CoreDNS scheduling

CoreDNS runs with two replicas on distinct ODROID H3 worker nodes. The required node affinity prevents it from being scheduled on the experimental control-plane node (arschrock), while required pod anti-affinity prevents both replicas from sharing a worker.

Apply and verify the configuration with:

kubectl -n kube-system patch deployment coredns \
  --type=strategic \
  --patch-file coredns-scheduling-patch.yaml
kubectl apply -f coredns-pdb.yaml
kubectl -n kube-system rollout status deployment/coredns
kubectl -n kube-system get pods -l k8s-app=kube-dns -o wide

The ODROID worker nodes must retain the label odroid-h3=enabled.

./install.sh performs those steps for an administrator. Gitea Actions checks the manifests on every branch and updates only the exact existing kube-system/coredns Deployment and PodDisruptionBudget on main. Its identity cannot read Secrets, create or delete resources, or change any other workload. Run ./create-ci-kubeconfig.sh once and store only its final line as the repository Actions secret KUBE_CONFIG_BASE64.