diff --git a/kubernetes/apps/default/namespace.yaml b/kubernetes/apps/default/namespace.yaml
index f659b055df..394b9eca07 100644
--- a/kubernetes/apps/default/namespace.yaml
+++ b/kubernetes/apps/default/namespace.yaml
@@ -5,3 +5,4 @@ metadata:
   name: default
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    kyverno.io/add-ndots: "true"
diff --git a/kubernetes/apps/home/namespace.yaml b/kubernetes/apps/home/namespace.yaml
index f2c03cd9dd..f802711cbe 100644
--- a/kubernetes/apps/home/namespace.yaml
+++ b/kubernetes/apps/home/namespace.yaml
@@ -5,3 +5,4 @@ metadata:
   name: home
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    kyverno.io/add-ndots: "true"
diff --git a/kubernetes/apps/media/namespace.yaml b/kubernetes/apps/media/namespace.yaml
index e4b066b2a4..11a39368d0 100644
--- a/kubernetes/apps/media/namespace.yaml
+++ b/kubernetes/apps/media/namespace.yaml
@@ -5,3 +5,4 @@ metadata:
   name: media
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    kyverno.io/add-ndots: "true"
diff --git a/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml b/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
index 6363043072..f8d2279bbf 100644
--- a/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
@@ -31,8 +31,8 @@ spec:
               name: &secret grafana-secret
     replicas: 3
     env:
-      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: http://authelia.security.svc.cluster.local:9091/api/oidc/token
-      GF_AUTH_GENERIC_OAUTH_API_URL: http://authelia.security.svc.cluster.local:9091/api/oidc/userinfo
+      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: http://authelia.security.svc.cluster.local.:9091/api/oidc/token
+      GF_AUTH_GENERIC_OAUTH_API_URL: http://authelia.security.svc.cluster.local.:9091/api/oidc/userinfo
       GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.${PUBLIC_DOMAIN}/api/oidc/authorization
       GF_AUTH_GENERIC_OAUTH_CLIENT_ID: grafana
       GF_DATE_FORMATS_USE_BROWSER_LOCALE: true
@@ -163,7 +163,7 @@ spec:
             type: prometheus
             uid: prometheus
             access: proxy
-            url: http://thanos-query-frontend.monitoring.svc.cluster.local:9090
+            url: http://thanos-query-frontend.monitoring.svc.cluster.local.:9090
             jsonData:
               prometheusType: Thanos
             isDefault: true
@@ -171,14 +171,14 @@ spec:
             type: alertmanager
             uid: alertmanager
             access: proxy
-            url: http://alertmanager-operated.monitoring.svc.cluster.local:9093
+            url: http://alertmanager-operated.monitoring.svc.cluster.local.:9093
             jsonData:
               implementation: prometheus
           - name: Loki
             type: loki
             uid: loki
             access: proxy
-            url: http://loki-gateway.monitoring.svc.cluster.local:80
+            url: http://loki-gateway.monitoring.svc.cluster.local.:80
             jsonData:
               maxLines: 250
     dashboards:
diff --git a/kubernetes/apps/monitoring/karma/app/helmrelease.yaml b/kubernetes/apps/monitoring/karma/app/helmrelease.yaml
index 944d4e96b8..61a6d5c8e4 100644
--- a/kubernetes/apps/monitoring/karma/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/karma/app/helmrelease.yaml
@@ -33,7 +33,7 @@ spec:
               repository: ghcr.io/prymitive/karma
               tag: v0.118@sha256:f116547287c662263e03b6a82e1deb18157c3a213787506ceb38bb7d24298844
             env:
-              ALERTMANAGER_URI: http://alertmanager-operated.monitoring.svc.cluster.local:9093
+              ALERTMANAGER_URI: http://alertmanager-operated.monitoring.svc.cluster.local.:9093
             probes:
               liveness: &probes
                 enabled: true
diff --git a/kubernetes/apps/monitoring/loki/app/helmrelease.yaml b/kubernetes/apps/monitoring/loki/app/helmrelease.yaml
index 9b0d86ec4d..667c1aec6b 100644
--- a/kubernetes/apps/monitoring/loki/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/loki/app/helmrelease.yaml
@@ -70,7 +70,7 @@ spec:
         ruler:
           enable_api: true
           enable_alertmanager_v2: true
-          alertmanager_url: http://alertmanager-operated.monitoring.svc.cluster.local:9093
+          alertmanager_url: http://alertmanager-operated.monitoring.svc.cluster.local.:9093
           storage:
             type: local
             local:
diff --git a/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml b/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
index 2e32758662..04c4a8fcae 100644
--- a/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
@@ -39,9 +39,9 @@ spec:
         type: REDIS
         config:
           addr: >-
-            redis-node-0.redis-headless.databases.svc.cluster.local:26379,
-            redis-node-1.redis-headless.databases.svc.cluster.local:26379,
-            redis-node-2.redis-headless.databases.svc.cluster.local:26379
+            redis-node-0.redis-headless.databases.svc.cluster.local.:26379,
+            redis-node-1.redis-headless.databases.svc.cluster.local.:26379,
+            redis-node-2.redis-headless.databases.svc.cluster.local.:26379
           master_name: redis-master
       ingress:
         enabled: true
@@ -91,7 +91,7 @@ spec:
       replicaLabel: __replica__
       clusterName: k8s
       alertmanagers:
-        - http://alertmanager-operated.monitoring.svc.cluster.local:9093
+        - http://alertmanager-operated.monitoring.svc.cluster.local.:9093
       extraFlags:
         - --web.prefix-header=X-Forwarded-Prefix
       config: |-
diff --git a/kubernetes/apps/monitoring/vector/agent/configs/vector.yaml b/kubernetes/apps/monitoring/vector/agent/configs/vector.yaml
index ba04b9e152..dea04d7107 100644
--- a/kubernetes/apps/monitoring/vector/agent/configs/vector.yaml
+++ b/kubernetes/apps/monitoring/vector/agent/configs/vector.yaml
@@ -17,5 +17,5 @@ sinks:
     type: vector
     inputs:
       - kubernetes_logs
-    address: "vector-aggregator.monitoring.svc.cluster.local:6000"
+    address: "vector-aggregator.monitoring.svc.cluster.local.:6000"
     version: "2"
diff --git a/kubernetes/apps/monitoring/vector/aggregator/configs/vector.yaml b/kubernetes/apps/monitoring/vector/aggregator/configs/vector.yaml
index c70d75a7f4..7ec7d1b0f0 100644
--- a/kubernetes/apps/monitoring/vector/aggregator/configs/vector.yaml
+++ b/kubernetes/apps/monitoring/vector/aggregator/configs/vector.yaml
@@ -87,7 +87,7 @@ sinks:
     type: loki
     inputs:
       - kubernetes_transform
-    endpoint: http://loki-gateway.monitoring.svc.cluster.local:80
+    endpoint: http://loki-gateway.monitoring.svc.cluster.local.:80
     encoding:
       codec: json
     batch:
@@ -105,7 +105,7 @@ sinks:
     type: loki
     inputs:
       - talos_kernel_transform
-    endpoint: http://loki-gateway.monitoring.svc.cluster.local:80
+    endpoint: http://loki-gateway.monitoring.svc.cluster.local.:80
     encoding:
       codec: json
       except_fields:
@@ -122,7 +122,7 @@ sinks:
     type: loki
     inputs:
       - talos_service_transform
-    endpoint: http://loki-gateway.monitoring.svc.cluster.local:80
+    endpoint: http://loki-gateway.monitoring.svc.cluster.local.:80
     encoding:
       codec: json
       except_fields:
@@ -139,7 +139,7 @@ sinks:
     type: loki
     inputs:
       - unifi_kernel_transform
-    endpoint: http://loki-gateway.monitoring.svc.cluster.local:80
+    endpoint: http://loki-gateway.monitoring.svc.cluster.local.:80
     encoding:
       codec: json
     batch:
diff --git a/kubernetes/apps/networking/blocky/app/datasource/datasource.yaml b/kubernetes/apps/networking/blocky/app/datasource/datasource.yaml
index 896e2537dc..a7c72b52f5 100644
--- a/kubernetes/apps/networking/blocky/app/datasource/datasource.yaml
+++ b/kubernetes/apps/networking/blocky/app/datasource/datasource.yaml
@@ -6,7 +6,7 @@ datasources:
     type: postgres
     uid: blocky
     access: proxy
-    url: postgres-ro.databases.svc.cluster.local:5432
+    url: postgres-ro.databases.svc.cluster.local.:5432
     user: {{ .BLOCKY_POSTGRES_USER }}
     jsonData:
       database: blocky
diff --git a/kubernetes/apps/networking/namespace.yaml b/kubernetes/apps/networking/namespace.yaml
index b9e4a4161f..366c889a4e 100644
--- a/kubernetes/apps/networking/namespace.yaml
+++ b/kubernetes/apps/networking/namespace.yaml
@@ -5,3 +5,4 @@ metadata:
   name: networking
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    kyverno.io/add-ndots: "true"
diff --git a/kubernetes/apps/security/namespace.yaml b/kubernetes/apps/security/namespace.yaml
index 397a2359d3..9e9853f65e 100644
--- a/kubernetes/apps/security/namespace.yaml
+++ b/kubernetes/apps/security/namespace.yaml
@@ -5,3 +5,4 @@ metadata:
   name: security
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    kyverno.io/add-ndots: "true"