helm-release.external-dns-public.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: external-dns-public
  namespace: network
spec:
  interval: 5m
  chart:
    spec:
      # renovate: registryUrl=https://charts.bitnami.com/bitnami
      chart: external-dns
      version: 5.4.13
      sourceRef:
        kind: HelmRepository
        name: bitnami-charts
        namespace: flux-system
      interval: 5m
  values:
    nameOverride: external-dns-public
    image:
      registry: k8s.gcr.io
      repository: external-dns/external-dns
      tag: v0.10.1
    logLevel: debug
    provider: aws
    aws:
      region: us-west-2
      zoneType: public
    extraEnv:
      - name: AWS_ACCESS_KEY_ID
        valueFrom:
          secretKeyRef:
            name: dns-aws-access-key
            key: access-key-id
      - name: AWS_SECRET_ACCESS_KEY
        valueFrom:
          secretKeyRef:
            name: dns-aws-access-key
            key: secret-access-key
    domainFilters:
      - ${PUBLIC_CLUSTER_DOMAIN_FILTER}
    sources:
      - crd
      - service
      - ingress
    createSecret: true
    crd:
      create: false
      # setting these enables access to these sources in the role that gets created
      apiversion: externaldns.k8s.io/v1alpha1
      kind: DNSEndpoint
    # allow ONLY when external-dns/is-public=true
    annotationFilter: "external-dns/is-public=true"
    # text prefix so txt records will go on a name with the given prefix
    # this is required because a CNAME and TXT record cannot co-exist
    txtPrefix: "k8s."
    # sync DNS records so old records get deleted
    policy: sync
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    resources:
      requests:
        memory: 64Mi
        cpu: 25m
      limits:
        memory: 128Mi