From 63f722c59c6bcaac70e5acdb370e8e458c5fcfa4 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Tue, 20 Oct 2026 16:49:01 +0200
Subject: [PATCH] Preserve latest CoreDNS deployment reference before
 retirement

---
 README.md                     |  5 +++--
 coredns-scheduling-patch.yaml |  3 +++
 install.sh                    | 15 ++++++++++++++-
 test.sh                       |  6 ++++--
 4 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index d8c9caf..04a09d6 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
-# CoreDNS scheduling
+# CoreDNS
 
-CoreDNS runs with two replicas on distinct ODROID H3 worker nodes. The required
+CoreDNS is pinned to `v1.14.7` and runs with two replicas on distinct ODROID H3
+worker nodes. The required
 node affinity prevents it from being scheduled on the experimental control-plane
 node (`arschrock`), while required pod anti-affinity prevents both replicas from
 sharing a worker.
diff --git a/coredns-scheduling-patch.yaml b/coredns-scheduling-patch.yaml
index a2408e2..50a0aef 100644
--- a/coredns-scheduling-patch.yaml
+++ b/coredns-scheduling-patch.yaml
@@ -7,6 +7,9 @@ spec:
   replicas: 2
   template:
     spec:
+      containers:
+        - name: coredns
+          image: registry.k8s.io/coredns/coredns:v1.14.7
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
diff --git a/install.sh b/install.sh
index 3646f15..2cc9a43 100755
--- a/install.sh
+++ b/install.sh
@@ -1,7 +1,20 @@
 #!/bin/sh
 set -eu
 project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+expected_context=kubernetes-admin@kubernetes
+current_context=$(kubectl config current-context)
+if [ "$current_context" != "$expected_context" ]; then
+  echo "Refusing to modify context '$current_context'; expected '$expected_context'." >&2
+  exit 1
+fi
+
+kubectl -n kube-system patch deployment coredns --type=strategic \
+  --patch-file "$project_dir/coredns-scheduling-patch.yaml" \
+  --dry-run=server >/dev/null
+kubectl apply --server-side --dry-run=server \
+  -f "$project_dir/coredns-pdb.yaml" >/dev/null
 kubectl -n kube-system patch deployment coredns --type=strategic \
   --patch-file "$project_dir/coredns-scheduling-patch.yaml"
-kubectl apply -f "$project_dir/coredns-pdb.yaml"
+kubectl apply --server-side -f "$project_dir/coredns-pdb.yaml"
 kubectl -n kube-system rollout status deployment/coredns --timeout=5m
diff --git a/test.sh b/test.sh
index db60baa..f4d49bb 100755
--- a/test.sh
+++ b/test.sh
@@ -4,9 +4,11 @@ dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 sh -n "$dir/install.sh"
 bash -n "$dir/create-ci-kubeconfig.sh" "$dir/test.sh"
 grep -Fq 'namespace: kube-system' "$dir/coredns-scheduling-patch.yaml"
+grep -Fq 'registry.k8s.io/coredns/coredns:v1.14.7' "$dir/coredns-scheduling-patch.yaml"
 grep -Fq 'odroid-h3' "$dir/coredns-scheduling-patch.yaml"
 grep -Fq 'requiredDuringSchedulingIgnoredDuringExecution' "$dir/coredns-scheduling-patch.yaml"
 image=ghcr.io/yannh/kubeconform:v0.7.0
-docker run --rm -i "$image" -strict -exit-on-error -summary < "$dir/coredns-pdb.yaml"
-docker run --rm -i "$image" -strict -exit-on-error -summary < "$dir/ci-deployer.yaml"
+runtime=${CONTAINER_RUNTIME:-podman}
+"$runtime" run --rm -i "$image" -strict -exit-on-error -summary < "$dir/coredns-pdb.yaml"
+"$runtime" run --rm -i "$image" -strict -exit-on-error -summary < "$dir/ci-deployer.yaml"
 echo 'CoreDNS scheduling manifests and least-privilege CI resources are valid.'