diff --git a/.gitignore b/.gitignore
index fcea597..a0a3196 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 media/
 default/*tt*
+default/havenllo*
 certs/ca*
 
 lab/*
diff --git a/monitoring/kube-state-metrics.yaml b/monitoring/kube-state-metrics.yaml
index fba535b..75d2945 100644
--- a/monitoring/kube-state-metrics.yaml
+++ b/monitoring/kube-state-metrics.yaml
@@ -3,55 +3,51 @@ kind: ServiceAccount
 metadata:
   name: kube-state-metrics
   namespace: monitoring
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
+automountServiceAccountToken: false
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: kube-state-metrics
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 rules:
   - apiGroups: [""]
     resources:
       - nodes
       - pods
-      - services
-      - endpoints
-      - namespaces
-      - replicationcontrollers
+      - persistentvolumeclaims
     verbs: ["list", "watch"]
-  - apiGroups: ["extensions", "apps"]
+  - apiGroups: ["apps"]
     resources:
+      - statefulsets
       - daemonsets
       - deployments
       - replicasets
-      - statefulsets
     verbs: ["list", "watch"]
   - apiGroups: ["batch"]
     resources:
       - cronjobs
       - jobs
     verbs: ["list", "watch"]
-  - apiGroups: ["autoscaling"]
-    resources:
-      - horizontalpodautoscalers
-    verbs: ["list", "watch"]
-  - apiGroups: ["policy"]
-    resources:
-      - poddisruptionbudgets
-    verbs: ["list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources:
-      - storageclasses
-      - volumeattachments
-    verbs: ["list", "watch"]
-  - apiGroups: ["apps"]
-    resources:
-      - replicasets
-    verbs: ["list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: kube-state-metrics
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -68,6 +64,9 @@ metadata:
   namespace: monitoring
   labels:
     app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 spec:
   replicas: 1
   selector:
@@ -77,14 +76,46 @@ spec:
     metadata:
       labels:
         app: kube-state-metrics
+        app.kubernetes.io/component: exporter
+        app.kubernetes.io/name: kube-state-metrics
+        app.kubernetes.io/version: 2.19.1
     spec:
+      automountServiceAccountToken: true
       serviceAccountName: kube-state-metrics
+      nodeSelector:
+        kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets
           ports:
             - name: http-metrics
               containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http-metrics
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             requests:
               cpu: 50m
@@ -100,10 +131,15 @@ metadata:
   namespace: monitoring
   labels:
     app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 spec:
+  type: ClusterIP
+  selector:
+    app: kube-state-metrics
   ports:
     - name: http-metrics
       port: 8080
       targetPort: http-metrics
-  selector:
-    app: kube-state-metrics
+      protocol: TCP
diff --git a/monitoring/loki.yaml b/monitoring/loki.yaml
index ccaf7fd..952a937 100644
--- a/monitoring/loki.yaml
+++ b/monitoring/loki.yaml
@@ -24,6 +24,13 @@ spec:
               mountPath: /etc/loki/config
             - name: loki-storage
               mountPath: /tmp/loki
+          resources:
+            requests:
+              cpu: 100m
+              memory: 1Gi
+            limits:
+              cpu: 200m
+              memory: 1Gi
       volumes:
         - name: config
           configMap:
@@ -98,4 +105,4 @@ spec:
       targetPort: 3100
       name: http
   selector:
-    app: loki
\ No newline at end of file
+    app: loki
diff --git a/secrets/kasbot.yaml b/secrets/kasbot.yaml
new file mode 100644
index 0000000..55cf02b
--- /dev/null
+++ b/secrets/kasbot.yaml
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: kasbot, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: kasbot-secrets
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        KASBOT_TOKEN: "{{ .KASBOT_TOKEN }}"
+  data:
+    - secretKey: KASBOT_TOKEN
+      remoteRef:
+        { key: 885a7d90-95be-494f-af88-300ac6a7e210, property: KASBOT_TOKEN }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }