Enable CoreDNS reconciliation after healthy adoption

apps/coredns/README.md

@@ -1,18 +1,18 @@
 # CoreDNS adoption
 
-The upstream CoreDNS chart is staged as an Argo Application with automatic sync
-disabled. It preserves the `kube-system/coredns` Deployment selector, the
+The upstream CoreDNS chart is reconciled by Argo CD. It preserves the
+`kube-system/coredns` Deployment selector, the
 `kube-dns` Service name and `10.96.0.10` ClusterIP, the current image tag,
 Corefile behavior, two ODROID replicas, and the existing PDB selector.
 
-Do not enable automatic sync before reviewing the live Argo diff and proving
-DNS resolution through the two existing endpoints. The chart uses different
-port names and additional Pod labels/security settings, so adoption will roll
-cluster DNS even though its serving port numbers remain 53/TCP and 53/UDP.
+The first no-prune sync was validated with two ready DNS endpoints and working
+UDP/TCP lookups. The chart uses different port names and additional Pod
+labels/security settings, so its initial adoption rolled the DNS pods; the
+Service UID and `10.96.0.10` ClusterIP stayed unchanged. The separate
+`prometheus-kube-prometheus-coredns` Service still serves metrics on 9153.
 The existing `system:coredns` RBAC and `coredns` ServiceAccount remain owned by
 Kubernetes bootstrap; this chart intentionally does not render replacements.
 
-Until cutover succeeds, the historical `coredns-deployment` repository remains
-the live direct-CD writer. Once Argo is Synced/Healthy and DNS tests pass,
-retire that workflow and its kubeconfig/RBAC and archive the deployment-only
-repository.
+Pruning stays disabled for this cluster-critical service. The historical
+`coredns-deployment` direct-CD workflow and kubeconfig/RBAC are retired after
+Argo adoption; the deployment-only repository is archived.

bootstrap/coredns.yaml

@@ -21,8 +21,8 @@ spec:
     namespace: kube-system
   syncPolicy:
     automated:
-      enabled: false
+      enabled: true
       prune: false
-      selfHeal: false
+      selfHeal: true
     syncOptions:
     - CreateNamespace=false