feat(k8s/pihole): fully stateless setup with ConfigMap-driven config and adlists

kubernetes/app/pihole/configmap-adlists.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pihole-adlists
+  namespace: pihole
+data:
+  adlists.txt: |
+    # Hagezi Multi Pro — ads, tracking, malware, scam, crypto
+    https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/pro.txt
+    # Hagezi Threat Intelligence Feeds — malware, C2, phishing
+    https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/tif.txt
+    # Ukrainian Security Filter — phishing/fraud targeting Ukrainian citizens
+    https://raw.githubusercontent.com/braveinnovators/ukrainian-security-filter/main/lists/domains.txt
+    # Phishing Army Extended
+    https://phishing.army/download/phishing_army_blocklist_extended.txt

kubernetes/app/pihole/configmap-pihole.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pihole-config
+  namespace: pihole
+data:
+  TZ: Europe/Kyiv
+  FTLCONF_dns_listeningMode: all
+  FTLCONF_dns_upstreams: "127.0.0.1#5353"
+  FTLCONF_misc_etc_dnsmasq_d: "true"
+  FTLCONF_dns_revServers: "true,10.127.0.0/16,10.127.1.1,lviv"
+  FTLCONF_files_database: /data/pihole-FTL.db
+  # Local DNS records (one per line: "IP HOSTNAME")
+  # Uncomment and add entries as needed:
+  # FTLCONF_dns_hosts: |
+  #   192.168.1.1 router.lan
+  #   192.168.1.2 nas.lan

kubernetes/app/pihole/deployment.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   replicas: 1
   strategy:
-    type: Recreate
+    type: RollingUpdate
   selector:
     matchLabels:
       app: pihole
@@ -17,23 +17,25 @@ spec:
       labels:
         app: pihole
     spec:
+      initContainers:
+        - name: fix-permissions
+          image: busybox:latest
+          command: ["sh", "-c", "chown 1000:1000 /data"]
+          volumeMounts:
+            - name: pihole-ftl-db
+              mountPath: /data
       containers:
         - name: pihole
-          image: pihole/pihole:2025.08.0
+          image: pihole/pihole:2026.02.0
+          envFrom:
+            - configMapRef:
+                name: pihole-config
           env:
-            - name: TZ
-              value: Europe/Kyiv
             - name: FTLCONF_webserver_api_password
               valueFrom:
                 secretKeyRef:
                   name: pihole-credentials
                   key: WEBPASSWORD
-            - name: FTLCONF_dns_listeningMode
-              value: all
-            - name: FTLCONF_dns_upstreams
-              value: "127.0.0.1#5353"
-            - name: FTLCONF_misc_etc_dnsmasq_d
-              value: "true"
           ports:
             - containerPort: 53
               protocol: TCP
@@ -44,11 +46,47 @@ spec:
             - containerPort: 80
               protocol: TCP
               name: http
+          readinessProbe:
+            exec:
+              command:
+                - dig
+                - +norecurse
+                - +retry=0
+                - +time=2
+                - healthcheck.pi.hole
+                - "@127.0.0.1"
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          lifecycle:
+            postStart:
+              exec:
+                command:
+                  - /bin/bash
+                  - -c
+                  - |
+                    (
+                      SID=""
+                      until curl -sf "http://localhost/api/lists?sid=$SID" | grep -q '"lists"'; do
+                        SID=$(curl -s -X POST http://localhost/api/auth \
+                          -d "{\"password\":\"$FTLCONF_webserver_api_password\"}" | \
+                          grep -o '"sid":"[^"]*"' | cut -d'"' -f4)
+                        sleep 5
+                      done
+                      grep -v '^#\|^$' /etc/pihole-adlists/adlists.txt | while read -r url; do
+                        curl -s -X POST "http://localhost/api/lists?type=block&sid=$SID" \
+                          -d "{\"address\":\"$url\"}" > /dev/null
+                      done
+                      curl -s -X POST "http://localhost/api/action/gravity?sid=$SID" > /dev/null
+                    ) &
           volumeMounts:
             - name: pihole-config
               mountPath: /etc/pihole
             - name: pihole-dnsmasq
               mountPath: /etc/dnsmasq.d
+            - name: pihole-adlists
+              mountPath: /etc/pihole-adlists
+            - name: pihole-ftl-db
+              mountPath: /data
 
         - name: dnscrypt-proxy
           image: klutchell/dnscrypt-proxy:latest
@@ -62,11 +100,16 @@ spec:
 
       volumes:
         - name: pihole-config
-          persistentVolumeClaim:
+          emptyDir: {}
-            claimName: pihole-config
         - name: pihole-dnsmasq
-          persistentVolumeClaim:
+          emptyDir: {}
-            claimName: pihole-dnsmasq
+        - name: pihole-ftl-db
+          hostPath:
+            path: /var/hostPath/pihole
+            type: DirectoryOrCreate
+        - name: pihole-adlists
+          configMap:
+            name: pihole-adlists
         - name: dnscrypt-config
           configMap:
             name: dnscrypt-config

kubernetes/app/pihole/namespace.yaml

@@ -2,3 +2,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: pihole
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/pihole/pv.yaml

@@ -1,35 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pihole-config
-spec:
-  capacity:
-    storage: 2Gi
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ""
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nointr
-  nfs:
-    server: synology.storage.lviv
-    path: /volume3/k8s-storage/pihole-config
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pihole-dnsmasq
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ""
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nointr
-  nfs:
-    server: synology.storage.lviv
-    path: /volume3/k8s-storage/pihole-dnsmasq

kubernetes/app/pihole/pvc.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pihole-config
-  namespace: pihole
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ""
-  volumeName: pihole-config
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pihole-dnsmasq
-  namespace: pihole
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ""
-  volumeName: pihole-dnsmasq
-  resources:
-    requests:
-      storage: 1Gi

kubernetes/app/pihole/service-dns.yaml

@@ -7,6 +7,7 @@ metadata:
     metallb.io/loadBalancerIPs: 10.127.1.200
 spec:
   type: LoadBalancer
+  externalTrafficPolicy: Local
   selector:
     app: pihole
   ports: