# DIVERGENCE from live state (intentional): the live deployment has WEBPASSWORD
# as a plaintext env value. Here it comes from the `pihole-admin` secret —
# create it (see secret.example.yaml) BEFORE applying this, or the pod will
# fail with CreateContainerConfigError.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pihole
  namespace: pihole
  labels:
    app: pihole
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pihole
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: pihole
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 1
              preference:
                matchExpressions:
                  - key: cpu
                    operator: In
                    values:
                      - arm
                  - key: model
                    operator: In
                    values:
                      - raspi
      containers:
        - name: pihole
          image: pihole/pihole:latest
          imagePullPolicy: IfNotPresent
          env:
            - name: TZ
              value: America/Los_Angeles
            - name: WEBPASSWORD
              valueFrom:
                secretKeyRef:
                  name: pihole-admin
                  key: WEBPASSWORD
            - name: PIHOLE_UID
              value: "0"
          ports:
            - containerPort: 53
              protocol: TCP
            - containerPort: 53
              protocol: UDP
            - containerPort: 67
              protocol: UDP
            - containerPort: 80
              protocol: TCP
            - containerPort: 443
              protocol: TCP
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: "1"
              memory: 2Gi
          securityContext:
            privileged: true
          volumeMounts:
            - name: gv-pihole
              mountPath: /etc/pihole
            - name: gv-pihole-dnsmasq-volume
              mountPath: /etc/dnsmasq.d
      volumes:
        - name: gv-pihole
          persistentVolumeClaim:
            claimName: pihole-gvolume0
        - name: gv-pihole-dnsmasq-volume
          persistentVolumeClaim:
            claimName: pihole-dnsmasq-volume