feat: migrate externaldns from Terraform to ArgoCD

- Add externaldns base ArgoCD application with namespace and Vault integration
- Create externaldns overlay for au-syd1 with Helm chart configuration
- Update platform ApplicationSet to include externaldns deployment
- Configure external-dns v1.19.0 with RFC2136 provider for DNS updates
- Maintain one-to-one migration from Terraform configuration including TSIG secrets

apps/base/externaldns/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml

apps/base/externaldns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: externaldns

apps/base/externaldns/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: externaldns
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - externaldns
+  kubernetes:
+    role: externaldns
+    serviceAccount: externaldns
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/externaldns/vaultstaticsecret.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: externaldns-tsig
+  namespace: externaldns
+spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/externaldns/tsig
+  refreshAfter: 5m
+  destination:
+    name: externaldns-tsig
+    create: true
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: externaldns