new pi-hole server v6 results in 404 error

[xorinzor]

What happened: external-dns started reporting a 404 error.

time="2025-02-21T11:11:49Z" level=debug msg="Fetching new token from https://<pi-hole-server-address>/admin/index.php?login"
time="2025-02-21T11:11:49Z" level=fatal msg="received non-200 status code from request: 404 Not Found"

What you expected to happen:
A non-error

How to reproduce it (as minimally and precisely as possible):
Use pi-hole docker image 2025.02.0 or higher

Anything else we need to know?:
Started happening since (I think) my pi-hole server got updated to docker tag 2025.02.0. Which now is based on the new pi-hole server v6.

It appears that pi-hole now uses the endpoint /api/auth for authentication instead: https://docs.pi-hole.net/api/auth/

Environment:

• External-DNS version (use external-dns --version): helm chart 1.15.2 reports image registry.k8s.io/external-dns/external-dns:v0.15.1
• DNS provider: pi-hole
• Others: pi-hole docker image 2025.02.3

[ivankatliarchuk]

Hi.

We recently had quite few pi-hole related issues. This is open-source project If you have time would you mind update a dev guide how to configure lab with external-dns and pi-hole? I think the actual how to install pi-hole is missing.

#5044 (comment)

[ivankatliarchuk]

/help

[k8s-ci-robot]

@ivankatliarchuk:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[thebigbone]

are there any current workarounds to it?

[xorinzor]

@thebigbone sticking with pi-hole v5 until external-dns is updated to work with pi-hole v6.

[ivankatliarchuk]

It's an open source project. So someone could submit a pull request. My understanding it should support old and new pi-hole versions at least for a while.

[thebigbone]

It's an open source project. So someone could submit a pull request. My understanding it should support old and new pi-hole versions at least for a while.

you're right. I am no expert in k8s but I will still look into it and hopefully atleast figure out what's wrong.

[masterkain]

well what's wrong is that pihole 6 changed api endpoints so we need to update the integration https://github.com/kubernetes-sigs/external-dns/blob/master/provider/pihole/client.go#L278
I have some busy weeks ahead but I might try updating some stuff

[aztechian]

Just adding some info here to save others some research time:
https://discourse.pi-hole.net/t/scope-of-the-v6-api-includes-dns-cname-crud/73373/8

It's unfortunately more than just the auth part. The old PHP scripts that were getting called are (likely) no longer available either. There is now a REST API, but it's a significant rework of the current pihole provider.

For any maintainers, I'm curious how you might tackle this:

1. wrap determining version in the current pihole provider and it supports both v5 and v6
2. create a new v6 provider and users need to choose it if they run pihole v6

I can confirm that testing CURL commands on my v6 install (I naively upgraded recently 😢) did work for adding/deleting A records with something like:

GET current list

curl -H "X-FTL-SID: xxxxxxxxxxx" http://pi.hole/api/config/dns/hosts | jq

Add A record

curl -H "X-FTL-SID: xxxxxxxxxxx" -X PUT http://pi.hole/api/config/dns/hosts/192.168.254.0%20testing.example.com

Delete A Record

curl -H "X-FTL-SID: xxxxxxxxxxx" -X DELETE http://pi.hole/api/config/dns/hosts/192.168.254.0%20testing.example.com

Note

Note, that it needs the full IP address + hostname combination for DELETE. In other words

curl -H "X-FTL-SID: xxxxxxxxxxx" -X DELETE http://pi.hole/api/config/dns/hosts/testing.example.com

won't work.

On the plus side, the REST+JSON api lends itself nicely to go's structs and parsing, so that would be cleaner in v6. And, the API docs are self-hosted by the pihole at http://pi.hole/api/docs

[tJouve]

Hello, I can start working on this one

WIP => https://github.com/tJouve/external-dns/tree/feat/piholev6

[ivankatliarchuk]

There is no specific endpiont to find out the pi-hole version if aunautrhosed. One could do

First probe to validate where or not auth is required and is v6

GET /api/auth/

If not found, it's an older version. Do

/admin/index.php?login

[ivankatliarchuk]

Probably no point to support V5 and V6, as V5 is supported on older versions of external-dns

[tJouve]

@ivankatliarchuk so you think i can drop support for the previous version ? My plan was to add a config to specify the api version, with default 5. If 6 is specified I use the V6 client.

[ivankatliarchuk]

Is quite expensive to support both versions aka bee backward compatible. Having a flag for that, sounds reasonable as well. There is another option to create a pi-hole webhook but not sure if someone would trust that provider in home network.

I let you to decide.

[xorinzor]

Using a configurable flag for now seems like the better option IMO. Things might change at the kubernetes side whereas v5 will stay working the same way, in which case users would be forced to upgrade.

You could mark v5 as deprecated and remove it in a later version of external-dns, but for now the better path is probably to use a configurable api version, defaulting to v5.

[divStar]

Is there something I can do to actively help you @tJouve ? I have a bit of spare time and I am a bit familiar with Go (though by no means a lot). I am also in the process of setting up my homelab cluster and would love for it to communicate with my PiHole, which turned out to be V6.

If there's something I can do (review, implement something, test), let me know.

[tJouve]

@divStar Sure, I can add you on my fork.
Task list :

• Unit test
• Review
• Finish implementation
• Refactoring
• Integration testing
• Documentation

[divStar]

Sorry, the invitation didn't seem to go through:

I started working on it though so no hurry. If for whatever reason the invitation does not work, I can open a pull request your way anyway if need be (though it'd require more Git juggling).