Try fix how external dns gets its secret

deployments/dns/bind.yaml

@@ -1,10 +1,5 @@
 ---
 apiVersion: v1
-kind: Namespace
-metadata:
-  name: dns
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: bind-master-config

deployments/dns/externaldns.yaml

@@ -1,9 +1,4 @@
 ---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: external-dns
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -31,19 +26,19 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: external-dns
-    namespace: external-dns
+    namespace: dns
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: external-dns
-  namespace: external-dns
+  namespace: dns
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: external-dns
-  namespace: external-dns
+  namespace: dns
 spec:
   replicas: 1
   selector:
@@ -76,6 +71,6 @@ spec:
             - name: RFC2136_TSIG_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: rfc2136-tsig-secret
-                  key: tsig-secret
+                  name: dns-secrets
+                  key: externaldns-secret
 

deployments/dns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns