k3os CoreDNS upstream resolution and CA trust store propagation

In a k3os environment, CoreDNS operates as a system-wide addon managed by the kube-controller. When deploying on edge nodes with specific upstream DNS providers, resolution often fails because the node's resolv.conf conflicts with the CoreDNS configuration in the k3s manifest.

Furthermore, because k3os utilizes a read-only root filesystem by default, injecting custom CA certificates into the host trust store to facilitate TLS validation is non-trivial. This results in certificate validation failures for containerized applications that rely on the built-in CA generated during initial boot, as the trust anchor is not propagated to downstream pods via standard file system paths.

What is the recommended method to persistently configure upstream DNS forwarders in the k3s manifest without them being overwritten by the agent on reboot? How can custom CA certificates be injected into the k3os trust store while respecting the read-only nature of the OS?