homelab-k3s/apps/pihole/deployment-pihole.yaml

# Pi-hole v6 (image pinned by digest = Core v6.2.2 — :latest bit us on
# 2026-07-26 when a fresh node pull silently jumped v5→v6).
# v6 notes:
#  - FTLCONF_dns_listeningMode=ALL is REQUIRED in k8s: the v6 default (LOCAL)
#    only answers queries from directly-attached subnets, which silently drops
#    all cross-node svclb traffic.
#  - v6 ignores the old WEBPASSWORD env; the admin password is
#    FTLCONF_webserver_api_password, fed from the `pihole-admin` secret —
#    create it (see secret.example.yaml) BEFORE applying.
#  - Readiness probe on :53 so rollouts wait for FTL to actually serve DNS.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pihole
  namespace: pihole
  labels:
    app: pihole
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pihole
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: pihole
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 1
              preference:
                matchExpressions:
                  - key: cpu
                    operator: In
                    values:
                      - arm
                  - key: model
                    operator: In
                    values:
                      - raspi
      containers:
        - name: pihole
          image: pihole/pihole@sha256:e28e239f55e648a9d32c8f065650acfe987ddebf1cd5f64f1c071e8716156ceb # Core v6.2.2
          imagePullPolicy: IfNotPresent
          env:
            - name: TZ
              value: America/Los_Angeles
            - name: FTLCONF_dns_listeningMode
              value: ALL
            - name: FTLCONF_webserver_api_password
              valueFrom:
                secretKeyRef:
                  name: pihole-admin
                  key: WEBPASSWORD
            - name: PIHOLE_UID
              value: "0"
          ports:
            - containerPort: 53
              protocol: TCP
            - containerPort: 53
              protocol: UDP
            - containerPort: 67
              protocol: UDP
            - containerPort: 80
              protocol: TCP
            - containerPort: 443
              protocol: TCP
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: "1"
              memory: 2Gi
          securityContext:
            privileged: true
          readinessProbe:
            tcpSocket:
              port: 53
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 3
          volumeMounts:
            - name: gv-pihole
              mountPath: /etc/pihole
            - name: gv-pihole-dnsmasq-volume
              mountPath: /etc/dnsmasq.d
      volumes:
        - name: gv-pihole
          persistentVolumeClaim:
            claimName: pihole-gvolume0
        - name: gv-pihole-dnsmasq-volume
          persistentVolumeClaim:
            claimName: pihole-dnsmasq-volume