Preserve latest CoreDNS deployment reference before retirement

README.md

@@ -1,6 +1,7 @@
-# CoreDNS scheduling
+# CoreDNS
 
-CoreDNS runs with two replicas on distinct ODROID H3 worker nodes. The required
+CoreDNS is pinned to `v1.14.7` and runs with two replicas on distinct ODROID H3
+worker nodes. The required
 node affinity prevents it from being scheduled on the experimental control-plane
 node (`arschrock`), while required pod anti-affinity prevents both replicas from
 sharing a worker.

coredns-scheduling-patch.yaml

@@ -7,6 +7,9 @@ spec:
   replicas: 2
   template:
     spec:
+      containers:
+        - name: coredns
+          image: registry.k8s.io/coredns/coredns:v1.14.7
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:

install.sh

@@ -1,7 +1,20 @@
 #!/bin/sh
 set -eu
 project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+expected_context=kubernetes-admin@kubernetes
+current_context=$(kubectl config current-context)
+if [ "$current_context" != "$expected_context" ]; then
+  echo "Refusing to modify context '$current_context'; expected '$expected_context'." >&2
+  exit 1
+fi
+
+kubectl -n kube-system patch deployment coredns --type=strategic \
+  --patch-file "$project_dir/coredns-scheduling-patch.yaml" \
+  --dry-run=server >/dev/null
+kubectl apply --server-side --dry-run=server \
+  -f "$project_dir/coredns-pdb.yaml" >/dev/null
 kubectl -n kube-system patch deployment coredns --type=strategic \
   --patch-file "$project_dir/coredns-scheduling-patch.yaml"
-kubectl apply -f "$project_dir/coredns-pdb.yaml"
+kubectl apply --server-side -f "$project_dir/coredns-pdb.yaml"
 kubectl -n kube-system rollout status deployment/coredns --timeout=5m

test.sh

@@ -4,9 +4,11 @@ dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 sh -n "$dir/install.sh"
 bash -n "$dir/create-ci-kubeconfig.sh" "$dir/test.sh"
 grep -Fq 'namespace: kube-system' "$dir/coredns-scheduling-patch.yaml"
+grep -Fq 'registry.k8s.io/coredns/coredns:v1.14.7' "$dir/coredns-scheduling-patch.yaml"
 grep -Fq 'odroid-h3' "$dir/coredns-scheduling-patch.yaml"
 grep -Fq 'requiredDuringSchedulingIgnoredDuringExecution' "$dir/coredns-scheduling-patch.yaml"
 image=ghcr.io/yannh/kubeconform:v0.7.0
-docker run --rm -i "$image" -strict -exit-on-error -summary < "$dir/coredns-pdb.yaml"
-docker run --rm -i "$image" -strict -exit-on-error -summary < "$dir/ci-deployer.yaml"
+runtime=${CONTAINER_RUNTIME:-podman}
+"$runtime" run --rm -i "$image" -strict -exit-on-error -summary < "$dir/coredns-pdb.yaml"
+"$runtime" run --rm -i "$image" -strict -exit-on-error -summary < "$dir/ci-deployer.yaml"
 echo 'CoreDNS scheduling manifests and least-privilege CI resources are valid.'