Has anyone got deployed pihole inside k8s? I am trying to use deployment via argocd+kustomization, but having fee issues when deploying pihole 2025.08.0:
- web password does not get picked up from secrets (i am aware that it was moved from WEBPASSWORD v5 to FTLCONF_webserver_api_password for v6)
- resolv.conf is wrong
- can't find running unbound IP
My whole deployment comes from github workflow, where I deploy argocd, and then applies config in applications folder, where futher each application gets deployed from different folders.
Would be good if I could refer to working config, or possibly change deployment type to helm charts?
P.S. Keep in mind, that I have IPv4 + IPv6 enabled on my network. But not in kubernetes YET...
I am testing Cilium capabilities without kube-proxy, exposing admin URL via Gateway IP, while DNS is using LoadBalancer IP.
A lot of my own services are using custom internal CA [That is another project to follow up (not advertised yet)] - so keeping a single CA chain for all wildcard domains passed through Gateway API with a single secret [it is development anyways, no down vote needed], trying to get a production ready solution...
EDIT #1: Updated with manifests
ArgoCD Application:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: pihole-a-dev
namespace: argocd
## ensure it comes up after the unbound app is created; adjust as you prefer
annotations: { argocd.argoproj.io/sync-wave: "1" }
labels:
app.kubernetes.io/part-of: pihole
instance: a
spec:
project: default
destination: { server: https://kubernetes.default.svc, namespace: default }
sources:
- repoURL: https://mojo2600.github.io/pihole-kubernetes/
chart: pihole
targetRevision: "2.34.0" ## @TODO: bump intentionally
helm:
releaseName: pihole-a ## <— gives you pihole-a-web/dns Service names
valueFiles:
- $values/cicd/default/dev/pihole/values/base.yml
- $values/cicd/default/dev/pihole/values/instance-a.yml
- repoURL: https://github.com/<REDACTED_ORG>/<REDACTED_REPO>
targetRevision: pihole
ref: values
syncPolicy:
automated: { prune: true, selfHeal: true }
syncOptions: ["CreateNamespace=false"]
Files inside "cicd/default/dev/pihole/" folder
Secret...
```
$ k describe secret pihole-a
Name: pihole-a
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
secret: 20 bytes
```
```
values/base.yml
admin:
existingSecret: ""
passwordKey: password
Turn off DHCP (we’re only using DNS)
dnsmasq:
customDnsEntries: []
additionalHostsEntries: []
dhcp:
enabled: false
Some charts have a second PVC for dnsmasq; leave off unless needed
dnsmasqPersistentVolumeClaim:
enabled: false # ## @TODO: mirror the same as above if chart supports
extraEnvVars:
DNSMASQ_LISTENING: "all"
DNSMASQ_USER: "root"
DNSSEC: "false"
FTLCONF_dns_upstreams: "unbound.default.svc#5353"
FTLCONF_dns_listeningMode: "all"
FTLCONF_misc_etc_dnsmasq_d: "/etc/dnsmasq.d"
FTLCONF_webserver_port: "80"
PIHOLE_UID: "0"
PIHOLE_GID: "0"
SKIP_CHOWN: "true"
TZ: "Europe/Vilnius"
image:
repository: docker.io/pihole/pihole
tag: "2025.08.0" ## @TODO: choose your tag
imagePullPolicy: IfNotPresent
imagePullSecrets:
- name: dockerhub-creds ## @TODO
persistentVolumeClaim:
enabled: false
accessModes: ["ReadWriteOnce"]
size: 32Gi
podSecurityContext:
runAsUser: 0 ## @TODO: Pi-hole init runs as root
runAsGroup: 0
fsGroup: 0 ## @TODO: for emptyDir it’s fine; see NFS notes below
replicaCount: 1
resources:
requests: { cpu: 100m, memory: 128Mi }
limits: { cpu: 300m, memory: 384Mi }
serviceDhcp:
enabled: false
serviceDns:
mixedService: true
type: LoadBalancer
externalTrafficPolicy: Local
annotations: {}
serviceWeb:
type: ClusterIP
http: { enabled: true, port: 80 }
https: { enabled: false }
values/instance-a.yml
admin:
existingSecret: pihole-a ## @TODO: use the Secret name you created
passwordKey: "secret" ## @TODO: set to the actual key in that Secret
extraVolumes:
- name: vol-etc-pihole
persistentVolumeClaim: { claimName: pvc-pihole-a-etc }
- name: vol-etc-dnsmasq
persistentVolumeClaim: { claimName: pvc-pihole-a-dnsmasq }
extraVolumeMounts:
- { name: vol-etc-pihole, mountPath: /etc/pihole }
- { name: vol-etc-dnsmasq, mountPath: /etc/dnsmasq.d }
serviceDns:
extraLabels: { env: "dns" }
annotations:
lbipam.cilium.io/ips: "10.<REDACTED_SUBNET>.160"
# optionally share VIPs across services by using the same key
# lbipam.cilium.io/sharing-key: "dns-vip"
loadBalancerIP: "10.<REDACTED_SUBNET>.160"
```
```
deployment-a.yml
apiVersion: apps/v1
kind: Deployment
metadata:
name: pihole-a
namespace: default
labels:
app: pihole
instance: a
spec:
replicas: 1
selector:
matchLabels:
app: pihole
instance: a
template:
metadata:
labels:
app: pihole
instance: a
spec:
# imagePullSecrets:
# - name: dockerhub-creds
securityContext:
runAsUser: 0
runAsGroup: 0
fsGroup: 0
containers:
- name: pihole
image: docker.io/pihole/pihole:2025.08.0
imagePullPolicy: IfNotPresent
ports:
- { name: dns-udp, containerPort: 53, protocol: UDP }
- { name: dns-tcp, containerPort: 53, protocol: TCP }
- { name: http, containerPort: 80, protocol: TCP }
env:
- name: WEBPASSWORD
valueFrom:
secretKeyRef:
name: pihole-a # ## @TODO: ensure this Secret exists
key: secret
# --- v6 upstreams & web
- { name: FTLCONF_dns_upstreams, value: "unbound.default.svc#5353" } # <- no cluster domain
- { name: FTLCONF_dns_listeningMode, value: "all" }
- { name: FTLCONF_webserver_port, value: "80" }
- { name: FTLCONF_misc_etc_dnsmasq_d, value: "true" }
# --- must be root (logs demanded this)
- { name: DNSMASQ_USER, value: "root" }
- { name: PIHOLE_UID, value: "0" }
- { name: PIHOLE_GID, value: "0" }
- { name: TZ, value: "Europe/Vilnius" }
- { name: DNSMASQ_LISTENING, value: "all" }
- { name: IPv6, value: "true" }
# - { name: DNS1, value: "unbound.default.svc.cluster.local#5353" }
# - { name: DNS2, value: "no" }
# - { name: SKIP_CHOWN, value: "true" }
# - { name: FTLCONF_PRIVACYLEVEL, value: "0" }
# - { name: FTLCONF_MAXDBDAYS, value: "3650" }
volumeMounts:
- { name: vol-etc-pihole, mountPath: /etc/pihole }
- { name: vol-etc-dnsmasq, mountPath: /etc/dnsmasq.d }
resources:
requests: { cpu: 50m, memory: 256Mi }
limits: { cpu: 500m, memory: 1Gi }
volumes:
- name: vol-etc-pihole
emptyDir: {}
- name: vol-etc-dnsmasq
emptyDir: {}
```
service:
```
service-a.yml
apiVersion: v1
kind: Service
metadata:
name: pihole-a-web
namespace: default
labels:
app: pihole
instance: a
spec:
type: ClusterIP
selector:
app: pihole
instance: a
ports:
- { name: http, port: 80, targetPort: 80, protocol: TCP }
apiVersion: v1
kind: Service
metadata:
name: pihole-a-dns
namespace: default
labels:
app: pihole
instance: a
env: dns # ## @TODO: matches your Cilium LB IP pool selector
annotations:
# io.cilium/lb-ipam-ips: "10.<REDACTED_SUBNET>.160" # ## @TODO: pick an IP if you want deterministic
spec:
type: LoadBalancer
externalTrafficPolicy: Local
selector:
app: pihole
instance: a
ports:
- { name: dns-tcp, port: 53, targetPort: 53, protocol: TCP }
- { name: dns-udp, port: 53, targetPort: 53, protocol: UDP }
```
PVs
```
apiVersion: v1
kind: PersistentVolume
metadata: { name: pv-pihole-a-etc, labels: { app: pihole, instance: a, mount: etc } }
spec:
capacity: { storage: 32Gi } # ## @TODO: size
accessModes: ["ReadWriteOnce"]
storageClassName: "" # <- static PV (no dynamic SC)
persistentVolumeReclaimPolicy: Retain
mountOptions: [nfsvers=4.2, hard, noatime] # ## @TODO: tune; ok defaults
nfs:
server: 10.<REDACTED> # ## @TODO
path: /nfs/k8s/dev/pi1_etc # <- your exact path
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: pvc-pihole-a-etc, namespace: default }
spec:
accessModes: ["ReadWriteOnce"]
resources: { requests: { storage: 32Gi } }
storageClassName: ""
volumeName: pv-pihole-a-etc
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-pihole-a-dnsmasq
labels: { app: pihole, instance: a, mount: dnsmasq }
spec:
capacity: { storage: 1Gi } # ## @TODO: size
accessModes: ["ReadWriteOnce"]
storageClassName: "" # <- static PV (no dynamic SC)
persistentVolumeReclaimPolicy: Retain
mountOptions: [nfsvers=4.2, hard, noatime] # ## @TODO: tune; ok defaults
nfs:
server: 10.<REDACTED>
path: /nfs/k8s/dev/pi1_dnsmasq # <- your exact path
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: pvc-pihole-a-dnsmasq, namespace: default }
spec:
accessModes: ["ReadWriteOnce"]
resources: { requests: { storage: 1Gi } }
storageClassName: ""
volumeName: pv-pihole-a-dnsmasq
```
