base.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: external-dns
  namespace: dns
spec:
  chart:
    spec:
      chart: external-dns
      sourceRef:
        kind: HelmRepository
        name: bitnami
        namespace: flux-system
      version: 4.0.0
  interval: 5m
  releaseName: external-dns
  targetNamespace: dns
  values:
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        selector:
          release: kube-prometheus-stack

chart-values.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: external-dns
  namespace: dns
spec:
  values:
    provider: cloudflare
    domainFilters:
      - xxxxxxxx
    zoneIdFilters:
      - xxxxxxxxxxxx
    resources:
      limits:
        cpu: 50m
        memory: 100Mi
      requests:
        memory: 50Mi
        cpu: 10m
    serviceAccount:
      name: external-dns
      annotations:
        iam.gke.io/gcp-service-account: portefaix-prod-external-dns@portefaix-prod.iam.gserviceaccount.com
  valuesFrom:
    # - kind: ConfigMap
    #   name: prod-env-values
    - kind: Secret
      name: external-dns

kustomization.yaml

---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../../base/dns/external-dns
- ./secret.yaml
patchesStrategicMerge:
- chart-values.yaml

secret.yaml

apiVersion: v1
data:
    values.yaml: ENC[AES256_GCM,data:QcB2uJBODc+PxmVLjppCP5M711YC3O5ptYCO2uZRGoYUlhPNkj+Zm1GcRAUhfkWuFN2iLct7ELG+MbbpIeiApD0Jxbvu5wTFnBOkmB/CGg4Ni/5WeDuZig==,iv:1/sfo8hnDYUEnXYj77tSiimyakor0ARR8ChymhsM1nQ=,tag:06g3crNu0+/TQY6ntzQCnw==,type:str]
kind: Secret
metadata:
    creationTimestamp: null
    name: external-dns
    namespace: dns
sops:
    kms: []
    gcp_kms:
    -   resource_id: projects/portefaix-prod/locations/europe-west1/keyRings/portefaix-prod-sops/cryptoKeys/portefaix-prod-sops
        created_at: '2020-12-05T10:06:08Z'
        enc: CiQAq0sbA4xcpLleU7xv98+3ONu5qwGcDhyNzOuqDAmgLbxsKUQSSQBgH1U0aII5qmnToqRzUSBy0waVmHZa/iMbGUQkws+w4RDEFdgXk46o2ZoFOCZjMMXPJM+dmFHbEne9/jyYPaVbAfsjxRviKPc=
    azure_kv: []
    hc_vault: []
    lastmodified: '2020-12-05T10:06:08Z'
    mac: ENC[AES256_GCM,data:tB/b9H4Mm5RDNXD6FYzROMnN+TRJ9UA6U7iRgJlSKCYi63XWA9XLQU3D1spUOi5L9IoJ1EvayOw1oslsgemKASNTdJbwM9RhZQV4q3ltiSMnKfVpBfQeGXc4BgtPe7SSlTkT7pWtP1sIe+RPDkLWSGpW6KenrIk7loxDM8R6kxY=,iv:XOXdTS902/dsx92vMJC+jxSeyZ7hE2Cce9MeEOpv2iM=,tag:twSH95URzZI2V0zPRRwy8A==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)
    version: 3.6.1