chore: Update manifests after change

2026-05-08 02:27:20 +00:00
parent b4ba30ae8c
commit bf6bdb0b57
80 changed files with 412 additions and 95 deletions
--- a/clusters/cl01tl/manifests/authentik/Deployment-authentik-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/authentik/Deployment-authentik-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: authentik
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: authentik
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: authentik-cloudflared-secret
  namespace: authentik
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: authentik
    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: authentik-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/authentik/ServiceAccount-authentik-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/authentik/ServiceAccount-authentik-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authentik-cloudflared
+  labels:
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: authentik
--- a/clusters/cl01tl/manifests/element-web/Deployment-element-web-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/element-web/Deployment-element-web-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: element-web
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: element-web
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/element-web/ExternalSecret-element-web-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/element-web/ExternalSecret-element-web-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: element-web-cloudflared-secret
  namespace: element-web
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: element-web
    app.kubernetes.io/part-of: element-web
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: element-web-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/element-web/ServiceAccount-element-web-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/element-web/ServiceAccount-element-web-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: element-web-cloudflared
+  labels:
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: element-web
--- a/clusters/cl01tl/manifests/foldergram/Deployment-foldergram-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/foldergram/Deployment-foldergram-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: foldergram
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: foldergram
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml
+++ b/clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: foldergram
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: foldergram
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 1000
--- a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: foldergram-cloudflared-secret
  namespace: foldergram
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: foldergram
    app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: foldergram-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: foldergram-cloudflared
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: foldergram
--- a/clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: foldergram
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: foldergram
+    helm.sh/chart: foldergram-5.0.0
+  namespace: foldergram
--- a/clusters/cl01tl/manifests/freshrss/Deployment-freshrss-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/freshrss/Deployment-freshrss-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: freshrss
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: freshrss
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml
+++ b/clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: freshrss
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: freshrss
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: freshrss-cloudflared-secret
  namespace: freshrss
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: freshrss
    app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: freshrss-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: freshrss-cloudflared
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: freshrss
--- a/clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: freshrss
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: freshrss
+    helm.sh/chart: freshrss-5.0.0
+  namespace: freshrss
--- a/clusters/cl01tl/manifests/gitea/Deployment-gitea-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/gitea/Deployment-gitea-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: gitea
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: gitea
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: gitea-cloudflared-secret
  namespace: gitea
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/part-of: gitea
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: gitea-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-cloudflared
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: gitea
--- a/clusters/cl01tl/manifests/karakeep/CronJob-karakeep-karakeep-assets-external-rclone.yaml
+++ b/clusters/cl01tl/manifests/karakeep/CronJob-karakeep-karakeep-assets-external-rclone.yaml
@@ -30,7 +30,7 @@ spec:
            app.kubernetes.io/name: karakeep-assets-external-rclone
        spec:
          enableServiceLinks: false
-          serviceAccountName: default
+          serviceAccountName: karakeep
          automountServiceAccountToken: true
          hostIPC: false
          hostNetwork: false
--- a/clusters/cl01tl/manifests/karakeep/CronJob-karakeep-karakeep-assets-rclone.yaml
+++ b/clusters/cl01tl/manifests/karakeep/CronJob-karakeep-karakeep-assets-rclone.yaml
@@ -30,7 +30,7 @@ spec:
            app.kubernetes.io/name: karakeep-assets-rclone
        spec:
          enableServiceLinks: false
-          serviceAccountName: default
+          serviceAccountName: karakeep
          automountServiceAccountToken: true
          hostIPC: false
          hostNetwork: false
--- a/clusters/cl01tl/manifests/karakeep/Deployment-karakeep-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/karakeep/Deployment-karakeep-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: karakeep
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: karakeep
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
+++ b/clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: karakeep
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: karakeep
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: karakeep-cloudflared-secret
  namespace: karakeep
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: karakeep
    app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: karakeep-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep-cloudflared
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: karakeep
--- a/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-karakeep-assets-external-rclone.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-karakeep-assets-external-rclone.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep-karakeep-assets-external-rclone
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: karakeep-assets-external-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-karakeep-assets-external-0.7.0
+  namespace: karakeep
--- a/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-karakeep-assets-rclone.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-karakeep-assets-rclone.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep-karakeep-assets-rclone
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: karakeep-assets-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-karakeep-assets-remote-0.7.0
+  namespace: karakeep
--- a/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: karakeep
+    helm.sh/chart: karakeep-5.0.0
+  namespace: karakeep
--- a/clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep.yaml
@@ -9,7 +9,7 @@ metadata:
    helm.sh/chart: karakeep-5.0.0
  namespace: karakeep
 spec:
-  jobLabel: karakeep
+  jobLabel: app.kubernetes.io/name
  namespaceSelector:
    matchNames:
      - karakeep
--- a/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-hookshot-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-hookshot-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: hookshot-cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-hookshot-2.6.0
+    helm.sh/chart: cloudflared-hookshot-2.7.1
  namespace: matrix-synapse
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: hookshot-cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: matrix-synapse
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-synapse-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-synapse-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: synapse-cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-synapse-2.6.0
+    helm.sh/chart: cloudflared-synapse-2.7.1
  namespace: matrix-synapse
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: synapse-cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: matrix-synapse
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-hookshot-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-hookshot-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: matrix-synapse-hookshot-cloudflared-secret
  namespace: matrix-synapse
  labels:
-    helm.sh/chart: cloudflared-hookshot-2.6.0
+    helm.sh/chart: cloudflared-hookshot-2.7.1
    app.kubernetes.io/instance: matrix-synapse
    app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: matrix-synapse-hookshot-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-synapse-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-synapse-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: matrix-synapse-synapse-cloudflared-secret
  namespace: matrix-synapse
  labels:
-    helm.sh/chart: cloudflared-synapse-2.6.0
+    helm.sh/chart: cloudflared-synapse-2.7.1
    app.kubernetes.io/instance: matrix-synapse
    app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: matrix-synapse-synapse-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-hookshot.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-hookshot.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: matrix-hookshot
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: matrix-hookshot
+    helm.sh/chart: matrix-hookshot-5.0.0
+  namespace: matrix-synapse
--- a/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-hookshot-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-hookshot-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: matrix-synapse-hookshot-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: hookshot-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-hookshot-2.7.1
+  namespace: matrix-synapse
--- a/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-synapse-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-synapse-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: matrix-synapse-synapse-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: synapse-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-synapse-2.7.1
+  namespace: matrix-synapse
--- a/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-mautrix-discord.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-mautrix-discord.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mautrix-discord
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: mautrix-discord
+    helm.sh/chart: mautrix-discord-5.0.0
+  namespace: matrix-synapse
--- a/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-mautrix-whatsapp.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-mautrix-whatsapp.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mautrix-whatsapp
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: mautrix-whatsapp
+    helm.sh/chart: mautrix-whatsapp-5.0.0
+  namespace: matrix-synapse
--- a/clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-hookshot.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-hookshot.yaml
@@ -9,7 +9,7 @@ metadata:
    helm.sh/chart: matrix-hookshot-5.0.0
  namespace: matrix-synapse
 spec:
-  jobLabel: matrix-hookshot
+  jobLabel: app.kubernetes.io/name
  namespaceSelector:
    matchNames:
      - matrix-synapse
--- a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-mautrix-discord.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-mautrix-discord.yaml
@@ -29,7 +29,7 @@ spec:
        app.kubernetes.io/name: mautrix-discord
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: matrix-synapse
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-mautrix-whatsapp.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-mautrix-whatsapp.yaml
@@ -29,7 +29,7 @@ spec:
        app.kubernetes.io/name: mautrix-whatsapp
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: matrix-synapse
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/outline/Deployment-outline-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/outline/Deployment-outline-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: outline
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: outline
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/outline/Deployment-outline.yaml
+++ b/clusters/cl01tl/manifests/outline/Deployment-outline.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: outline
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: outline
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 1001
--- a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: outline-cloudflared-secret
  namespace: outline
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: outline
    app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: outline-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/outline/ServiceAccount-outline-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/outline/ServiceAccount-outline-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: outline-cloudflared
+  labels:
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: outline
--- a/clusters/cl01tl/manifests/outline/ServiceAccount-outline.yaml
+++ b/clusters/cl01tl/manifests/outline/ServiceAccount-outline.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: outline
+  labels:
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: outline
+    helm.sh/chart: outline-5.0.0
+  namespace: outline
--- a/clusters/cl01tl/manifests/postiz/Deployment-postiz-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/postiz/Deployment-postiz-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: postiz
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: postiz
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/postiz/Deployment-postiz-main.yaml
+++ b/clusters/cl01tl/manifests/postiz/Deployment-postiz-main.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: postiz
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: postiz
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/postiz/Deployment-postiz-spotlight.yaml
+++ b/clusters/cl01tl/manifests/postiz/Deployment-postiz-spotlight.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: postiz
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: postiz
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: postiz-cloudflared-secret
  namespace: postiz
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/postiz/ServiceAccount-postiz-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/postiz/ServiceAccount-postiz-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postiz-cloudflared
+  labels:
+    app.kubernetes.io/instance: postiz
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: postiz
--- a/clusters/cl01tl/manifests/postiz/ServiceAccount-postiz.yaml
+++ b/clusters/cl01tl/manifests/postiz/ServiceAccount-postiz.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postiz
+  labels:
+    app.kubernetes.io/instance: postiz
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postiz
+    helm.sh/chart: postiz-5.0.0
+  namespace: postiz
--- a/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-backend.yaml
+++ b/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-backend.yaml
@@ -29,7 +29,7 @@ spec:
        app.kubernetes.io/name: rybbit
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: rybbit
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-clickhouse.yaml
+++ b/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-clickhouse.yaml
@@ -29,7 +29,7 @@ spec:
        app.kubernetes.io/name: rybbit
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: rybbit
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-client.yaml
+++ b/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-client.yaml
@@ -29,7 +29,7 @@ spec:
        app.kubernetes.io/name: rybbit
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: rybbit
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/rybbit/Deployment-rybbit-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: rybbit
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: rybbit
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/rybbit/ExternalSecret-rybbit-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ExternalSecret-rybbit-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: rybbit-cloudflared-secret
  namespace: rybbit
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: rybbit
    app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: rybbit-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/rybbit/ServiceAccount-rybbit-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ServiceAccount-rybbit-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rybbit-cloudflared
+  labels:
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: rybbit
--- a/clusters/cl01tl/manifests/rybbit/ServiceAccount-rybbit.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ServiceAccount-rybbit.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rybbit
+  labels:
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: rybbit
+    helm.sh/chart: rybbit-5.0.0
+  namespace: rybbit
--- a/clusters/cl01tl/manifests/rybbit/ServiceMonitor-rybbit.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ServiceMonitor-rybbit.yaml
@@ -9,7 +9,7 @@ metadata:
    helm.sh/chart: rybbit-5.0.0
  namespace: rybbit
 spec:
-  jobLabel: rybbit
+  jobLabel: app.kubernetes.io/name
  namespaceSelector:
    matchNames:
      - rybbit
--- a/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: site-documentation
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: site-documentation
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml
+++ b/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: site-documentation
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: site-documentation
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/site-documentation/ExternalSecret-site-documentation-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/site-documentation/ExternalSecret-site-documentation-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: site-documentation-cloudflared-secret
  namespace: site-documentation
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: site-documentation
    app.kubernetes.io/part-of: site-documentation
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: site-documentation-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/site-documentation/ServiceAccount-site-documentation-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/site-documentation/ServiceAccount-site-documentation-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-documentation-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: site-documentation
--- a/clusters/cl01tl/manifests/site-documentation/ServiceAccount-site-documentation.yaml
+++ b/clusters/cl01tl/manifests/site-documentation/ServiceAccount-site-documentation.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-documentation
+  labels:
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-documentation
+    helm.sh/chart: site-documentation-5.0.0
+  namespace: site-documentation
--- a/clusters/cl01tl/manifests/site-profile/Deployment-site-profile-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/site-profile/Deployment-site-profile-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: site-profile
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: site-profile
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml
+++ b/clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: site-profile
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: site-profile
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/site-profile/ExternalSecret-site-profile-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/site-profile/ExternalSecret-site-profile-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: site-profile-cloudflared-secret
  namespace: site-profile
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: site-profile
    app.kubernetes.io/part-of: site-profile
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: site-profile-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/site-profile/ServiceAccount-site-profile-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/site-profile/ServiceAccount-site-profile-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-profile-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: site-profile
--- a/clusters/cl01tl/manifests/site-profile/ServiceAccount-site-profile.yaml
+++ b/clusters/cl01tl/manifests/site-profile/ServiceAccount-site-profile.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-profile
+  labels:
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-profile
+    helm.sh/chart: site-profile-5.0.0
+  namespace: site-profile
--- a/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: site-saralebens
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: site-saralebens
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens.yaml
+++ b/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: site-saralebens
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: site-saralebens
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/site-saralebens/ExternalSecret-site-saralebens-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/site-saralebens/ExternalSecret-site-saralebens-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: site-saralebens-cloudflared-secret
  namespace: site-saralebens
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: site-saralebens
    app.kubernetes.io/part-of: site-saralebens
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: site-saralebens-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/site-saralebens/ServiceAccount-site-saralebens-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/site-saralebens/ServiceAccount-site-saralebens-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-saralebens-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: site-saralebens
--- a/clusters/cl01tl/manifests/site-saralebens/ServiceAccount-site-saralebens.yaml
+++ b/clusters/cl01tl/manifests/site-saralebens/ServiceAccount-site-saralebens.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-saralebens
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-saralebens
+    helm.sh/chart: site-saralebens-5.0.0
+  namespace: site-saralebens
--- a/clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden-cloudflared.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
  namespace: vaultwarden
 spec:
  revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: vaultwarden
+      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden.yaml
@@ -27,7 +27,7 @@ spec:
        app.kubernetes.io/name: vaultwarden
    spec:
      enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: vaultwarden
      automountServiceAccountToken: false
      hostIPC: false
      hostNetwork: false
--- a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-cloudflared-secret.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-cloudflared-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: vaultwarden-cloudflared-secret
  namespace: vaultwarden
  labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-2.7.1
    app.kubernetes.io/instance: vaultwarden
    app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "2.7.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: vaultwarden-cloudflared-secret
 spec:
--- a/clusters/cl01tl/manifests/vaultwarden/ServiceAccount-vaultwarden-cloudflared.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ServiceAccount-vaultwarden-cloudflared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vaultwarden-cloudflared
+  labels:
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.7.1
+  namespace: vaultwarden
--- a/clusters/cl01tl/manifests/vaultwarden/ServiceAccount-vaultwarden.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ServiceAccount-vaultwarden.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vaultwarden
+  labels:
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: vaultwarden
+    helm.sh/chart: vaultwarden-5.0.0
+  namespace: vaultwarden