Wondering how to get started

[MattBanak]

Hey there, I've installed the chart but I can't seem to access the dashboard.

I can't help but feel the readme could get some love for people new to Helm and PiHole to get them up and running.

Regardless, this seems like a very thorough chart!

[MoJo2600]

Hey, I'm always open to extend the documentation. Sometimes I'm to deep into the topic and do not understand the issues a new comer might have :) On the other hand, this is a helm chart for kubernetes and I see a lot of people struggle with basic concepts of kubernetes. I do try to help as far as I can, but you should have a basic understanding on how to run a service on kubernetes before trying to get a helm chart running. The problem I see is, that helm is abstracting a LOT of stuff for you to make it as convenient as possible. But this tends to hide a lot of needed knowledge.

Anyways, It seems like your service is not coming up. If you do a kubectl get svc you should see the services. The issue is, that there are multiple ways to make a service accessible to the network for example with a LoadBalancer or with an Ingress Controller. This now depends on your cluster setup and how you want to do this. I'm using MetalLB in my cluster.

There was a tutorial written for this helm chart. When I do find the Url, I will post it here.

Best Christian

[MattBanak]

Hey thanks for the reply. I'm still learning but I've setup a few charts before and I'm getting through the beginning of my CKAD certification. I'm primarily using k9s to view/manage my cluster. My service is coming up, is allegedly healthy, and the logs look fine. The thing that isn't obvious about this project is what is needed to make the service accessible as you said.

I think bringing that home in the Readme and clarifying along the lines of "You will likely need a load balancer, like X, Y, or Z, or an ingress controller, like A, B, or C. Once you've decided on what to use, you will need to update the following values in values.yaml: foo, bar, and baz. This is how you will access PiHole once it's up and running."

Some other charts I've installed have allowed local access simply through NodePort, perhaps the default configuration for this chart could use that as the most basic implementation that would work "out of the box"? Just spit-balling, this chart seems perfect otherwise.

[MoJo2600]

Thank you, this is valuable input. Maybe a example on how to configure an ingress / LB would also help. I like the idea to allow local access via NodePort by default. Helm could print out on how to do this. I will have a look into this. If you want to help feel free to add a pull request.

[quotidian-ennui]

I have pihole running on a microk8s cluster using this helm chart. While it's microk8s specific this is applicable to almost any kubernetes setup. The key change here would be the ingressClassname because microk8s wants to use public instead of nginx (this actually makes some sense in that you should be able to swap out nginx for Traefik without having to change all your ingress definnitions).

Once you have installed microk8s

Enable your load balancer

microk8s enable dns helm3 ingress
microk8s enable metallb:192.168.0.90-192.168.0.100
microk8s helm3 repo add mojo2600 https://mojo2600.github.io/pihole-kubernetes/
microk8s kubectl apply -f ./metallb-nginx-ingress.yml

apiVersion: v1
kind: Service
metadata:
  name: ingress
  namespace: ingress
spec:
  selector:
    name: nginx-ingress-microk8s
  type: LoadBalancer
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
    - name: https
      protocol: TCP
      port: 443
      targetPort: 443

• At this point you should see via kubectl get service -A that the ingress controller has been assigned an external IP address of 192.168.0.90 since it's the first one...

Using the helm chart

My minimal pihole chart is this; should be suitable for a single k8s node cluster. Key changes are

• I don't have a persistent volume; this is intentional on my part (I'm still deciding on what my shared storage is going to be).
  • The side effect is slower deployment readiness because it will try to download all the adlists every time a new deployment happens.
• I've been playing around with what externalTrafficPolicy means to me, and generally learning about metallb even though i didn't ever really want to know.
• DNS_FQDN_REQUIRED and DNS_BOGUS_PRIV ticks the "never forward non-FQDN & reverse lookups" on the settings page.
• DNSMASQ_LISTENING because otherwise you reject incoming requests from out-of-cluster.

microk8s helm3 repo update 
microk8s helm3 upgrade -n tooling --install --create-namespace pihole mojo2600/pihole -f resources/pihole-helm.yml

dnsHostPort:
  # -- set this to true to enable dnsHostPort
  enabled: false

serviceDns:
  loadBalancerIP: 192.168.0.99
  annotations:
    metallb.universe.tf/allow-shared-ip: pihole-svc
  type: LoadBalancer
  # externalTrafficPolicy: Cluster
  # mixedService: true

## My router hands out IP Addresses
serviceDhcp:
  enabled: false

serviceWeb:
  http:
    enabled: true
  https:
    enabled: false
  type: ClusterIP

ingress:
  enabled: true
  ingressClassName: "public"
  hosts:
    - pi.hole

extraEnvVars:
  TZ: UTC
  DNSMASQ_LISTENING: all
  DNS_FQDN_REQUIRED: "true"
  DNS_BOGUS_PRIV: "true"

dnsmasq:
  # -- Add upstream dns servers. All lines will be added to the pihole dnsmasq configuration
  upstreamServers: []

  # -- Add custom dns entries to override the dns resolution. All lines will be added to the pihole dnsmasq configuration.
  customDnsEntries:
    - address=/pi.hole/192.168.0.90
    - address=/dns.home.local/192.168.0.99

  additionalHostsEntries:
    - 192.168.0.90     pi.hole
    - 192.168.0.99     dns
    - 192.168.0.254    router

# choose some adlists
adlists:
  - https://dbl.oisd.nl

# insert the contents of
# https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt
whitelist:
  - appleid.apple.com
  - apps.skype.com

ftl:
  # Disable the rate limit
  RATE_LIMIT: "0/0"

podDnsConfig:
  enabled: false

If everything has worked, then you should be able to point your browser at http://pi.hole/admin and get the right result.
If you're getting random 503/404 errors from nginx, then edit /etc/hosts (or the windows equivalent) and just pin pi.hole to the correct address.