diff --git a/kustomizations/external-dns/digitalocean-provider.yaml b/kustomizations/external-dns/digitalocean-provider.yaml
new file mode 100644
index 0000000..49e3dda
--- /dev/null
+++ b/kustomizations/external-dns/digitalocean-provider.yaml
@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+spec:
+  template:
+    spec:
+      containers:
+      - name: external-dns
+        args:
+        - --source=service
+        - --source=ingress
+        - --provider=digitalocean
+        - --registry=txt
+        - --txt-owner-id=external-dns
+        - --txt-prefix=_owner.
+        - --log-level=debug
+        env:
+        - name: DO_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: digitalocean
+              key: access-token
diff --git a/kustomizations/external-dns/kustomization.yaml b/kustomizations/external-dns/kustomization.yaml
new file mode 100644
index 0000000..4d9d71c
--- /dev/null
+++ b/kustomizations/external-dns/kustomization.yaml
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: external-dns
+resources:
+- https://github.com/kubernetes-sigs/external-dns/kustomize?ref=d00387c92999e0c1530b144713a318bd1a5b6a17
+- namespace.yaml
+generators:
+- secret-generator.yaml
+patches:
+- path: digitalocean-provider.yaml
+  target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: external-dns
+images:
+- name: registry.k8s.io/external-dns/external-dns
+  newTag: v0.13.4@sha256:b1ee7b829bd4c8bc5fbae0e4671cc423304a5a4c8228dc13e2c961c1e5eb90e4
diff --git a/kustomizations/external-dns/namespace.yaml b/kustomizations/external-dns/namespace.yaml
new file mode 100644
index 0000000..d18e962
--- /dev/null
+++ b/kustomizations/external-dns/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-dns
diff --git a/kustomizations/external-dns/secret-generator.yaml b/kustomizations/external-dns/secret-generator.yaml
new file mode 100644
index 0000000..ca76abb
--- /dev/null
+++ b/kustomizations/external-dns/secret-generator.yaml
@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: ksops
+files:
+- ../digitalocean/digitalocean-config.enc.yaml