Run CoreDNS on the AI core node and prefer local DNS replicas

k8s-ng/core/coredns-config/deployment.yaml

@@ -11,6 +11,17 @@ spec:
   replicas: 3
   template:
     spec:
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+        # DNS also belongs on the internal core node used by Actions jobs.
+        - key: workload
+          operator: Equal
+          value: ai
+          effect: NoSchedule
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:

k8s-ng/core/coredns-config/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - deployment.yaml
+  - service.yaml

k8s-ng/core/coredns-config/service.yaml

@@ -0,0 +1,11 @@
+# Keep DNS on the caller's node when it has a healthy CoreDNS replica. K3s owns
+# the rest of this Service; server-side apply preserves its ports and selector.
+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-dns
+  namespace: kube-system
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false,Delete=false
+spec:
+  trafficDistribution: PreferSameNode