Pi-hole runs as an Argo CD Application from the private overlay at clusters/<cluster>/overlays/pihole/. Config and gravity data live on claim pihole-data-lh (longhorn-ssd). The web admin password comes from a Kubernetes Secret that you write before the first sync.
Configure#
Copy the secret template into the Pi-hole overlay and generate the Secret there:
cp apps/pihole/secret.yaml.template clusters/<cluster>/overlays/pihole/secret.yaml
kubectl -n pihole create secret generic pihole-password --from-literal=WEBPASSWORD='your-strong-password' --dry-run=client -o yaml > clusters/<cluster>/overlays/pihole/secret.yamlStorage#
The Deployment mounts pihole-data-lh (public shape in homelabs/pihole/pvc.yaml) under the usual Pi-hole data paths. FTL uses SQLite with WAL, so treat any filesystem copy during a storage cutover carefully: checkpoint and integrity-check rather than a blind recursive copy. Patterns and the migrate Job example are on the Longhorn page.
Deploy#
Register the Argo CD stack, then let Argo sync Pi-hole:
kubectl apply -k argocdTo bring Pi-hole up by hand before Argo owns it (first bootstrap or recovery), apply the overlay directly. Once Argo manages the application, change Git and sync instead of applying manifests by hand:
kubectl apply -k clusters/<cluster>/overlays/piholeDeco DNS settings#
Set the primary DNS in the Deco app to the Pi-hole LoadBalancer IP:
kubectl -n pihole get svc pihole -o jsonpath="{.status.loadBalancer.ingress[0].ip}"Cloudflare tunnel access#
Add a Public Hostname on the existing Cloudflare Tunnel: subdomain pihole, your domain, type HTTP, origin the in-cluster Pi-hole Service (http://<service>.<namespace>.svc.cluster.local:<port>). If you set the origin to HTTPS on port 80, Cloudflare attempts a TLS handshake against a plain HTTP endpoint and fails. Use HTTP on port 80, or HTTPS on port 443 with No TLS Verify.
Pi-hole serves the UI under /admin, so open https://pihole.<your-domain>/admin/.