clusters/cl01tl/manifests/authentik/Deployment-authentik-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: authentik
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: authentik
+      serviceAccountName: authentik-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: authentik-cloudflared-secret
   namespace: authentik
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: authentik
     app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: authentik-cloudflared-secret
 spec:

clusters/cl01tl/manifests/authentik/Service-authentik-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-cloudflared
+  labels:
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: authentik-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: authentik
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/authentik/ServiceAccount-authentik-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: authentik

clusters/cl01tl/manifests/authentik/ServiceMonitor-authentik-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: authentik-cloudflared
+  labels:
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: authentik
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - authentik
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/element-web/Deployment-element-web-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: element-web
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: element-web-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/element-web/ExternalSecret-element-web-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: element-web-cloudflared-secret
   namespace: element-web
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: element-web
     app.kubernetes.io/part-of: element-web
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: element-web-cloudflared-secret
 spec:

clusters/cl01tl/manifests/element-web/Service-element-web-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: element-web-cloudflared
+  labels:
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: element-web-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: element-web
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/element-web/ServiceAccount-element-web-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: element-web-cloudflared
+  labels:
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: element-web

clusters/cl01tl/manifests/element-web/ServiceMonitor-element-web-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: element-web-cloudflared
+  labels:
+    app.kubernetes.io/instance: element-web
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: element-web
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - element-web
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/eraser/Namespace-eraser.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eraser
+  labels:
+    app.kubernetes.io/name: eraser
+    app.kubernetes.io/instance: eraser
+    app.kubernetes.io/part-of: eraser
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/manifests/foldergram/Deployment-foldergram-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: foldergram
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: foldergram-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: foldergram
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: foldergram
       automountServiceAccountToken: false
       securityContext:
         fsGroup: 1000

clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: foldergram-cloudflared-secret
   namespace: foldergram
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-cloudflared-secret
 spec:

clusters/cl01tl/manifests/foldergram/Service-foldergram-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: foldergram-cloudflared
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: foldergram-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: foldergram
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: foldergram-cloudflared
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: foldergram

clusters/cl01tl/manifests/foldergram/ServiceAccount-foldergram.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: foldergram
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: foldergram
+    helm.sh/chart: foldergram-5.0.0
+  namespace: foldergram

clusters/cl01tl/manifests/foldergram/ServiceMonitor-foldergram-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: foldergram-cloudflared
+  labels:
+    app.kubernetes.io/instance: foldergram
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: foldergram
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - foldergram
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/freshrss/Deployment-freshrss-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: freshrss
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: freshrss-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: freshrss
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: freshrss
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: freshrss-cloudflared-secret
   namespace: freshrss
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-cloudflared-secret
 spec:

clusters/cl01tl/manifests/freshrss/Service-freshrss-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: freshrss-cloudflared
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: freshrss-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: freshrss
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: freshrss-cloudflared
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: freshrss

clusters/cl01tl/manifests/freshrss/ServiceAccount-freshrss.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: freshrss
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: freshrss
+    helm.sh/chart: freshrss-5.0.0
+  namespace: freshrss

clusters/cl01tl/manifests/freshrss/ServiceMonitor-freshrss-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: freshrss-cloudflared
+  labels:
+    app.kubernetes.io/instance: freshrss
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: freshrss
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - freshrss
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/gitea/Deployment-gitea-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: gitea
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: gitea
+      serviceAccountName: gitea-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: gitea-cloudflared-secret
   namespace: gitea
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/part-of: gitea
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gitea-cloudflared-secret
 spec:

clusters/cl01tl/manifests/gitea/Service-gitea-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-cloudflared
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: gitea-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: gitea
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: gitea

clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: gitea-cloudflared
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: gitea
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - gitea
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/karakeep/CronJob-karakeep-karakeep-assets-external-rclone.yaml

@@ -30,7 +30,7 @@ spec:
             app.kubernetes.io/name: karakeep-assets-external-rclone
         spec:
           enableServiceLinks: false
-          serviceAccountName: default
+          serviceAccountName: karakeep
           automountServiceAccountToken: true
           hostIPC: false
           hostNetwork: false

clusters/cl01tl/manifests/karakeep/CronJob-karakeep-karakeep-assets-rclone.yaml

@@ -30,7 +30,7 @@ spec:
             app.kubernetes.io/name: karakeep-assets-rclone
         spec:
           enableServiceLinks: false
-          serviceAccountName: default
+          serviceAccountName: karakeep
           automountServiceAccountToken: true
           hostIPC: false
           hostNetwork: false

clusters/cl01tl/manifests/karakeep/Deployment-karakeep-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: karakeep
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: karakeep-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: karakeep
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: karakeep
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: karakeep-cloudflared-secret
   namespace: karakeep
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-cloudflared-secret
 spec:

clusters/cl01tl/manifests/karakeep/Service-karakeep-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: karakeep-cloudflared
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: karakeep-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: karakeep
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep-cloudflared
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: karakeep

clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-karakeep-assets-external-rclone.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep-karakeep-assets-external-rclone
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: karakeep-assets-external-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-karakeep-assets-external-0.7.0
+  namespace: karakeep

clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-karakeep-assets-rclone.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep-karakeep-assets-rclone
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: karakeep-assets-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-karakeep-assets-remote-0.7.0
+  namespace: karakeep

clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: karakeep
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: karakeep
+    helm.sh/chart: karakeep-5.0.0
+  namespace: karakeep

clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: karakeep-cloudflared
+  labels:
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: karakeep
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - karakeep
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep.yaml

@@ -9,7 +9,7 @@ metadata:
     helm.sh/chart: karakeep-5.0.0
   namespace: karakeep
 spec:
-  jobLabel: karakeep
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - karakeep

clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-hookshot-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: hookshot-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-hookshot-2.7.1
+    helm.sh/chart: cloudflared-hookshot-3.2.0
   namespace: matrix-synapse
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: hookshot-cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: matrix-synapse
+      serviceAccountName: matrix-synapse-hookshot-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse-synapse-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: synapse-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-synapse-2.7.1
+    helm.sh/chart: cloudflared-synapse-3.2.0
   namespace: matrix-synapse
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: synapse-cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: matrix-synapse
+      serviceAccountName: matrix-synapse-synapse-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-hookshot-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-hookshot-cloudflared-secret
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: cloudflared-hookshot-2.7.1
+    helm.sh/chart: cloudflared-hookshot-3.2.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-hookshot-cloudflared-secret
 spec:

clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-synapse-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-synapse-cloudflared-secret
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: cloudflared-synapse-2.7.1
+    helm.sh/chart: cloudflared-synapse-3.2.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-synapse-cloudflared-secret
 spec:

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-hookshot-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-synapse-hookshot-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: hookshot-cloudflared
+    app.kubernetes.io/service: matrix-synapse-hookshot-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-hookshot-3.2.0
+  namespace: matrix-synapse
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/name: hookshot-cloudflared

clusters/cl01tl/manifests/matrix-synapse/Service-matrix-synapse-synapse-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-synapse-synapse-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: synapse-cloudflared
+    app.kubernetes.io/service: matrix-synapse-synapse-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-synapse-3.2.0
+  namespace: matrix-synapse
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/name: synapse-cloudflared

clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-hookshot-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: hookshot-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-hookshot-2.7.1
+    helm.sh/chart: cloudflared-hookshot-3.2.0
   namespace: matrix-synapse

clusters/cl01tl/manifests/matrix-synapse/ServiceAccount-matrix-synapse-synapse-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: synapse-cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-synapse-2.7.1
+    helm.sh/chart: cloudflared-synapse-3.2.0
   namespace: matrix-synapse

clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-synapse-hookshot-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: matrix-synapse-hookshot-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: hookshot-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-hookshot-3.2.0
+  namespace: matrix-synapse
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - matrix-synapse
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: hookshot-cloudflared
+      app.kubernetes.io/name: hookshot-cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/matrix-synapse/ServiceMonitor-matrix-synapse-synapse-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: matrix-synapse-synapse-cloudflared
+  labels:
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: synapse-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-synapse-3.2.0
+  namespace: matrix-synapse
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - matrix-synapse
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: synapse-cloudflared
+      app.kubernetes.io/name: synapse-cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/outline/Deployment-outline-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: outline
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: outline
+      serviceAccountName: outline-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/outline/ExternalSecret-outline-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: outline-cloudflared-secret
   namespace: outline
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-cloudflared-secret
 spec:

clusters/cl01tl/manifests/outline/Service-outline-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: outline-cloudflared
+  labels:
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: outline-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: outline
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/outline/ServiceAccount-outline-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: outline

clusters/cl01tl/manifests/outline/ServiceMonitor-outline-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: outline-cloudflared
+  labels:
+    app.kubernetes.io/instance: outline
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: outline
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - outline
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/postiz/Deployment-postiz-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: postiz
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: postiz
+      serviceAccountName: postiz-cloudflared
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: postiz-cloudflared-secret
   namespace: postiz
   labels:
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "2.7.1"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-cloudflared-secret
 spec:

clusters/cl01tl/manifests/postiz/Service-postiz-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postiz-cloudflared
+  labels:
+    app.kubernetes.io/instance: postiz
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: postiz-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: postiz
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: postiz
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/postiz/ServiceAccount-postiz-cloudflared.yaml

@@ -7,5 +7,5 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.7.1
+    helm.sh/chart: cloudflared-3.2.0
   namespace: postiz

clusters/cl01tl/manifests/postiz/ServiceMonitor-postiz-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: postiz-cloudflared
+  labels:
+    app.kubernetes.io/instance: postiz
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: postiz
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - postiz
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/rybbit/Deployment-rybbit-backend.yaml

@@ -29,7 +29,7 @@ spec:
         app.kubernetes.io/name: rybbit
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: rybbit
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/rybbit/Deployment-rybbit-clickhouse.yaml

@@ -29,7 +29,7 @@ spec:
         app.kubernetes.io/name: rybbit
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: rybbit
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/rybbit/Deployment-rybbit-client.yaml

@@ -29,7 +29,7 @@ spec:
         app.kubernetes.io/name: rybbit
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: rybbit
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/rybbit/Deployment-rybbit-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: rybbit
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: rybbit-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/rybbit/ExternalSecret-rybbit-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: rybbit-cloudflared-secret
   namespace: rybbit
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: rybbit-cloudflared-secret
 spec:

clusters/cl01tl/manifests/rybbit/Service-rybbit-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rybbit-cloudflared
+  labels:
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: rybbit-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: rybbit
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/rybbit/ServiceAccount-rybbit-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rybbit-cloudflared
+  labels:
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: rybbit

clusters/cl01tl/manifests/rybbit/ServiceAccount-rybbit.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rybbit
+  labels:
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: rybbit
+    helm.sh/chart: rybbit-5.0.0
+  namespace: rybbit

clusters/cl01tl/manifests/rybbit/ServiceMonitor-rybbit-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: rybbit-cloudflared
+  labels:
+    app.kubernetes.io/instance: rybbit
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: rybbit
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - rybbit
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/rybbit/ServiceMonitor-rybbit.yaml

@@ -9,7 +9,7 @@ metadata:
     helm.sh/chart: rybbit-5.0.0
   namespace: rybbit
 spec:
-  jobLabel: rybbit
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - rybbit

clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: site-documentation
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: site-documentation-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: site-documentation
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: site-documentation
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/site-documentation/ExternalSecret-site-documentation-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: site-documentation-cloudflared-secret
   namespace: site-documentation
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: site-documentation
     app.kubernetes.io/part-of: site-documentation
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: site-documentation-cloudflared-secret
 spec:

clusters/cl01tl/manifests/site-documentation/Service-site-documentation-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: site-documentation-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: site-documentation-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-documentation
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/site-documentation/ServiceAccount-site-documentation-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-documentation-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-documentation

clusters/cl01tl/manifests/site-documentation/ServiceAccount-site-documentation.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-documentation
+  labels:
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-documentation
+    helm.sh/chart: site-documentation-5.0.0
+  namespace: site-documentation

clusters/cl01tl/manifests/site-documentation/ServiceMonitor-site-documentation-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: site-documentation-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-documentation
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-documentation
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - site-documentation
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/site-profile/Deployment-site-profile-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: site-profile
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: site-profile-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: site-profile
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: site-profile
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/site-profile/ExternalSecret-site-profile-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: site-profile-cloudflared-secret
   namespace: site-profile
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: site-profile
     app.kubernetes.io/part-of: site-profile
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: site-profile-cloudflared-secret
 spec:

clusters/cl01tl/manifests/site-profile/Service-site-profile-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: site-profile-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: site-profile-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-profile
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/site-profile/ServiceAccount-site-profile-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-profile-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-profile

clusters/cl01tl/manifests/site-profile/ServiceAccount-site-profile.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-profile
+  labels:
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-profile
+    helm.sh/chart: site-profile-5.0.0
+  namespace: site-profile

clusters/cl01tl/manifests/site-profile/ServiceMonitor-site-profile-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: site-profile-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-profile
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-profile
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - site-profile
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: site-saralebens
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: site-saralebens-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: site-saralebens
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: site-saralebens
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/site-saralebens/ExternalSecret-site-saralebens-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: site-saralebens-cloudflared-secret
   namespace: site-saralebens
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: site-saralebens
     app.kubernetes.io/part-of: site-saralebens
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: site-saralebens-cloudflared-secret
 spec:

clusters/cl01tl/manifests/site-saralebens/Service-site-saralebens-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: site-saralebens-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: site-saralebens-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-saralebens
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/site-saralebens/ServiceAccount-site-saralebens-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-saralebens-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-saralebens

clusters/cl01tl/manifests/site-saralebens/ServiceAccount-site-saralebens.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site-saralebens
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-saralebens
+    helm.sh/chart: site-saralebens-5.0.0
+  namespace: site-saralebens

clusters/cl01tl/manifests/site-saralebens/ServiceMonitor-site-saralebens-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: site-saralebens-cloudflared
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: site-saralebens
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - site-saralebens
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s

clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden-cloudflared.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cloudflared
     app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
   namespace: vaultwarden
 spec:
   revisionHistoryLimit: 3
@@ -28,8 +28,8 @@ spec:
         app.kubernetes.io/name: cloudflared
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
+      serviceAccountName: vaultwarden-cloudflared
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -38,8 +38,9 @@ spec:
         - args:
             - tunnel
             - --protocol
-            - http2
+            - auto
             - --no-autoupdate
+            - --metrics 0.0.0.0:20241
             - run
             - --token
             - $(CF_MANAGED_TUNNEL_TOKEN)

clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden.yaml

@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/name: vaultwarden
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: vaultwarden
       automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false

clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-cloudflared-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: vaultwarden-cloudflared-secret
   namespace: vaultwarden
   labels:
-    helm.sh/chart: cloudflared-2.6.0
+    helm.sh/chart: cloudflared-3.2.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "2.6.0"
+    app.kubernetes.io/version: "3.2.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-cloudflared-secret
 spec:

clusters/cl01tl/manifests/vaultwarden/Service-vaultwarden-cloudflared.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden-cloudflared
+  labels:
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/service: vaultwarden-cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: vaultwarden
+spec:
+  type: ClusterIP
+  ports:
+    - port: 20241
+      targetPort: 20241
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/name: cloudflared

clusters/cl01tl/manifests/vaultwarden/ServiceAccount-vaultwarden-cloudflared.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vaultwarden-cloudflared
+  labels:
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: vaultwarden

clusters/cl01tl/manifests/vaultwarden/ServiceAccount-vaultwarden.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vaultwarden
+  labels:
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: vaultwarden
+    helm.sh/chart: vaultwarden-5.0.0
+  namespace: vaultwarden

clusters/cl01tl/manifests/vaultwarden/ServiceMonitor-vaultwarden-cloudflared.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: vaultwarden-cloudflared
+  labels:
+    app.kubernetes.io/instance: vaultwarden
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-3.2.0
+  namespace: vaultwarden
+spec:
+  jobLabel: app.kubernetes.io/name
+  namespaceSelector:
+    matchNames:
+      - vaultwarden
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cloudflared
+      app.kubernetes.io/name: cloudflared
+  endpoints:
+    - interval: 30s
+      path: /metrics
+      port: metrics
+      scrapeTimeout: 10s