diff --git a/cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml b/cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml
index 0dfa27010..17da2658e 100644
--- a/cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml
+++ b/cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml
@@ -248,7 +248,7 @@ spec:
             scrape_interval: 60s
             metrics_path: "/metrics"
             static_configs:
-              - targets: ["opnsense.${SECRET_CLUSTER_DOMAIN_ROOT}:9273"]
+              - targets: ["opnsense.${SECRET_CLUSTER_DOMAIN_ROOT}.:9273"]
                 labels:
                   app: "opnsense"
           - job_name: "hass"
diff --git a/cluster/apps/system-upgrade/server-plan.yaml b/cluster/apps/system-upgrade/server-plan.yaml
index f5989c891..e0101103e 100644
--- a/cluster/apps/system-upgrade/server-plan.yaml
+++ b/cluster/apps/system-upgrade/server-plan.yaml
@@ -26,12 +26,9 @@ spec:
           - "amd64"
   serviceAccountName: system-upgrade
   tolerations:
-    - key: "node-role.kubernetes.io/master"
+    - key: "node-role.kubernetes.io/control-plane"
       operator: "Exists"
-    - effect: NoExecute
-      operator: Exists
-    - effect: NoSchedule
-      operator: Exists
+      effect: "NoSchedule"
   upgrade:
     image: rancher/k3s-upgrade
   channel: https://update.k3s.io/v1-release/channels/v1.21
diff --git a/cluster/apps/system-upgrade/worker-plan.yaml b/cluster/apps/system-upgrade/worker-plan.yaml
index 4c314abcb..c34b6bfb2 100644
--- a/cluster/apps/system-upgrade/worker-plan.yaml
+++ b/cluster/apps/system-upgrade/worker-plan.yaml
@@ -25,7 +25,7 @@ spec:
         operator: Exists
       - key: k3os.io/mode
         operator: DoesNotExist
-      - key: node-role.kubernetes.io/master
+      - key: node-role.kubernetes.io/control-plane
         operator: NotIn
         values:
           - "true"
diff --git a/cluster/core/kube-system/kured/helm-release.yaml b/cluster/core/kube-system/kured/helm-release.yaml
index 7109a917b..6bf8f5556 100644
--- a/cluster/core/kube-system/kured/helm-release.yaml
+++ b/cluster/core/kube-system/kured/helm-release.yaml
@@ -25,7 +25,8 @@ spec:
       endTime: "5:00"
       timeZone: "Europe/Paris"
     tolerations:
-      - key: "node-role.kubernetes.io/master"
+      - key: "node-role.kubernetes.io/control-plane"
         operator: "Exists"
+        effect: "NoSchedule"
     metrics:
       create: true
diff --git a/cluster/core/kube-system/node-feature-discovery/helm-release.yaml b/cluster/core/kube-system/node-feature-discovery/helm-release.yaml
index d771e5a11..cfd8a11e3 100644
--- a/cluster/core/kube-system/node-feature-discovery/helm-release.yaml
+++ b/cluster/core/kube-system/node-feature-discovery/helm-release.yaml
@@ -19,10 +19,9 @@ spec:
   values:
     master:
       tolerations:
-        - effect: NoExecute
-          operator: Exists
-        - effect: NoSchedule
-          operator: Exists
+        - key: "node-role.kubernetes.io/control-plane"
+          operator: "Exists"
+          effect: "NoSchedule"
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -83,7 +82,6 @@ spec:
       annotations:
         configmap.reloader.stakater.com/reload: "nfd-worker-conf"
       tolerations:
-        - effect: "NoExecute"
-          operator: "Exists"
-        - effect: "NoSchedule"
+        - key: "node-role.kubernetes.io/control-plane"
           operator: "Exists"
+          effect: "NoSchedule"
diff --git a/cluster/core/rook-ceph/helm-release.yaml b/cluster/core/rook-ceph/helm-release.yaml
index 3938b6fb2..84333a3b2 100644
--- a/cluster/core/rook-ceph/helm-release.yaml
+++ b/cluster/core/rook-ceph/helm-release.yaml
@@ -21,12 +21,9 @@ spec:
     csi:
       kubeletDirPath: /var/lib/kubelet
       pluginTolerations:
-        - key: "node-role.kubernetes.io/master"
+        - key: "node-role.kubernetes.io/control-plane"
           operator: "Exists"
-        - effect: NoExecute
-          operator: Exists
-        - effect: NoSchedule
-          operator: Exists
+          effect: "NoSchedule"
     resources:
       requests:
         cpu: 100m
diff --git a/cluster/core/system-upgrade/deployment.yaml b/cluster/core/system-upgrade/deployment.yaml
index b8b08411f..ed6947bdf 100644
--- a/cluster/core/system-upgrade/deployment.yaml
+++ b/cluster/core/system-upgrade/deployment.yaml
@@ -53,7 +53,7 @@ spec:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
               - matchExpressions:
-                  - key: "node-role.kubernetes.io/master"
+                  - key: "node-role.kubernetes.io/control-plane"
                     operator: In
                     values:
                       - "true"
@@ -61,13 +61,9 @@ spec:
       tolerations:
         - key: "CriticalAddonsOnly"
           operator: "Exists"
-        - key: "node-role.kubernetes.io/master"
+        - key: "node-role.kubernetes.io/control-plane"
           operator: "Exists"
           effect: "NoSchedule"
-        - effect: NoExecute
-          operator: Exists
-        - effect: NoSchedule
-          operator: Exists
       containers:
         - name: system-upgrade-controller
           image: rancher/system-upgrade-controller:v0.7.3