https://technologistcreative.hashnode.devRSS for NodeTue, 03 Dec 2024 07:07:36 GMT60https://technologistcreative.hashnode.dev/host-device-administration-on-a-kubernetes-node-with-no-ssh-accesshttps://technologistcreative.hashnode.dev/host-device-administration-on-a-kubernetes-node-with-no-ssh-accessWed, 08 May 2024 20:36:46 GMT<![CDATA[<p>Ive recently been building a Kubernetes lab environment to learn some AI and machine learning concepts on. The OS I chose was Talos Linux. Talos is an immutable OS that has no SSH access. When it came time to configure storage, I was in a bit of a pickle. After some research, I was really pleased to find that disk operations can be done through a K8s pod fairly easily. There are a few considerations, though.</p><h1 id="heading-environment">environment</h1><ul><li><p>Talos Linux 1.7.0</p></li><li><p>Kubernetes 1.29.4</p></li><li><p>kubectl installed locally</p></li></ul><h1 id="heading-make-sure-you-can-run-privileged-pods">make sure you can run privileged pods</h1><p>Since were going to be working with the host system, youll want to be able to run privileged pods.</p><h1 id="heading-storage-with-piraeus">storage with Piraeus</h1><p>I wanted to use an existing nvme disk in my labs single worker node for <a target="_blank" href="https://piraeus.io/">Piraeus</a> storage, since it seems like a really simple way to run storage in an on-premise Kubernetes environment. I followed the <a target="_blank" href="https://www.talos.dev/v1.7/kubernetes-guides/configuration/storage/#piraeus--linstor">Talos Linux documentation for configuring a storage pool</a>, but there was an issue. I already had a partition on the nvme device that I wanted to use.</p><pre><code class="lang-bash">kubectl linstor physical-storage create-device-pool --pool-name nvme_lvm_pool LVM talos-6o3-rkz /dev/nvme0n1 --storage-pool nvme_poolERROR:Description: (Node: <span class="hljs-string">'talos-6o3-rkz'</span>) Failed to pvcreate on device: /dev/nvme0n1Details: Command <span class="hljs-string">'pvcreate --config '</span>devices { filter=[<span class="hljs-string">'"'</span><span class="hljs-string">"'a|/dev/nvme0n1|'"</span><span class="hljs-string">'"'</span>,<span class="hljs-string">'"'</span><span class="hljs-string">"'r|.*|'"</span><span class="hljs-string">'"'</span>] }<span class="hljs-string">' /dev/nvme0n1'</span> returned with exitcode 5. Standard out: Error message: Cannot use /dev/nvme0n1: device is partitioned</code></pre><p>My options are limited with no SSH access to the box, and no evident way to do destructive operations on a disk with <code>talosctl</code>, Talos Linuxs CLI. I could flash a <code>gparted</code> live USB, boot my worker node with that, and easily erase the partition. However, I wanted to accomplish this through Kubernetes instead. Heres what I did:</p><h1 id="heading-introduce-a-namespace-with-privileged-annotations">introduce a namespace with privileged annotations</h1><p>The following creates a namespace resource called <code>disk-utilities</code> in your cluster where pods can run privileged.</p><pre><code class="lang-bash">cat &lt;&lt;EOF | kubectl apply --filename -apiVersion: v1kind: Namespacemetadata: name: disk-utilities labels: pod-security.kubernetes.io/enforce: privileged pod-security.kubernetes.io/audit: privileged pod-security.kubernetes.io/warn: privilegedEOF</code></pre><h1 id="heading-spin-up-a-pod-using-an-ubuntu-container">spin up a pod using an ubuntu container</h1><p>Really, you can do this with any image that contains a number of disk utilities, but I found <code>wipefs</code> really easy to use for this usecase.</p><pre><code class="lang-bash">cat &lt;&lt;EOF | kubectl apply --filename -apiVersion: v1kind: Podmetadata: name: disk-partitioner namespace: disk-utilitiesspec: containers: - name: ubuntu image: ubuntu:latest securityContext: privileged: <span class="hljs-literal">true</span> <span class="hljs-built_in">command</span>: [<span class="hljs-string">"sleep"</span>, <span class="hljs-string">"infinity"</span>] volumeMounts: - name: dev mountPath: /dev volumes: - name: dev hostPath: path: /dev nodeSelector: kubernetes.io/hostname: {{your_hostname_goes_here}}EOF</code></pre><p>Two important things to note here:</p><ul><li><p>mounting <code>/dev</code> directory from the host into the container, using a <code>volume</code> and <code>volumeMount</code>. Thats how we associate the container to the hosts devices!</p></li><li><p>make sure you select the correct host using <code>nodeSelector</code>.</p></li></ul><p>I ended up using the node label <code>kubernetes.io/hostname</code> to ensure my pod spins up on the correct host. To list out your node labels, simply:</p><pre><code class="lang-bash">kubectl get nodes --show-labels</code></pre><p>You dont have to use <code>kubernetes.io/hostname</code>, but make sure whichever label you use is <em>unique to the host</em>!</p><h1 id="heading-exec-into-the-container">exec into the container</h1><p>Next, youll exec into the container and <a target="_blank" href="https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/">launch a shell</a> <code>/bin/bash</code>.</p><pre><code class="lang-bash">kubectl <span class="hljs-built_in">exec</span> --namespace disk-utilities -it disk-partitioner -- /bin/bash</code></pre><h1 id="heading-list-block-storage-devices">list block storage devices</h1><p>Use <a target="_blank" href="https://man7.org/linux/man-pages/man8/lsblk.8.html">lsblk</a> to find the device you want to erase</p><pre><code class="lang-bash">root@disk-partitioner:/<span class="hljs-comment"># lsblk</span>Outputs list of devices</code></pre><h1 id="heading-erase-disk-signatures">erase disk signatures</h1><pre><code class="lang-bash">wipefs --all /dev/{your_device_name_from_lsblk}</code></pre><h1 id="heading-exit-container">exit container</h1><pre><code class="lang-bash"><span class="hljs-built_in">exit</span></code></pre><p>Now I can go back and provision my device pool!</p><pre><code class="lang-bash">kubectl linstor physical-storage create-device-pool --pool-name nvme_lvm_pool LVM talos-6o3-rkz /dev/nvme0n1 --storage-pool nvme_poolSUCCESS: (talos-6o3-rkz) PV <span class="hljs-keyword">for</span> device <span class="hljs-string">'/dev/nvme0n1'</span> created.SUCCESS: (talos-6o3-rkz) VG <span class="hljs-keyword">for</span> devices [/dev/nvme0n1] with name <span class="hljs-string">'nvme_lvm_pool'</span> created.SUCCESS: Successfully <span class="hljs-built_in">set</span> property key(s): StorDriver/StorPoolNameSUCCESS:Description: New storage pool <span class="hljs-string">'nvme_pool'</span> on node <span class="hljs-string">'talos-6o3-rkz'</span> registered.Details: Storage pool <span class="hljs-string">'nvme_pool'</span> on node <span class="hljs-string">'talos-6o3-rkz'</span> UUID is: 7cde04eb-b266-4a59-8711-6731162b9f76SUCCESS: (talos-6o3-rkz) Changes applied to storage pool <span class="hljs-string">'nvme_pool'</span></code></pre><p>Linstor (the underlying storage engine used by Piraeus) is happy, since it can use the newly de-partitioned device.</p><h1 id="heading-cleaning-up">cleaning up</h1><p>To clean up, simply delete the namespace that was created. This will delete the pod that was created in the namespace, preventing the namespace from being hijacked for privileged operations by a would-be attacker.</p><pre><code class="lang-bash">kubectl delete namespaces disk-utilities</code></pre>]]><![CDATA[<p>Ive recently been building a Kubernetes lab environment to learn some AI and machine learning concepts on. The OS I chose was Talos Linux. Talos is an immutable OS that has no SSH access. When it came time to configure storage, I was in a bit of a pickle. After some research, I was really pleased to find that disk operations can be done through a K8s pod fairly easily. There are a few considerations, though.</p><h1 id="heading-environment">environment</h1><ul><li><p>Talos Linux 1.7.0</p></li><li><p>Kubernetes 1.29.4</p></li><li><p>kubectl installed locally</p></li></ul><h1 id="heading-make-sure-you-can-run-privileged-pods">make sure you can run privileged pods</h1><p>Since were going to be working with the host system, youll want to be able to run privileged pods.</p><h1 id="heading-storage-with-piraeus">storage with Piraeus</h1><p>I wanted to use an existing nvme disk in my labs single worker node for <a target="_blank" href="https://piraeus.io/">Piraeus</a> storage, since it seems like a really simple way to run storage in an on-premise Kubernetes environment. I followed the <a target="_blank" href="https://www.talos.dev/v1.7/kubernetes-guides/configuration/storage/#piraeus--linstor">Talos Linux documentation for configuring a storage pool</a>, but there was an issue. I already had a partition on the nvme device that I wanted to use.</p><pre><code class="lang-bash">kubectl linstor physical-storage create-device-pool --pool-name nvme_lvm_pool LVM talos-6o3-rkz /dev/nvme0n1 --storage-pool nvme_poolERROR:Description: (Node: <span class="hljs-string">'talos-6o3-rkz'</span>) Failed to pvcreate on device: /dev/nvme0n1Details: Command <span class="hljs-string">'pvcreate --config '</span>devices { filter=[<span class="hljs-string">'"'</span><span class="hljs-string">"'a|/dev/nvme0n1|'"</span><span class="hljs-string">'"'</span>,<span class="hljs-string">'"'</span><span class="hljs-string">"'r|.*|'"</span><span class="hljs-string">'"'</span>] }<span class="hljs-string">' /dev/nvme0n1'</span> returned with exitcode 5. Standard out: Error message: Cannot use /dev/nvme0n1: device is partitioned</code></pre><p>My options are limited with no SSH access to the box, and no evident way to do destructive operations on a disk with <code>talosctl</code>, Talos Linuxs CLI. I could flash a <code>gparted</code> live USB, boot my worker node with that, and easily erase the partition. However, I wanted to accomplish this through Kubernetes instead. Heres what I did:</p><h1 id="heading-introduce-a-namespace-with-privileged-annotations">introduce a namespace with privileged annotations</h1><p>The following creates a namespace resource called <code>disk-utilities</code> in your cluster where pods can run privileged.</p><pre><code class="lang-bash">cat &lt;&lt;EOF | kubectl apply --filename -apiVersion: v1kind: Namespacemetadata: name: disk-utilities labels: pod-security.kubernetes.io/enforce: privileged pod-security.kubernetes.io/audit: privileged pod-security.kubernetes.io/warn: privilegedEOF</code></pre><h1 id="heading-spin-up-a-pod-using-an-ubuntu-container">spin up a pod using an ubuntu container</h1><p>Really, you can do this with any image that contains a number of disk utilities, but I found <code>wipefs</code> really easy to use for this usecase.</p><pre><code class="lang-bash">cat &lt;&lt;EOF | kubectl apply --filename -apiVersion: v1kind: Podmetadata: name: disk-partitioner namespace: disk-utilitiesspec: containers: - name: ubuntu image: ubuntu:latest securityContext: privileged: <span class="hljs-literal">true</span> <span class="hljs-built_in">command</span>: [<span class="hljs-string">"sleep"</span>, <span class="hljs-string">"infinity"</span>] volumeMounts: - name: dev mountPath: /dev volumes: - name: dev hostPath: path: /dev nodeSelector: kubernetes.io/hostname: {{your_hostname_goes_here}}EOF</code></pre><p>Two important things to note here:</p><ul><li><p>mounting <code>/dev</code> directory from the host into the container, using a <code>volume</code> and <code>volumeMount</code>. Thats how we associate the container to the hosts devices!</p></li><li><p>make sure you select the correct host using <code>nodeSelector</code>.</p></li></ul><p>I ended up using the node label <code>kubernetes.io/hostname</code> to ensure my pod spins up on the correct host. To list out your node labels, simply:</p><pre><code class="lang-bash">kubectl get nodes --show-labels</code></pre><p>You dont have to use <code>kubernetes.io/hostname</code>, but make sure whichever label you use is <em>unique to the host</em>!</p><h1 id="heading-exec-into-the-container">exec into the container</h1><p>Next, youll exec into the container and <a target="_blank" href="https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/">launch a shell</a> <code>/bin/bash</code>.</p><pre><code class="lang-bash">kubectl <span class="hljs-built_in">exec</span> --namespace disk-utilities -it disk-partitioner -- /bin/bash</code></pre><h1 id="heading-list-block-storage-devices">list block storage devices</h1><p>Use <a target="_blank" href="https://man7.org/linux/man-pages/man8/lsblk.8.html">lsblk</a> to find the device you want to erase</p><pre><code class="lang-bash">root@disk-partitioner:/<span class="hljs-comment"># lsblk</span>Outputs list of devices</code></pre><h1 id="heading-erase-disk-signatures">erase disk signatures</h1><pre><code class="lang-bash">wipefs --all /dev/{your_device_name_from_lsblk}</code></pre><h1 id="heading-exit-container">exit container</h1><pre><code class="lang-bash"><span class="hljs-built_in">exit</span></code></pre><p>Now I can go back and provision my device pool!</p><pre><code class="lang-bash">kubectl linstor physical-storage create-device-pool --pool-name nvme_lvm_pool LVM talos-6o3-rkz /dev/nvme0n1 --storage-pool nvme_poolSUCCESS: (talos-6o3-rkz) PV <span class="hljs-keyword">for</span> device <span class="hljs-string">'/dev/nvme0n1'</span> created.SUCCESS: (talos-6o3-rkz) VG <span class="hljs-keyword">for</span> devices [/dev/nvme0n1] with name <span class="hljs-string">'nvme_lvm_pool'</span> created.SUCCESS: Successfully <span class="hljs-built_in">set</span> property key(s): StorDriver/StorPoolNameSUCCESS:Description: New storage pool <span class="hljs-string">'nvme_pool'</span> on node <span class="hljs-string">'talos-6o3-rkz'</span> registered.Details: Storage pool <span class="hljs-string">'nvme_pool'</span> on node <span class="hljs-string">'talos-6o3-rkz'</span> UUID is: 7cde04eb-b266-4a59-8711-6731162b9f76SUCCESS: (talos-6o3-rkz) Changes applied to storage pool <span class="hljs-string">'nvme_pool'</span></code></pre><p>Linstor (the underlying storage engine used by Piraeus) is happy, since it can use the newly de-partitioned device.</p><h1 id="heading-cleaning-up">cleaning up</h1><p>To clean up, simply delete the namespace that was created. This will delete the pod that was created in the namespace, preventing the namespace from being hijacked for privileged operations by a would-be attacker.</p><pre><code class="lang-bash">kubectl delete namespaces disk-utilities</code></pre>]]>https://technologistcreative.hashnode.dev/using-pi-hole-as-your-external-dns-provider-in-kuberneteshttps://technologistcreative.hashnode.dev/using-pi-hole-as-your-external-dns-provider-in-kubernetesWed, 01 May 2024 20:30:09 GMT<![CDATA[<h1 id="heading-environment-assumptions">environment assumptions</h1><ul><li><p>A locally-running Kubernetes cluster</p></li><li><p>Pi-Hole on the network configured as the primary DNS</p></li></ul><h1 id="heading-what-is-external-dns">what is external-dns?</h1><p>When you build an <a target="_blank" href="https://kubernetes.io/docs/concepts/services-networking/ingress/">ingress</a> (which is essentially a layer-7 host and path-based load-balancer) in Kubernetes to bring web traffic to a cluster, you specify a <code>host</code> name. This creates a load-balancer entry in whatever load balancer you're using. If you're in public cloud, Kubernetes will call cloud load balancer APIs. In my home lab setup, I'm using <a target="_blank" href="https://metallb.universe.tf"><code>metallb</code></a> for this purpose. The ingress below listens for requests to <code>openweb-ui.lan</code> and sends them to the <code>http</code> service (a web UI) called <code>openweb-ui</code>.</p><pre><code class="lang-yaml"><span class="hljs-attr">apiVersion:</span> <span class="hljs-string">networking.k8s.io/v1</span><span class="hljs-attr">kind:</span> <span class="hljs-string">Ingress</span><span class="hljs-attr">metadata:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">open-webui</span> <span class="hljs-attr">namespace:</span> <span class="hljs-string">openweb-ui</span><span class="hljs-attr">spec:</span> <span class="hljs-attr">ingressClassName:</span> <span class="hljs-string">nginx</span> <span class="hljs-attr">rules:</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">host:</span> <span class="hljs-string">openweb-ui.lan</span> <span class="hljs-attr">http:</span> <span class="hljs-attr">paths:</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">backend:</span> <span class="hljs-attr">service:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">open-webui</span> <span class="hljs-attr">port:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">http</span> <span class="hljs-attr">path:</span> <span class="hljs-string">/</span> <span class="hljs-attr">pathType:</span> <span class="hljs-string">Prefixyaml</span></code></pre><p>It reaches out to <code>metallb</code> to assign an IP address from a reserved pool. The address below, <code>192.168.126.50</code> was handed out by <code>metallb</code>.</p><p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1714591746843/f279ef68-d3be-4d02-8a4e-10669c1cd0a9.png" alt class="image--center mx-auto" /></p><p>Now that that's in place, devices on my network need to know that this hostname resolves to the <code>ingress ip</code>. That's where <a target="_blank" href="https://github.com/kubernetes-sigs/external-dns"><code>external-dns</code></a> comes in. Typically, <code>external-dns</code> is leveraged to write DNS records to providers like Cloudflare, Route53, etc. However, it also supports writing DNS records to your locally-installed <code>Pi-Hole</code>!</p><h1 id="heading-what-is-pi-hole">what is pi-hole?</h1><p>It's no secret that tech workers are amongst the biggest users of ad-blocking software, and one of the major players in this space is the venerable <a target="_blank" href="https://pi-hole.net">Pi-Hole</a>.</p><p>If you don't know what Pi-Hole is, it's a piece of software originally designed to run on a <a target="_blank" href="https://www.raspberrypi.com">Raspberry Pi</a> (although it runs anywhere now, even Docker and Kubernetes) that blocks ads at the DNS level. You configure the Pi-Hole to be your DNS provider. When an app or website calls out to a domain associated with the configured <a target="_blank" href="https://github.com/topics/pihole-blocklists">block list(s)</a>, Pi-Hole simply responds that the advertising domain is unresolvable, and content from the advertising domain is not shown. All the while, the useful, good, content you were looking for is displayed!</p><p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1714590822512/15ae8897-d37a-4152-9844-0106c916b866.png" alt="image showing a list of network resources from Safari Web Inspector, showing an advertising domain not loaded." class="image--center mx-auto" /></p><p>Notice in the above image that <code>analytics.js</code> from <code>google-analytics.com</code> isn't loading, thanks to Pi-Hole!</p><p>However, the feature of Pi-Hole I'll be discussing in this article is <code>Local DNS</code>. We'll be using it to map a DNS record to the ingress IP on a homelab Kubernetes cluster.</p><p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1714592083142/e105a185-3b4b-4ad4-930b-2cc071425672.png" alt class="image--center mx-auto" /></p><h1 id="heading-installing-external-dns">installing external-dns</h1><p>The Helm chart is the best way to install external-dns.</p><h2 id="heading-required-information">required information</h2><p>Collect the following:</p><ul><li><p>The IP address of your <code>Pi-Hole</code> instance (referenced as <code>piholeipaddress</code>)</p></li><li><p>The <code>admin</code> credentials for your <code>Pi-Hole</code> instance (referenced as <code>piholeadminpassword</code>)</p></li></ul><h2 id="heading-add-and-update-repo">add and update repo</h2><pre><code class="lang-bash">helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/helm update/</code></pre><h1 id="heading-create-a-secret-for-pi-hole">create a secret for pi-hole</h1><p>In this step, we'll create a Kubernetes <code>Secret</code> for authenticating to the <code>Pi-Hole</code>.</p><pre><code class="lang-bash">kubectl create secret generic pihole-password \--namespace external-dns \--from-literal EXTERNAL_DNS_PIHOLE_PASSWORD={{piholeadminpassword}}</code></pre><h2 id="heading-create-valuesyaml">create values.yaml</h2><p>Next, create a <code>values.yaml</code> to pass configuration values to the Helm chart.</p><pre><code class="lang-yaml"><span class="hljs-comment"># https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#values</span><span class="hljs-attr">provider:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">pihole</span><span class="hljs-comment"># https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/pihole.md#arguments</span><span class="hljs-attr">env:</span> <span class="hljs-comment"># configured your pi-hole password and ip address</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">name:</span> <span class="hljs-string">EXTERNAL_DNS_PIHOLE_PASSWORD</span> <span class="hljs-attr">valueFrom:</span> <span class="hljs-attr">secretKeyRef:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">pihole-password</span> <span class="hljs-attr">key:</span> <span class="hljs-string">EXTERNAL_DNS_PIHOLE_PASSWORD</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">name:</span> <span class="hljs-string">EXTERNAL_DNS_PIHOLE_SERVER</span> <span class="hljs-comment"># make sure NOT to put a trailing slash, as external-dns adds its own</span> <span class="hljs-attr">value:</span> <span class="hljs-string">http://{{piholeipaddress}}</span></code></pre><h2 id="heading-install">install</h2><pre><code class="lang-bash">helm upgrade --install external-dns external-dns/external-dns \--namespace external-dns \--create-namespace \--values values.yaml</code></pre><h2 id="heading-make-sure-its-working">make sure it's working</h2><p>If you check the deployment logs for <code>external-dns</code> , you'll see that <code>external-dns</code> has been hard at work creating a DNS record for your <code>ingress</code>.</p><pre><code class="lang-bash">kubectl logs --namespace external-dns deployments/external-dns external-dns</code></pre><pre><code class="lang-bash">time=<span class="hljs-string">"2024-05-01T20:14:10Z"</span> level=info msg=<span class="hljs-string">"add openweb-ui.lan IN A -&gt; 192.168.126.50"</span>time=<span class="hljs-string">"2024-05-01T20:14:10Z"</span> level=warning msg=<span class="hljs-string">"Skipping unsupported endpoint openweb-ui.lan TXT \"heritage=external-dns,external-dns/owner=default,external-dns/resource=ingress/openweb-ui/open-webui\""</span>time=<span class="hljs-string">"2024-05-01T20:14:10Z"</span> level=warning msg=<span class="hljs-string">"Skipping unsupported endpoint a-openweb-ui.lan TXT \"heritage=external-dns,external-dns/owner=default,external-dns/resource=ingress/openweb-ui/open-webui\""</span>time=<span class="hljs-string">"2024-05-01T20:15:10Z"</span> level=info msg=<span class="hljs-string">"All records are already up to date"</span></code></pre><p>That's it!</p><p>If you have trouble, again make sure you take out any trailing slashes on the <code>EXTERNAL_DNS_PIHOLE_SERVER</code> environment variable. And also make sure the IP is correct! Don't ask me how I spent like 20 minutes wondering why <code>external-dns</code> wouldn't connect.</p>]]><![CDATA[<h1 id="heading-environment-assumptions">environment assumptions</h1><ul><li><p>A locally-running Kubernetes cluster</p></li><li><p>Pi-Hole on the network configured as the primary DNS</p></li></ul><h1 id="heading-what-is-external-dns">what is external-dns?</h1><p>When you build an <a target="_blank" href="https://kubernetes.io/docs/concepts/services-networking/ingress/">ingress</a> (which is essentially a layer-7 host and path-based load-balancer) in Kubernetes to bring web traffic to a cluster, you specify a <code>host</code> name. This creates a load-balancer entry in whatever load balancer you're using. If you're in public cloud, Kubernetes will call cloud load balancer APIs. In my home lab setup, I'm using <a target="_blank" href="https://metallb.universe.tf"><code>metallb</code></a> for this purpose. The ingress below listens for requests to <code>openweb-ui.lan</code> and sends them to the <code>http</code> service (a web UI) called <code>openweb-ui</code>.</p><pre><code class="lang-yaml"><span class="hljs-attr">apiVersion:</span> <span class="hljs-string">networking.k8s.io/v1</span><span class="hljs-attr">kind:</span> <span class="hljs-string">Ingress</span><span class="hljs-attr">metadata:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">open-webui</span> <span class="hljs-attr">namespace:</span> <span class="hljs-string">openweb-ui</span><span class="hljs-attr">spec:</span> <span class="hljs-attr">ingressClassName:</span> <span class="hljs-string">nginx</span> <span class="hljs-attr">rules:</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">host:</span> <span class="hljs-string">openweb-ui.lan</span> <span class="hljs-attr">http:</span> <span class="hljs-attr">paths:</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">backend:</span> <span class="hljs-attr">service:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">open-webui</span> <span class="hljs-attr">port:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">http</span> <span class="hljs-attr">path:</span> <span class="hljs-string">/</span> <span class="hljs-attr">pathType:</span> <span class="hljs-string">Prefixyaml</span></code></pre><p>It reaches out to <code>metallb</code> to assign an IP address from a reserved pool. The address below, <code>192.168.126.50</code> was handed out by <code>metallb</code>.</p><p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1714591746843/f279ef68-d3be-4d02-8a4e-10669c1cd0a9.png" alt class="image--center mx-auto" /></p><p>Now that that's in place, devices on my network need to know that this hostname resolves to the <code>ingress ip</code>. That's where <a target="_blank" href="https://github.com/kubernetes-sigs/external-dns"><code>external-dns</code></a> comes in. Typically, <code>external-dns</code> is leveraged to write DNS records to providers like Cloudflare, Route53, etc. However, it also supports writing DNS records to your locally-installed <code>Pi-Hole</code>!</p><h1 id="heading-what-is-pi-hole">what is pi-hole?</h1><p>It's no secret that tech workers are amongst the biggest users of ad-blocking software, and one of the major players in this space is the venerable <a target="_blank" href="https://pi-hole.net">Pi-Hole</a>.</p><p>If you don't know what Pi-Hole is, it's a piece of software originally designed to run on a <a target="_blank" href="https://www.raspberrypi.com">Raspberry Pi</a> (although it runs anywhere now, even Docker and Kubernetes) that blocks ads at the DNS level. You configure the Pi-Hole to be your DNS provider. When an app or website calls out to a domain associated with the configured <a target="_blank" href="https://github.com/topics/pihole-blocklists">block list(s)</a>, Pi-Hole simply responds that the advertising domain is unresolvable, and content from the advertising domain is not shown. All the while, the useful, good, content you were looking for is displayed!</p><p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1714590822512/15ae8897-d37a-4152-9844-0106c916b866.png" alt="image showing a list of network resources from Safari Web Inspector, showing an advertising domain not loaded." class="image--center mx-auto" /></p><p>Notice in the above image that <code>analytics.js</code> from <code>google-analytics.com</code> isn't loading, thanks to Pi-Hole!</p><p>However, the feature of Pi-Hole I'll be discussing in this article is <code>Local DNS</code>. We'll be using it to map a DNS record to the ingress IP on a homelab Kubernetes cluster.</p><p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1714592083142/e105a185-3b4b-4ad4-930b-2cc071425672.png" alt class="image--center mx-auto" /></p><h1 id="heading-installing-external-dns">installing external-dns</h1><p>The Helm chart is the best way to install external-dns.</p><h2 id="heading-required-information">required information</h2><p>Collect the following:</p><ul><li><p>The IP address of your <code>Pi-Hole</code> instance (referenced as <code>piholeipaddress</code>)</p></li><li><p>The <code>admin</code> credentials for your <code>Pi-Hole</code> instance (referenced as <code>piholeadminpassword</code>)</p></li></ul><h2 id="heading-add-and-update-repo">add and update repo</h2><pre><code class="lang-bash">helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/helm update/</code></pre><h1 id="heading-create-a-secret-for-pi-hole">create a secret for pi-hole</h1><p>In this step, we'll create a Kubernetes <code>Secret</code> for authenticating to the <code>Pi-Hole</code>.</p><pre><code class="lang-bash">kubectl create secret generic pihole-password \--namespace external-dns \--from-literal EXTERNAL_DNS_PIHOLE_PASSWORD={{piholeadminpassword}}</code></pre><h2 id="heading-create-valuesyaml">create values.yaml</h2><p>Next, create a <code>values.yaml</code> to pass configuration values to the Helm chart.</p><pre><code class="lang-yaml"><span class="hljs-comment"># https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#values</span><span class="hljs-attr">provider:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">pihole</span><span class="hljs-comment"># https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/pihole.md#arguments</span><span class="hljs-attr">env:</span> <span class="hljs-comment"># configured your pi-hole password and ip address</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">name:</span> <span class="hljs-string">EXTERNAL_DNS_PIHOLE_PASSWORD</span> <span class="hljs-attr">valueFrom:</span> <span class="hljs-attr">secretKeyRef:</span> <span class="hljs-attr">name:</span> <span class="hljs-string">pihole-password</span> <span class="hljs-attr">key:</span> <span class="hljs-string">EXTERNAL_DNS_PIHOLE_PASSWORD</span> <span class="hljs-bullet">-</span> <span class="hljs-attr">name:</span> <span class="hljs-string">EXTERNAL_DNS_PIHOLE_SERVER</span> <span class="hljs-comment"># make sure NOT to put a trailing slash, as external-dns adds its own</span> <span class="hljs-attr">value:</span> <span class="hljs-string">http://{{piholeipaddress}}</span></code></pre><h2 id="heading-install">install</h2><pre><code class="lang-bash">helm upgrade --install external-dns external-dns/external-dns \--namespace external-dns \--create-namespace \--values values.yaml</code></pre><h2 id="heading-make-sure-its-working">make sure it's working</h2><p>If you check the deployment logs for <code>external-dns</code> , you'll see that <code>external-dns</code> has been hard at work creating a DNS record for your <code>ingress</code>.</p><pre><code class="lang-bash">kubectl logs --namespace external-dns deployments/external-dns external-dns</code></pre><pre><code class="lang-bash">time=<span class="hljs-string">"2024-05-01T20:14:10Z"</span> level=info msg=<span class="hljs-string">"add openweb-ui.lan IN A -&gt; 192.168.126.50"</span>time=<span class="hljs-string">"2024-05-01T20:14:10Z"</span> level=warning msg=<span class="hljs-string">"Skipping unsupported endpoint openweb-ui.lan TXT \"heritage=external-dns,external-dns/owner=default,external-dns/resource=ingress/openweb-ui/open-webui\""</span>time=<span class="hljs-string">"2024-05-01T20:14:10Z"</span> level=warning msg=<span class="hljs-string">"Skipping unsupported endpoint a-openweb-ui.lan TXT \"heritage=external-dns,external-dns/owner=default,external-dns/resource=ingress/openweb-ui/open-webui\""</span>time=<span class="hljs-string">"2024-05-01T20:15:10Z"</span> level=info msg=<span class="hljs-string">"All records are already up to date"</span></code></pre><p>That's it!</p><p>If you have trouble, again make sure you take out any trailing slashes on the <code>EXTERNAL_DNS_PIHOLE_SERVER</code> environment variable. And also make sure the IP is correct! Don't ask me how I spent like 20 minutes wondering why <code>external-dns</code> wouldn't connect.</p>]]>https://cdn.hashnode.com/res/hashnode/image/upload/v1714595272003/13ad7284-23a3-4d4f-a3ac-09f77482b524.png