman <Eyal.Yurman.-ND@disney.com>
Date: Tue, 29 Apr 2025 10:16:15 -0700
Subject: [PATCH 10/10] document dnsPolicy, dnsConfig.

---
 docs/api_specifications/druid.md | 84 ++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)

diff --git a/docs/api_specifications/druid.md b/docs/api_specifications/druid.md
index fd57ded3..993205d5 100644
--- a/docs/api_specifications/druid.md
+++ b/docs/api_specifications/druid.md
@@ -907,6 +907,34 @@ string
 <p>CoreSite Contents of <code>core-site.xml</code>.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>dnsPolicy</code><br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#dnspolicy-v1-core">
+Kubernetes core/v1.DNSPolicy
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>See v1.DNSPolicy for more details.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>dnsConfig</code><br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#poddnsconfig-v1-core">
+Kubernetes core/v1.PodDNSConfig
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>See v1.PodDNSConfig for more details.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
@@ -1942,6 +1970,34 @@ Kubernetes autoscaling/v2.HorizontalPodAutoscalerSpec
 <p>Operator deploys the sidecar container based on these properties.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>dnsPolicy</code><br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#dnspolicy-v1-core">
+Kubernetes core/v1.DNSPolicy
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>See v1.DNSPolicy for more details.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>dnsConfig</code><br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#poddnsconfig-v1-core">
+Kubernetes core/v1.PodDNSConfig
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>See v1.PodDNSConfig for more details.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>
@@ -2626,6 +2682,34 @@ string
 <p>CoreSite Contents of <code>core-site.xml</code>.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>dnsPolicy</code><br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#dnspolicy-v1-core">
+Kubernetes core/v1.DNSPolicy
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>See v1.DNSPolicy for more details.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>dnsConfig</code><br>
+<em>
+<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#poddnsconfig-v1-core">
+Kubernetes core/v1.PodDNSConfig
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>See v1.PodDNSConfig for more details.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>