chore: Update manifests after change

clusters/cl01tl/manifests/authentik/ConfigMap-authentik-valkey-init-scripts.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 data:
   init.sh: |-

clusters/cl01tl/manifests/authentik/Deployment-authentik-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: authentik
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: authentik
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: authentik-cloudflared-secret
   namespace: authentik
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: authentik
     app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: authentik-cloudflared-secret
 spec:

clusters/cl01tl/manifests/authentik/PodMonitor-authentik-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: podmonitor

clusters/cl01tl/manifests/authentik/PrometheusRule-authentik-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
 spec:

clusters/cl01tl/manifests/authentik/Service-authentik-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-cloudflared
+  labels:
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: authentik-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: authentik
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/authentik/Service-authentik-valkey-headless.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: headless
 spec:

clusters/cl01tl/manifests/authentik/Service-authentik-valkey-metrics.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: valkey

clusters/cl01tl/manifests/authentik/Service-authentik-valkey-read.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: read
 spec:

clusters/cl01tl/manifests/authentik/Service-authentik-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: primary
 spec:

clusters/cl01tl/manifests/authentik/ServiceAccount-authentik-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: authentik

clusters/cl01tl/manifests/authentik/ServiceAccount-authentik-valkey.yaml

@@ -6,6 +6,6 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 automountServiceAccountToken: false

clusters/cl01tl/manifests/authentik/ServiceMonitor-authentik-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: authentik-cloudflared
+  labels:
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: authentik
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - authentik
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/authentik/ServiceMonitor-authentik-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: service-monitor

clusters/cl01tl/manifests/authentik/StatefulSet-authentik-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 spec:
   serviceName: authentik-valkey-headless
@@ -32,7 +32,7 @@ spec:
         app.kubernetes.io/name: valkey
         app.kubernetes.io/instance: authentik
       annotations:
-        checksum/initconfig: "5891897632e2eabc8b0c61cc49fea0f6"
+        checksum/initconfig: "89a44900a681d6ea516ee7bd3b55d326"
     spec:
       automountServiceAccountToken: false
       serviceAccountName: authentik-valkey
@@ -44,7 +44,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: authentik-valkey-init
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -67,7 +67,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: authentik-valkey
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]

clusters/cl01tl/manifests/element-web/Deployment-element-web-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: element-web
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: element-web
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/element-web/ExternalSecret-element-web-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: element-web-cloudflared-secret
   namespace: element-web
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: element-web
     app.kubernetes.io/part-of: element-web
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: element-web-cloudflared-secret
 spec:

clusters/cl01tl/manifests/element-web/Service-element-web-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: element-web-cloudflared
+  labels:
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: element-web-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: element-web
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/element-web/ServiceAccount-element-web-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: element-web

clusters/cl01tl/manifests/element-web/ServiceMonitor-element-web-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: element-web-cloudflared
+  labels:
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: element-web
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - element-web
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/foldergram/Deployment-foldergram-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: foldergram
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: foldergram
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: foldergram-cloudflared-secret
   namespace: foldergram
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-cloudflared-secret
 spec:

clusters/cl01tl/manifests/foldergram/Service-foldergram-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: foldergram-cloudflared
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: foldergram-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: foldergram
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: foldergram

clusters/cl01tl/manifests/foldergram/ServiceMonitor-foldergram-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: foldergram-cloudflared
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: foldergram
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - foldergram
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/freshrss/Deployment-freshrss-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: freshrss
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: freshrss
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: freshrss-cloudflared-secret
   namespace: freshrss
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-cloudflared-secret
 spec:

clusters/cl01tl/manifests/freshrss/Service-freshrss-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: freshrss-cloudflared
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: freshrss-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: freshrss
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: freshrss

clusters/cl01tl/manifests/freshrss/ServiceMonitor-freshrss-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: freshrss-cloudflared
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: freshrss
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - freshrss
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/gitea/ConfigMap-gitea-valkey-init-scripts.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 data:
   init.sh: |-

clusters/cl01tl/manifests/gitea/ConfigMap-gitea-valkey-renovate-init-scripts.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 data:
   init.sh: |-

clusters/cl01tl/manifests/gitea/Deployment-gitea-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: gitea
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: gitea
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/gitea/Deployment-gitea-valkey-renovate.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -22,7 +22,7 @@ spec:
         app.kubernetes.io/name: valkey-renovate
         app.kubernetes.io/instance: gitea
       annotations:
-        checksum/initconfig: 94157ae544275da50867d4d0da0722fc
+        checksum/initconfig: ec5d1c08a6657961bb2582aeddf9f127
     spec:
       automountServiceAccountToken: false
       serviceAccountName: gitea-valkey-renovate
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: gitea-valkey-renovate-init
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -52,7 +52,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: gitea-valkey-renovate
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: gitea-cloudflared-secret
   namespace: gitea
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/part-of: gitea
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gitea-cloudflared-secret
 spec:

clusters/cl01tl/manifests/gitea/PersistentVolumeClaim-gitea-valkey-renovate.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 spec:
   accessModes:

clusters/cl01tl/manifests/gitea/PodMonitor-gitea-valkey-renovate.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: podmonitor

clusters/cl01tl/manifests/gitea/PodMonitor-gitea-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: podmonitor

clusters/cl01tl/manifests/gitea/PrometheusRule-gitea-valkey-renovate.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
 spec:

clusters/cl01tl/manifests/gitea/PrometheusRule-gitea-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
 spec:

clusters/cl01tl/manifests/gitea/Service-gitea-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-cloudflared
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: gitea-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: gitea
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/gitea/Service-gitea-valkey-headless.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: headless
 spec:

clusters/cl01tl/manifests/gitea/Service-gitea-valkey-metrics.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: valkey

clusters/cl01tl/manifests/gitea/Service-gitea-valkey-read.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: read
 spec:

clusters/cl01tl/manifests/gitea/Service-gitea-valkey-renovate-metrics.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: valkey

clusters/cl01tl/manifests/gitea/Service-gitea-valkey-renovate.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: primary
 spec:

clusters/cl01tl/manifests/gitea/Service-gitea-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: primary
 spec:

clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: gitea

clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-valkey-renovate.yaml

@@ -6,6 +6,6 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 automountServiceAccountToken: false

clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-valkey.yaml

@@ -6,6 +6,6 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 automountServiceAccountToken: false

clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: gitea-cloudflared
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: gitea
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - gitea
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-valkey-renovate.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-renovate
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: service-monitor

clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: service-monitor

clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 spec:
   serviceName: gitea-valkey-headless
@@ -32,7 +32,7 @@ spec:
         app.kubernetes.io/name: valkey
         app.kubernetes.io/instance: gitea
       annotations:
-        checksum/initconfig: "9bf6424ee2956d21b52e5c3831aecefa"
+        checksum/initconfig: "88e964ad8690829ad09a86ad90173244"
     spec:
       automountServiceAccountToken: false
       serviceAccountName: gitea-valkey
@@ -44,7 +44,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: gitea-valkey-init
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -67,7 +67,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: gitea-valkey
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]

clusters/cl01tl/manifests/karakeep/Deployment-karakeep-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: karakeep
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: karakeep
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: karakeep-cloudflared-secret
   namespace: karakeep
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-cloudflared-secret
 spec:

clusters/cl01tl/manifests/karakeep/Service-karakeep-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: karakeep-cloudflared
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: karakeep-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: karakeep
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: karakeep

clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: karakeep-cloudflared
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: karakeep
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - karakeep
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/matrix-synapse/ConfigMap-matrix-synapse-valkey-hookshot-init-scripts.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 data:
   init.sh: |-

clusters/cl01tl/manifests/matrix-synapse/ConfigMap-matrix-synapse-valkey-init-scripts.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 data:
   init.sh: |-

clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-hookshot-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: hookshot-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-hookshot-2.7.1
+    helm.sh/chart: cloudflared-hookshot-3.0.0
   namespace: matrix-synapse
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: hookshot-cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: matrix-synapse
+      serviceAccountName: hookshot-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-synapse-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: synapse-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-synapse-2.7.1
+    helm.sh/chart: cloudflared-synapse-3.0.0
   namespace: matrix-synapse
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: synapse-cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: matrix-synapse
+      serviceAccountName: synapse-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-hookshot-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-hookshot-cloudflared-secret
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: cloudflared-hookshot-2.7.1
+    helm.sh/chart: cloudflared-hookshot-3.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-hookshot-cloudflared-secret
 spec:

clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-synapse-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-synapse-cloudflared-secret
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: cloudflared-synapse-2.7.1
+    helm.sh/chart: cloudflared-synapse-3.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-synapse-cloudflared-secret
 spec:

clusters/cl01tl/manifests/matrix-synapse/Pod-matrix-synapse-valkey-test-auth-existing.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
   annotations:
     "helm.sh/hook": test
@@ -15,7 +15,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: test-auth
-      image: "docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
+      image: "docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193"
       command:
         - sh
         - -c

clusters/cl01tl/manifests/matrix-synapse/PodMonitor-matrix-synapse-valkey-hookshot.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: podmonitor

clusters/cl01tl/manifests/matrix-synapse/PodMonitor-matrix-synapse-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: podmonitor

clusters/cl01tl/manifests/matrix-synapse/PrometheusRule-matrix-synapse-valkey-hookshot.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
 spec:

clusters/cl01tl/manifests/matrix-synapse/PrometheusRule-matrix-synapse-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-hookshot-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-synapse-hookshot-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: hookshot-cloudflared
+    app.kubernetes.io/service: matrix-synapse-hookshot-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-hookshot-3.0.0
+  namespace: matrix-synapse
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/name: hookshot-cloudflared

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-synapse-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-synapse-synapse-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: synapse-cloudflared
+    app.kubernetes.io/service: matrix-synapse-synapse-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-synapse-3.0.0
+  namespace: matrix-synapse
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/name: synapse-cloudflared

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-headless.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: headless
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-hookshot-headless.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: headless
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-hookshot-metrics.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: valkey

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-hookshot-read.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: read
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-hookshot.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: primary
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-metrics.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: valkey

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey-read.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: read
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: primary
 spec:

clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-hookshot-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: hookshot-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-hookshot-2.7.1
+    helm.sh/chart: cloudflared-hookshot-3.0.0
   namespace: matrix-synapse

clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-synapse-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: synapse-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-synapse-2.7.1
+    helm.sh/chart: cloudflared-synapse-3.0.0
   namespace: matrix-synapse

clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-valkey-hookshot.yaml

@@ -6,6 +6,6 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 automountServiceAccountToken: false

clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-valkey.yaml

@@ -6,6 +6,6 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 automountServiceAccountToken: false

clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-synapse-hookshot-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: matrix-synapse-hookshot-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: hookshot-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-hookshot-3.0.0
+  namespace: matrix-synapse
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - matrix-synapse
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: hookshot-cloudflared
+      app.kubernetes.io/name: hookshot-cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-synapse-synapse-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: matrix-synapse-synapse-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: synapse-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-synapse-3.0.0
+  namespace: matrix-synapse
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - matrix-synapse
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: synapse-cloudflared
+      app.kubernetes.io/name: synapse-cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-synapse-valkey-hookshot.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: service-monitor

clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-synapse-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: service-monitor

clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey-hookshot.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey-hookshot
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 spec:
   serviceName: matrix-synapse-valkey-hookshot-headless
@@ -32,7 +32,7 @@ spec:
         app.kubernetes.io/name: valkey-hookshot
         app.kubernetes.io/instance: matrix-synapse
       annotations:
-        checksum/initconfig: "aae826beaee4a88b18f654c578fef5d8"
+        checksum/initconfig: "232b540234890780e685c24799102e7c"
     spec:
       automountServiceAccountToken: false
       serviceAccountName: matrix-synapse-valkey-hookshot
@@ -44,7 +44,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: matrix-synapse-valkey-hookshot-init
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -67,7 +67,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: matrix-synapse-valkey-hookshot
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]

clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: matrix-synapse
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 spec:
   serviceName: matrix-synapse-valkey-headless
@@ -32,7 +32,7 @@ spec:
         app.kubernetes.io/name: valkey
         app.kubernetes.io/instance: matrix-synapse
       annotations:
-        checksum/initconfig: "cc7e33d661e37e2f4bd1e87887270f67"
+        checksum/initconfig: "3301efde7fe4519c9f111852791c234c"
     spec:
       automountServiceAccountToken: false
       serviceAccountName: matrix-synapse-valkey
@@ -44,7 +44,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: matrix-synapse-valkey-init
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -72,7 +72,7 @@ spec:
               readOnly: true
       containers:
         - name: matrix-synapse-valkey
-          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+          image: docker.io/valkey/valkey:9.0.4@sha256:8436e10bc65c94886a91d4415b6a6dfa9cb5a306fb3b996e5bb67cd2b4854193
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]

clusters/cl01tl/manifests/outline/ConfigMap-outline-valkey-init-scripts.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
 data:
   init.sh: |-

clusters/cl01tl/manifests/outline/Deployment-outline-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
   namespace: outline
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: outline
+      serviceAccountName: cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/outline/ExternalSecret-outline-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: outline-cloudflared-secret
   namespace: outline
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-cloudflared-secret
 spec:

clusters/cl01tl/manifests/outline/PodMonitor-outline-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
     app.kubernetes.io/component: podmonitor

clusters/cl01tl/manifests/outline/PrometheusRule-outline-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: valkey
 spec:

clusters/cl01tl/manifests/outline/Service-outline-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: outline-cloudflared
+  labels:
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: outline-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.0.0
+  namespace: outline
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/outline/Service-outline-valkey-headless.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: headless
 spec:

clusters/cl01tl/manifests/outline/Service-outline-valkey-metrics.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: valkey

clusters/cl01tl/manifests/outline/Service-outline-valkey-read.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: read
 spec:

clusters/cl01tl/manifests/outline/Service-outline-valkey.yaml

@@ -6,7 +6,7 @@ metadata:
     helm.sh/chart: valkey-0.9.4
     app.kubernetes.io/name: valkey
     app.kubernetes.io/instance: outline
-    app.kubernetes.io/version: "9.0.3"
+    app.kubernetes.io/version: "9.0.4"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: primary
 spec: