diff --git a/api/v1/cbcontainersagent_types.go b/api/v1/cbcontainersagent_types.go
index 84263102..e3ae0c59 100644
--- a/api/v1/cbcontainersagent_types.go
+++ b/api/v1/cbcontainersagent_types.go
@@ -30,7 +30,13 @@ type CBContainersAgentSpec struct {
 	ClusterName string                   `json:"clusterName,required"`
 	Version     string                   `json:"version,required"`
 	Gateways    CBContainersGatewaysSpec `json:"gateways,required"`
+	// The field below remains to avoid moving the CRD from v1 to v2.
+	// It MUST not be used as agent namespace should be controlled outside the operator itself.
+	// This is because a custom namespace in the CRD requires high privileges by the operator across the whole cluster to be able to "switch" namespaces on demand.
+
 	// +kubebuilder:default:="cbcontainers-dataplane"
+	// Namespace is deprecated and the value has no effect. Do not use.
+	// Deprecated: The operator and agent always run in the same namespace. See documentation for ways to customize this namespace.
 	Namespace string `json:"namespace,omitempty"`
 	// +kubebuilder:default:="cbcontainers-access-token"
 	AccessTokenSecretName string `json:"accessTokenSecretName,omitempty"`
diff --git a/cbcontainers/state/components/cluster_configmap.go b/cbcontainers/state/components/cluster_configmap.go
index 940b1001..155cd218 100644
--- a/cbcontainers/state/components/cluster_configmap.go
+++ b/cbcontainers/state/components/cluster_configmap.go
@@ -17,9 +17,9 @@ type ConfigurationK8sObject struct {
 	Namespace string
 }
 
-func NewConfigurationK8sObject() *ConfigurationK8sObject {
+func NewConfigurationK8sObject(namespace string) *ConfigurationK8sObject {
 	return &ConfigurationK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -35,12 +35,11 @@ func (obj *ConfigurationK8sObject) MutateK8sObject(k8sObject client.Object, agen
 		return fmt.Errorf("expected ConfigMap K8s object")
 	}
 
-	configMap.Namespace = agentSpec.Namespace
 	configMap.Data = map[string]string{
 		commonState.DataPlaneConfigmapAccountKey:            agentSpec.Account,
 		commonState.DataPlaneConfigmapClusterKey:            agentSpec.ClusterName,
 		commonState.DataPlaneConfigmapAgentVersionKey:       agentSpec.Version,
-		commonState.DataPlaneConfigmapDataplaneNamespaceKey: agentSpec.Namespace,
+		commonState.DataPlaneConfigmapDataplaneNamespaceKey: obj.Namespace,
 		commonState.DataPlaneConfigmapApiSchemeKey:          agentSpec.Gateways.ApiGateway.Scheme,
 		commonState.DataPlaneConfigmapApiHostKey:            agentSpec.Gateways.ApiGateway.Host,
 		commonState.DataPlaneConfigmapApiPortKey:            strconv.Itoa(agentSpec.Gateways.ApiGateway.Port),
diff --git a/cbcontainers/state/components/enforcer_deployment.go b/cbcontainers/state/components/enforcer_deployment.go
index 00803cde..5e629d62 100644
--- a/cbcontainers/state/components/enforcer_deployment.go
+++ b/cbcontainers/state/components/enforcer_deployment.go
@@ -42,9 +42,9 @@ type EnforcerDeploymentK8sObject struct {
 	Namespace string
 }
 
-func NewEnforcerDeploymentK8sObject() *EnforcerDeploymentK8sObject {
+func NewEnforcerDeploymentK8sObject(namespace string) *EnforcerDeploymentK8sObject {
 	return &EnforcerDeploymentK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -84,8 +84,6 @@ func (obj *EnforcerDeploymentK8sObject) MutateK8sObject(k8sObject client.Object,
 	if objectsDiffer(deployment.Spec.Template.Spec.ImagePullSecrets, desiredImagePullSecrets) {
 		deployment.Spec.Template.Spec.ImagePullSecrets = desiredImagePullSecrets
 	}
-	obj.Namespace = agentSpec.Namespace
-	deployment.Namespace = agentSpec.Namespace
 	obj.mutateAnnotations(deployment, enforcer)
 	obj.mutateVolumes(&deployment.Spec.Template.Spec)
 	obj.mutateAffinityAndNodeSelector(&deployment.Spec.Template.Spec, enforcer)
diff --git a/cbcontainers/state/components/enforcer_mutating_webhook.go b/cbcontainers/state/components/enforcer_mutating_webhook.go
index 6711eeaa..44c5085e 100644
--- a/cbcontainers/state/components/enforcer_mutating_webhook.go
+++ b/cbcontainers/state/components/enforcer_mutating_webhook.go
@@ -34,10 +34,10 @@ type EnforcerMutatingWebhookK8sObject struct {
 	ServiceNamespace string
 }
 
-func NewEnforcerMutatingWebhookK8sObject(kubeletVersion string) *EnforcerMutatingWebhookK8sObject {
+func NewEnforcerMutatingWebhookK8sObject(serviceNamespace, kubeletVersion string) *EnforcerMutatingWebhookK8sObject {
 	return &EnforcerMutatingWebhookK8sObject{
 		kubeletVersion:   kubeletVersion,
-		ServiceNamespace: commonState.DataPlaneNamespaceName,
+		ServiceNamespace: serviceNamespace,
 	}
 }
 
@@ -65,10 +65,10 @@ func (obj *EnforcerMutatingWebhookK8sObject) MutateK8sObject(k8sObject client.Ob
 
 	enforcer := &agentSpec.Components.Basic.Enforcer
 	obj.mutateWebhookConfigurationLabels(webhookConfiguration, enforcer)
-	return obj.mutateWebhooks(webhookConfiguration, enforcer, agentSpec.Namespace)
+	return obj.mutateWebhooks(webhookConfiguration, enforcer)
 }
 
-func (obj *EnforcerMutatingWebhookK8sObject) mutateWebhooks(webhookConfiguration adapters.WebhookConfigurationAdapter, enforcer *cbcontainersv1.CBContainersEnforcerSpec, serviceNamespace string) error {
+func (obj *EnforcerMutatingWebhookK8sObject) mutateWebhooks(webhookConfiguration adapters.WebhookConfigurationAdapter, enforcer *cbcontainersv1.CBContainersEnforcerSpec) error {
 	var resourcesWebhookObj adapters.WebhookAdapter
 
 	initializeWebhooks := false
@@ -93,7 +93,7 @@ func (obj *EnforcerMutatingWebhookK8sObject) mutateWebhooks(webhookConfiguration
 		resourcesWebhookObj = updatedWebhooks[0]
 	}
 
-	obj.mutateResourcesWebhook(resourcesWebhookObj, enforcer.WebhookTimeoutSeconds, enforcer.FailurePolicy, serviceNamespace)
+	obj.mutateResourcesWebhook(resourcesWebhookObj, enforcer.WebhookTimeoutSeconds, enforcer.FailurePolicy)
 	return nil
 }
 
@@ -107,7 +107,7 @@ func (obj *EnforcerMutatingWebhookK8sObject) findWebhookByName(webhooks []adapte
 	return nil, false
 }
 
-func (obj *EnforcerMutatingWebhookK8sObject) mutateResourcesWebhook(resourcesWebhook adapters.WebhookAdapter, timeoutSeconds int32, failurePolicy, serviceNamespace string) {
+func (obj *EnforcerMutatingWebhookK8sObject) mutateResourcesWebhook(resourcesWebhook adapters.WebhookAdapter, timeoutSeconds int32, failurePolicy string) {
 	resourcesWebhook.SetName(MutatingWebhookName)
 	resourcesWebhook.SetFailurePolicy(failurePolicy)
 	resourcesWebhook.SetSideEffects(MutatingWebhookSideEffect)
@@ -123,7 +123,7 @@ func (obj *EnforcerMutatingWebhookK8sObject) mutateResourcesWebhook(resourcesWeb
 	}
 	resourcesWebhook.SetCABundle(obj.tlsSecretValues.CaCert)
 	resourcesWebhook.SetServiceName(EnforcerName)
-	resourcesWebhook.SetServiceNamespace(serviceNamespace)
+	resourcesWebhook.SetServiceNamespace(obj.ServiceNamespace)
 	resourcesWebhook.SetServicePath(&MutatingWebhookPath)
 }
 
diff --git a/cbcontainers/state/components/enforcer_service.go b/cbcontainers/state/components/enforcer_service.go
index 336241f3..21819796 100644
--- a/cbcontainers/state/components/enforcer_service.go
+++ b/cbcontainers/state/components/enforcer_service.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	cbcontainersv1 "github.com/vmware/cbcontainers-operator/api/v1"
-	commonState "github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 	coreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -21,9 +20,9 @@ type EnforcerServiceK8sObject struct {
 	Namespace string
 }
 
-func NewEnforcerServiceK8sObject() *EnforcerServiceK8sObject {
+func NewEnforcerServiceK8sObject(namespace string) *EnforcerServiceK8sObject {
 	return &EnforcerServiceK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -45,7 +44,6 @@ func (obj *EnforcerServiceK8sObject) MutateK8sObject(k8sObject client.Object, ag
 
 	service.Labels = enforcer.Labels
 	service.Spec.Type = coreV1.ServiceTypeClusterIP
-	service.Namespace = agentSpec.Namespace
 	service.Spec.Selector = map[string]string{
 		EnforcerLabelKey: EnforcerName,
 	}
diff --git a/cbcontainers/state/components/enforcer_tls_secret.go b/cbcontainers/state/components/enforcer_tls_secret.go
index 91ddb73f..b4bed8bd 100644
--- a/cbcontainers/state/components/enforcer_tls_secret.go
+++ b/cbcontainers/state/components/enforcer_tls_secret.go
@@ -5,7 +5,6 @@ import (
 
 	cbcontainersv1 "github.com/vmware/cbcontainers-operator/api/v1"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/models"
-	commonState "github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 	coreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -26,10 +25,10 @@ type EnforcerTlsK8sObject struct {
 	Namespace string
 }
 
-func NewEnforcerTlsK8sObject(tlsSecretsValuesCreator TlsSecretsValuesCreator) *EnforcerTlsK8sObject {
+func NewEnforcerTlsK8sObject(namespace string, tlsSecretsValuesCreator TlsSecretsValuesCreator) *EnforcerTlsK8sObject {
 	return &EnforcerTlsK8sObject{
 		tlsSecretsValuesCreator: tlsSecretsValuesCreator,
-		Namespace:               commonState.DataPlaneNamespaceName,
+		Namespace:               namespace,
 	}
 }
 
@@ -47,7 +46,6 @@ func (obj *EnforcerTlsK8sObject) MutateK8sObject(k8sObject client.Object, spec *
 		return fmt.Errorf("expected Secret K8s object")
 	}
 
-	secret.Namespace = spec.Namespace
 	tlsSecretValues, err := obj.tlsSecretsValuesCreator.CreateTlsSecretsValues(types.NamespacedName{Name: EnforcerName, Namespace: obj.Namespace})
 	if err != nil {
 		return err
diff --git a/cbcontainers/state/components/enforcer_validating_webhook.go b/cbcontainers/state/components/enforcer_validating_webhook.go
index 1e855f1e..acaeaf14 100644
--- a/cbcontainers/state/components/enforcer_validating_webhook.go
+++ b/cbcontainers/state/components/enforcer_validating_webhook.go
@@ -7,7 +7,6 @@ import (
 	cbcontainersv1 "github.com/vmware/cbcontainers-operator/api/v1"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/models"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/state/adapters"
-	commonState "github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/utils"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -36,10 +35,10 @@ type EnforcerValidatingWebhookK8sObject struct {
 	ServiceNamespace string
 }
 
-func NewEnforcerValidatingWebhookK8sObject(kubeletVersion string) *EnforcerValidatingWebhookK8sObject {
+func NewEnforcerValidatingWebhookK8sObject(serviceNamespace, kubeletVersion string) *EnforcerValidatingWebhookK8sObject {
 	return &EnforcerValidatingWebhookK8sObject{
 		kubeletVersion:   kubeletVersion,
-		ServiceNamespace: commonState.DataPlaneNamespaceName,
+		ServiceNamespace: serviceNamespace,
 	}
 }
 
diff --git a/cbcontainers/state/components/image_scanning_reporter_deployment.go b/cbcontainers/state/components/image_scanning_reporter_deployment.go
index f6c9f509..4d9b25d6 100644
--- a/cbcontainers/state/components/image_scanning_reporter_deployment.go
+++ b/cbcontainers/state/components/image_scanning_reporter_deployment.go
@@ -34,9 +34,9 @@ type ImageScanningReporterDeploymentK8sObject struct {
 	Namespace string
 }
 
-func NewImageScanningReporterDeploymentK8sObject() *ImageScanningReporterDeploymentK8sObject {
+func NewImageScanningReporterDeploymentK8sObject(namespace string) *ImageScanningReporterDeploymentK8sObject {
 	return &ImageScanningReporterDeploymentK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -55,7 +55,6 @@ func (obj *ImageScanningReporterDeploymentK8sObject) MutateK8sObject(k8sObject c
 	}
 
 	clusterScanning := &agentSpec.Components.ClusterScanning
-	deployment.Namespace = agentSpec.Namespace
 	imageScanningReporter := &clusterScanning.ImageScanningReporter
 	obj.initiateDeployment(deployment, agentSpec)
 	obj.mutateLabels(deployment, imageScanningReporter)
diff --git a/cbcontainers/state/components/image_scanning_reporter_service.go b/cbcontainers/state/components/image_scanning_reporter_service.go
index 83e97926..2f7dbce6 100644
--- a/cbcontainers/state/components/image_scanning_reporter_service.go
+++ b/cbcontainers/state/components/image_scanning_reporter_service.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	cbcontainersv1 "github.com/vmware/cbcontainers-operator/api/v1"
-	commonState "github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 	coreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -21,9 +20,9 @@ type ImageScanningReporterServiceK8sObject struct {
 	Namespace string
 }
 
-func NewImageScanningReporterServiceK8sObject() *ImageScanningReporterServiceK8sObject {
+func NewImageScanningReporterServiceK8sObject(namespace string) *ImageScanningReporterServiceK8sObject {
 	return &ImageScanningReporterServiceK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -43,7 +42,6 @@ func (obj *ImageScanningReporterServiceK8sObject) MutateK8sObject(k8sObject clie
 
 	imageScanningReporter := &agentSpec.Components.ClusterScanning.ImageScanningReporter
 
-	service.Namespace = agentSpec.Namespace
 	service.Labels = imageScanningReporter.Labels
 	service.Spec.Type = coreV1.ServiceTypeClusterIP
 	service.Spec.Selector = map[string]string{
diff --git a/cbcontainers/state/components/monitor_deployment.go b/cbcontainers/state/components/monitor_deployment.go
index c887def4..809895ba 100644
--- a/cbcontainers/state/components/monitor_deployment.go
+++ b/cbcontainers/state/components/monitor_deployment.go
@@ -37,9 +37,9 @@ type MonitorDeploymentK8sObject struct {
 	Namespace string
 }
 
-func NewMonitorDeploymentK8sObject() *MonitorDeploymentK8sObject {
+func NewMonitorDeploymentK8sObject(namespace string) *MonitorDeploymentK8sObject {
 	return &MonitorDeploymentK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -76,7 +76,6 @@ func (obj *MonitorDeploymentK8sObject) MutateK8sObject(k8sObject client.Object,
 		deployment.Spec.Template.ObjectMeta.Annotations = make(map[string]string)
 	}
 
-	deployment.Namespace = agentSpec.Namespace
 	deployment.Spec.Replicas = &MonitorReplicas
 	deployment.ObjectMeta.Labels = desiredLabels
 	deployment.Spec.Selector.MatchLabels = desiredLabels
diff --git a/cbcontainers/state/components/registry_secret.go b/cbcontainers/state/components/registry_secret.go
index a8083643..845ef397 100644
--- a/cbcontainers/state/components/registry_secret.go
+++ b/cbcontainers/state/components/registry_secret.go
@@ -18,9 +18,9 @@ type RegistrySecretK8sObject struct {
 	Namespace string
 }
 
-func NewRegistrySecretK8sObject() *RegistrySecretK8sObject {
+func NewRegistrySecretK8sObject(namespace string) *RegistrySecretK8sObject {
 	return &RegistrySecretK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -46,7 +46,6 @@ func (obj *RegistrySecretK8sObject) MutateK8sObject(k8sObject client.Object, spe
 
 	secret.Type = obj.registrySecretValues.Type
 	secret.Data = obj.registrySecretValues.Data
-	secret.Namespace = spec.Namespace
 
 	return nil
 }
diff --git a/cbcontainers/state/components/resolver_service.go b/cbcontainers/state/components/resolver_service.go
index 94b8ea17..935889d6 100644
--- a/cbcontainers/state/components/resolver_service.go
+++ b/cbcontainers/state/components/resolver_service.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	cbcontainersv1 "github.com/vmware/cbcontainers-operator/api/v1"
-	commonState "github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 	coreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -20,9 +19,9 @@ type ResolverServiceK8sObject struct {
 	Namespace string
 }
 
-func NewResolverServiceK8sObject() *ResolverServiceK8sObject {
+func NewResolverServiceK8sObject(namespace string) *ResolverServiceK8sObject {
 	return &ResolverServiceK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -46,7 +45,6 @@ func (obj *ResolverServiceK8sObject) MutateK8sObject(k8sObject client.Object, ag
 	service.Spec.Type = coreV1.ServiceTypeClusterIP
 	service.Spec.ClusterIP = coreV1.ClusterIPNone
 
-	service.Namespace = agentSpec.Namespace
 	service.Spec.Selector = map[string]string{
 		resolverLabelKey: ResolverName,
 	}
diff --git a/cbcontainers/state/components/runtime_resolver_deployment.go b/cbcontainers/state/components/runtime_resolver_deployment.go
index 3f9dd247..9be0d68b 100644
--- a/cbcontainers/state/components/runtime_resolver_deployment.go
+++ b/cbcontainers/state/components/runtime_resolver_deployment.go
@@ -36,9 +36,9 @@ type ResolverDeploymentK8sObject struct {
 	APIReader client.Reader
 }
 
-func NewResolverDeploymentK8sObject(apiReader client.Reader) *ResolverDeploymentK8sObject {
+func NewResolverDeploymentK8sObject(namespace string, apiReader client.Reader) *ResolverDeploymentK8sObject {
 	return &ResolverDeploymentK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 		APIReader: apiReader,
 	}
 }
@@ -89,7 +89,6 @@ func (obj *ResolverDeploymentK8sObject) MutateK8sObject(k8sObject client.Object,
 		}
 	}
 
-	deployment.Namespace = agentSpec.Namespace
 	deployment.Spec.Replicas = replicasCount
 	deployment.ObjectMeta.Labels = desiredLabels
 	deployment.Spec.Selector.MatchLabels = desiredLabels
diff --git a/cbcontainers/state/components/sensor_daemon_set.go b/cbcontainers/state/components/sensor_daemon_set.go
index cab75b69..27889e76 100644
--- a/cbcontainers/state/components/sensor_daemon_set.go
+++ b/cbcontainers/state/components/sensor_daemon_set.go
@@ -95,9 +95,9 @@ type SensorDaemonSetK8sObject struct {
 	Namespace string
 }
 
-func NewSensorDaemonSetK8sObject() *SensorDaemonSetK8sObject {
+func NewSensorDaemonSetK8sObject(namespace string) *SensorDaemonSetK8sObject {
 	return &SensorDaemonSetK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -131,7 +131,6 @@ func (obj *SensorDaemonSetK8sObject) MutateK8sObject(k8sObject client.Object, ag
 		daemonSet.Spec.Template.Spec.HostPID = false
 	}
 
-	daemonSet.Namespace = agentSpec.Namespace
 	obj.mutateLabels(daemonSet, agentSpec)
 	obj.mutateAnnotations(daemonSet, agentSpec)
 	obj.mutateVolumes(daemonSet, agentSpec)
diff --git a/cbcontainers/state/components/state_reporter_deployment.go b/cbcontainers/state/components/state_reporter_deployment.go
index d1d00d35..b090b06d 100644
--- a/cbcontainers/state/components/state_reporter_deployment.go
+++ b/cbcontainers/state/components/state_reporter_deployment.go
@@ -32,9 +32,9 @@ type StateReporterDeploymentK8sObject struct {
 	Namespace string
 }
 
-func NewStateReporterDeploymentK8sObject() *StateReporterDeploymentK8sObject {
+func NewStateReporterDeploymentK8sObject(namespace string) *StateReporterDeploymentK8sObject {
 	return &StateReporterDeploymentK8sObject{
-		Namespace: commonState.DataPlaneNamespaceName,
+		Namespace: namespace,
 	}
 }
 
@@ -72,7 +72,6 @@ func (obj *StateReporterDeploymentK8sObject) MutateK8sObject(k8sObject client.Ob
 		deployment.Spec.Template.ObjectMeta.Annotations = make(map[string]string)
 	}
 
-	deployment.Namespace = agentSpec.Namespace
 	deployment.Spec.Replicas = &StateReporterReplicas
 	deployment.ObjectMeta.Labels = desiredLabels
 	deployment.Spec.Selector.MatchLabels = desiredLabels
diff --git a/cbcontainers/state/state_applier.go b/cbcontainers/state/state_applier.go
index 6cbc6741..35ebc408 100644
--- a/cbcontainers/state/state_applier.go
+++ b/cbcontainers/state/state_applier.go
@@ -41,23 +41,23 @@ type StateApplier struct {
 	log                             logr.Logger
 }
 
-func NewStateApplier(apiReader client.Reader, agentComponentApplier AgentComponentApplier, k8sVersion string, tlsSecretsValuesCreator components.TlsSecretsValuesCreator, log logr.Logger) *StateApplier {
+func NewStateApplier(apiReader client.Reader, agentComponentApplier AgentComponentApplier, k8sVersion, agentNamespace string, tlsSecretsValuesCreator components.TlsSecretsValuesCreator, log logr.Logger) *StateApplier {
 	return &StateApplier{
-		desiredConfigMap:                components.NewConfigurationK8sObject(),
-		desiredRegistrySecret:           components.NewRegistrySecretK8sObject(),
+		desiredConfigMap:                components.NewConfigurationK8sObject(agentNamespace),
+		desiredRegistrySecret:           components.NewRegistrySecretK8sObject(agentNamespace),
 		desiredPriorityClass:            components.NewPriorityClassK8sObject(k8sVersion),
-		desiredMonitorDeployment:        components.NewMonitorDeploymentK8sObject(),
-		enforcerTlsSecret:               components.NewEnforcerTlsK8sObject(tlsSecretsValuesCreator),
-		enforcerDeployment:              components.NewEnforcerDeploymentK8sObject(),
-		enforcerService:                 components.NewEnforcerServiceK8sObject(),
-		enforcerValidatingWebhook:       components.NewEnforcerValidatingWebhookK8sObject(k8sVersion),
-		enforcerMutatingWebhook:         components.NewEnforcerMutatingWebhookK8sObject(k8sVersion),
-		stateReporterDeployment:         components.NewStateReporterDeploymentK8sObject(),
-		resolverDeployment:              components.NewResolverDeploymentK8sObject(apiReader),
-		resolverService:                 components.NewResolverServiceK8sObject(),
-		sensorDaemonSet:                 components.NewSensorDaemonSetK8sObject(),
-		imageScanningReporterDeployment: components.NewImageScanningReporterDeploymentK8sObject(),
-		imageScanningReporterService:    components.NewImageScanningReporterServiceK8sObject(),
+		desiredMonitorDeployment:        components.NewMonitorDeploymentK8sObject(agentNamespace),
+		enforcerTlsSecret:               components.NewEnforcerTlsK8sObject(agentNamespace, tlsSecretsValuesCreator),
+		enforcerDeployment:              components.NewEnforcerDeploymentK8sObject(agentNamespace),
+		enforcerService:                 components.NewEnforcerServiceK8sObject(agentNamespace),
+		enforcerValidatingWebhook:       components.NewEnforcerValidatingWebhookK8sObject(agentNamespace, k8sVersion),
+		enforcerMutatingWebhook:         components.NewEnforcerMutatingWebhookK8sObject(agentNamespace, k8sVersion),
+		stateReporterDeployment:         components.NewStateReporterDeploymentK8sObject(agentNamespace),
+		resolverDeployment:              components.NewResolverDeploymentK8sObject(agentNamespace, apiReader),
+		resolverService:                 components.NewResolverServiceK8sObject(agentNamespace),
+		sensorDaemonSet:                 components.NewSensorDaemonSetK8sObject(agentNamespace),
+		imageScanningReporterDeployment: components.NewImageScanningReporterDeploymentK8sObject(agentNamespace),
+		imageScanningReporterService:    components.NewImageScanningReporterServiceK8sObject(agentNamespace),
 		applier:                         agentComponentApplier,
 		log:                             log,
 	}
@@ -70,13 +70,6 @@ func (c *StateApplier) GetPriorityClassEmptyK8sObject() client.Object {
 func (c *StateApplier) ApplyDesiredState(ctx context.Context, agentSpec *cbcontainersv1.CBContainersAgentSpec, registrySecret *models.RegistrySecretValues, setOwner applymentOptions.OwnerSetter) (bool, error) {
 	applyOptions := applymentOptions.NewApplyOptions().SetOwnerSetter(setOwner)
 
-	// The namespace field of the agent spec should always be populated, because it has a default value
-	// but just in case include this check here in case it turns out to be empty in the future.
-	// By default all objects have the "cbcontainers-dataplane" as namespace.
-	if agentSpec.Namespace != "" {
-		c.setNamespace(agentSpec.Namespace)
-	}
-
 	coreMutated, err := c.applyCoreComponents(ctx, agentSpec, registrySecret, applyOptions)
 	if err != nil {
 		return false, err
@@ -143,24 +136,6 @@ func (c *StateApplier) ApplyDesiredState(ctx context.Context, agentSpec *cbconta
 	return coreMutated || mutatedEnforcer || mutatedStateReporter || mutatedRuntimeResolver || mutatedComponentsDaemonSet || runtimeResolverDeleted || mutatedImageScanningReporter || imageScanningReporterDeleted || componentsDamonSetDeleted, nil
 }
 
-// setNamespace sets the namespace to all the desired K8s objects which are namespaced.
-func (c *StateApplier) setNamespace(namespace string) {
-	c.desiredConfigMap.Namespace = namespace
-	c.desiredRegistrySecret.Namespace = namespace
-	c.desiredMonitorDeployment.Namespace = namespace
-	c.enforcerTlsSecret.Namespace = namespace
-	c.enforcerDeployment.Namespace = namespace
-	c.enforcerService.Namespace = namespace
-	c.enforcerValidatingWebhook.ServiceNamespace = namespace
-	c.enforcerMutatingWebhook.ServiceNamespace = namespace
-	c.stateReporterDeployment.Namespace = namespace
-	c.resolverDeployment.Namespace = namespace
-	c.resolverService.Namespace = namespace
-	c.sensorDaemonSet.Namespace = namespace
-	c.imageScanningReporterDeployment.Namespace = namespace
-	c.imageScanningReporterService.Namespace = namespace
-}
-
 func (c *StateApplier) applyCoreComponents(ctx context.Context, agentSpec *cbcontainersv1.CBContainersAgentSpec, registrySecret *models.RegistrySecretValues, applyOptions *applymentOptions.ApplyOptions) (bool, error) {
 	mutatedConfigmap, _, err := c.applier.Apply(ctx, c.desiredConfigMap, agentSpec, applyOptions)
 	if err != nil {
diff --git a/cbcontainers/state/state_applier_test.go b/cbcontainers/state/state_applier_test.go
index 5ee90bb2..4a4b6140 100644
--- a/cbcontainers/state/state_applier_test.go
+++ b/cbcontainers/state/state_applier_test.go
@@ -148,7 +148,6 @@ func testStateApplier(t *testing.T, setup StateApplierTestSetup, k8sVersion, nam
 	agentSpec := &cbcontainersv1.CBContainersAgentSpec{
 		Account:     Account,
 		ClusterName: Cluster,
-		Namespace:   namespace,
 		Gateways: cbcontainersv1.CBContainersGatewaysSpec{
 			ApiGateway: cbcontainersv1.CBContainersApiGatewaySpec{
 				Scheme:  ApiGateWayScheme,
@@ -190,7 +189,7 @@ func testStateApplier(t *testing.T, setup StateApplierTestSetup, k8sVersion, nam
 
 	setup(mockObjects)
 
-	stateApplier := state.NewStateApplier(testUtilsMocks.NewMockReader(ctrl), mockObjects.componentApplier, k8sVersion, mockObjects.secretValuesCreator, logrTesting.NewTestLogger(t))
+	stateApplier := state.NewStateApplier(testUtilsMocks.NewMockReader(ctrl), mockObjects.componentApplier, k8sVersion, namespace, mockObjects.secretValuesCreator, logrTesting.NewTestLogger(t))
 	return stateApplier.ApplyDesiredState(context.Background(), agentSpec, &models.RegistrySecretValues{}, nil)
 }
 
diff --git a/charts/cbcontainers-agent/README.md b/charts/cbcontainers-agent/README.md
index 2b654b34..aca3cf7a 100644
--- a/charts/cbcontainers-agent/README.md
+++ b/charts/cbcontainers-agent/README.md
@@ -21,15 +21,7 @@ There are 8 required fields that need to be provided by the user:
 | `spec.gateways.hardeningEventsGatewayHost` | The URL of the CBC Hardening events Gateway       |
 | `spec.gateways.runtimeEventsGatewayHost`   | The URL of the CBC Runtime events Gateway         |
 
-After setting these required fields in a `values.yaml` file you can install the chart from our repo:
-
-```sh
-helm repo add vmware TODO-chart-repo/TODO-chart-name -f values.yaml
-helm repo update
-helm install cbcontainers-agent TODO-chart-repo/TODO-chart-name -f values.yaml --namespace cbcontainers-dataplane
-```
-
-or from source
+After setting these required fields in a `values.yaml` file you can install the chart from source
 
 ```sh
 cd charts/cbcontainers-agent
@@ -46,9 +38,14 @@ For all the possible values see <https://github.com/octarinesec/octarine-operato
 
 ### Namespace
 
-By default the CBContainers agent will be installed in the `cbcontainers-dataplane` namespace.
+The CBContainers agent will be running in the same namespace as the deployed operator. This is by design as only 1 running agent per cluster is supported.
+To customize that namespace, see [operator-chart](../cbcontainers-operator).
+
+The actual namespace where helm tracks the release (see [--namespace flag](https://helm.sh/docs/helm/helm_install/)) is not important to the agent chart, 
+but the recommended approach is to also use the same namespace as the operator chart.
 
-If you want to change that set the `agentNamespce` value in your `values.yaml` file.
+The `agentNamespace` value is only required if the agent chart is responsible for deploying the agent's secret as well. See [secret detection](#secret-creation) for details.
+If the secret is pre-created before deploying the agent, then `agentNamespace` has no effect.  
 
 ### Secret creation
 
diff --git a/charts/cbcontainers-agent/cbcontainers-agent-chart/Chart.yaml b/charts/cbcontainers-agent/cbcontainers-agent-chart/Chart.yaml
index 43a0ac63..f32f96ca 100644
--- a/charts/cbcontainers-agent/cbcontainers-agent-chart/Chart.yaml
+++ b/charts/cbcontainers-agent/cbcontainers-agent-chart/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: cbcontainers-agent
 description: A Helm chart for installing the CBContainers Agent
 type: application
-version: 1.0.0
-appVersion: "2.11.0"
+version: 2.0.0
+appVersion: "2.12.1"
diff --git a/charts/cbcontainers-agent/cbcontainers-agent-chart/templates/service-accounts.yaml b/charts/cbcontainers-agent/cbcontainers-agent-chart/templates/service-accounts.yaml
deleted file mode 100644
index 401f4548..00000000
--- a/charts/cbcontainers-agent/cbcontainers-agent-chart/templates/service-accounts.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-apiVersion: v1
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
-kind: ServiceAccount
-metadata:
-  name: cbcontainers-agent-node
-  namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
----
-apiVersion: v1
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
-kind: ServiceAccount
-metadata:
-  name: cbcontainers-enforcer
-  namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
----
-apiVersion: v1
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
-kind: ServiceAccount
-metadata:
-  name: cbcontainers-image-scanning
-  namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
----
-apiVersion: v1
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
-kind: ServiceAccount
-metadata:
-  name: cbcontainers-monitor
-  namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
----
-apiVersion: v1
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
-kind: ServiceAccount
-metadata:
-  name: cbcontainers-runtime-resolver
-  namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
----
-apiVersion: v1
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
-kind: ServiceAccount
-metadata:
-  name: cbcontainers-state-reporter
-  namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
diff --git a/charts/cbcontainers-agent/cbcontainers-agent-chart/values.yaml b/charts/cbcontainers-agent/cbcontainers-agent-chart/values.yaml
index dad9ba86..91c04a30 100644
--- a/charts/cbcontainers-agent/cbcontainers-agent-chart/values.yaml
+++ b/charts/cbcontainers-agent/cbcontainers-agent-chart/values.yaml
@@ -9,5 +9,5 @@ clusterGroup: ""
 # clusterName is the name that will be used for the cluster that the agent is installed on
 clusterName: ""
 # agentNamespace is the name of the namespace in which the agent will be installed
-# that namespace should exist before the chart is installed
+# that namespace must exist before the chart is installed and must match the namespace where the operator is deployed
 agentNamespace: "cbcontainers-dataplane"
\ No newline at end of file
diff --git a/charts/cbcontainers-operator/README.md b/charts/cbcontainers-operator/README.md
index fef8b06e..1feea193 100644
--- a/charts/cbcontainers-operator/README.md
+++ b/charts/cbcontainers-operator/README.md
@@ -12,30 +12,22 @@ The chart can be installed as is, without any customization or modifications.
 
 You can create the Helm release in any namespace that you want.
 
-You can also customize the namespace in which the operator is installed.
+You can also customize the namespace in which the operator itself is installed.
 See [Customization](#namespace).
 
 ### Installing the operator chart
 
-Now, install the actual helm chart in the namespace based on the chosen option 1 or 2 above.
-
-```sh
-helm repo add vmware TODO-chart-repo/TODO-chart-name
-helm repo update
-helm install cbcontainers-operator TODO-chart-repo/TODO-chart-name --namespace X
-```
-
-or from source:
+Now, install the actual helm chart from source:
 
 ```sh
 cd charts/cbcontainers-operator
-helm install cbcontainers-operator ./cbcontainers-operator-chart --namespace X
+helm install cbcontainers-operator ./cbcontainers-operator-chart
 ```
 
 ## Customization
 
 | Parameter                        | Description                                         | Default                                                                            |
-| -------------------------------- | --------------------------------------------------- | ---------------------------------------------------------------------------------- |
+|----------------------------------|-----------------------------------------------------|------------------------------------------------------------------------------------|
 | `spec.operator.image.repository` | The repository of the operator image                | `cbartifactory/octarine-operator`                                                  |
 | `spec.operator.image.version`    | The version of the operator image                   | The latest version of the operator image                                           |
 | `spec.operator.resources`        | Carbon Black Container Operator resources           | `{requests: {memory: "64Mi", cpu: "30m"}, limits: {memory: "256Mi", cpu: "200m"}}` |
@@ -51,6 +43,16 @@ If you want to change that, set the `operatorNamespace` field in your `values.ya
 The chart will automatically create the namespace that you have chosen to install the operator into.
 If you don't want to do that (because you have already created the namespace), set the `createOperatorNamespace` field in your `values.yaml` file to `false`.
 
+If the namespace is pre-created, then it must also be labeled properly or the operator and agent might not reconcile successfully. 
+The commands below show an example of creating a custom namespace, labeling and installing the operator inside.
+
+```sh
+NAMESPACE=<choose_your_value>
+kubectl create namespace $NAMESPACE
+kubectl label namespace $NAMESPACE control-plane=operator octarine=ignore
+helm install cbcontainers-operator ./cbcontainers-operator-chart --set createOperatorNamespace=false,operatorNamespace=$NAMESPACE
+```
+
 ### CRD Installation
 
 By default, installing the chart will also create the `CBContainersAgent` CRD.
@@ -71,7 +73,7 @@ For more info see <https://github.com/octarinesec/octarine-operator/tree/master#
 
 ## Templates
 
-This chart consists of two [templates](cbcontainers-operator-chart/templates).
+This chart consists of four [templates](cbcontainers-operator-chart/templates).
 
 The [operator.yaml](cbcontainers-operator-chart/templates/operator.yaml) file contains all resources, apart from the operator deployment.
 It is generated via `kustomize`.
@@ -81,3 +83,6 @@ The [deployment.yaml](cbcontainers-operator-chart/templates/deployment.yaml) fil
 It is derived from [this Kustomize configuration](../../config/manager) but because it needs to be configurable via Helm it is heavily templated.
 Because of that it cannot be generated automatically, so it should be maintained by hand.
 If any changes are make to the [Kustomize configuration](../../config/manager), they should also be reflected in that file.
+
+The [dataplane_rbac.yaml](cbcontainers-operator-chart/templates/dataplane_rbac.yaml) and [dataplane_service_accounts](cbcontainers-operator-chart/templates/dataplane_service_accounts.yaml) 
+files contain necessary RBAC objects for the agent to work as expected. 
\ No newline at end of file
diff --git a/charts/cbcontainers-operator/cbcontainers-operator-chart/Chart.yaml b/charts/cbcontainers-operator/cbcontainers-operator-chart/Chart.yaml
index 5b890cab..9e58d581 100644
--- a/charts/cbcontainers-operator/cbcontainers-operator-chart/Chart.yaml
+++ b/charts/cbcontainers-operator/cbcontainers-operator-chart/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: cbcontainers-operator
 description: A Helm chart for installing the CBContainers operator
 type: application
-version: 1.0.0
-appVersion: v5.6.0
+version: 2.0.0
+appVersion: v5.6.2
diff --git a/charts/cbcontainers-agent/cbcontainers-agent-chart/templates/rbac.yaml b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_rbac.yaml
similarity index 88%
rename from charts/cbcontainers-agent/cbcontainers-agent-chart/templates/rbac.yaml
rename to charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_rbac.yaml
index f86348da..3f56e6b3 100644
--- a/charts/cbcontainers-agent/cbcontainers-agent-chart/templates/rbac.yaml
+++ b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_rbac.yaml
@@ -115,7 +115,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: cbcontainers-agent-node
-    namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
+    namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -128,7 +128,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: cbcontainers-enforcer
-    namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
+    namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -141,7 +141,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: cbcontainers-image-scanning
-    namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
+    namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -154,7 +154,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: cbcontainers-monitor
-    namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
+    namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -167,7 +167,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: cbcontainers-runtime-resolver
-    namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
+    namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -180,4 +180,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: cbcontainers-state-reporter
-    namespace: {{ default "cbcontainers-dataplane" .Values.agentNamespace }}
+    namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
diff --git a/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_service_accounts.yaml b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_service_accounts.yaml
new file mode 100644
index 00000000..15d00ed9
--- /dev/null
+++ b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_service_accounts.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cbcontainers-agent-node
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cbcontainers-enforcer
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cbcontainers-image-scanning
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cbcontainers-monitor
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cbcontainers-runtime-resolver
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cbcontainers-state-reporter
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
diff --git a/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/deployment.yaml b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/deployment.yaml
index a408648c..43a21c51 100644
--- a/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/deployment.yaml
+++ b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/deployment.yaml
@@ -99,5 +99,10 @@ spec:
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 65532
+        env:
+          - name: OPERATOR_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
       serviceAccountName: cbcontainers-operator
       terminationGracePeriodSeconds: 10
diff --git a/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/operator.yaml b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/operator.yaml
index 98f26019..157a7305 100644
--- a/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/operator.yaml
+++ b/charts/cbcontainers-operator/cbcontainers-operator-chart/templates/operator.yaml
@@ -1846,34 +1846,17 @@ spec:
                             default: {}
                             properties:
                               CRIO:
-                                default: { }
-                                description: CRIO holds configuration values specific
-                                  to the CRI-O container engine
+                                default: {}
+                                description: CRIO holds configuration values specific to the CRI-O container engine
                                 properties:
                                   configPath:
-                                    description: ConfigPath can be used to set the
-                                      path to CRI-O's configuration file. If not specified,
-                                      the default location is used (/etc/crio/crio.conf).
-                                      See https://github.com/cri-o/cri-o/blob/main/docs/crio.conf.5.md
-                                      for more information.
+                                    description: ConfigPath can be used to set the path to CRI-O's configuration file. If not specified, the default location is used (/etc/crio/crio.conf). See https://github.com/cri-o/cri-o/blob/main/docs/crio.conf.5.md for more information.
                                     type: string
                                   storageConfigPath:
-                                    description: StorageConfigPath can be used to
-                                      set the path to the storage configuration file
-                                      used by CRI-O (if any). If not specified, the
-                                      default location for storage is used (/etc/containers/storage.conf).
-                                      The files does not need to exist. See https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md
-                                      for more information
+                                    description: StorageConfigPath can be used to set the path to the storage configuration file used by CRI-O (if any). If not specified, the default location for storage is used (/etc/containers/storage.conf). The files does not need to exist. See https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md for more information
                                     type: string
                                   storagePath:
-                                    description: StoragePath can be used to set the
-                                      path used by CRI-O to store images on each node.
-                                      This path will be mounted on the cluster scanner
-                                      to provide access to the node's images. If the
-                                      path does not match what CRI-O uses on the nodes,
-                                      then images will not be found and scanned as
-                                      expected. If not specified, the default location
-                                      of CRI-O is used (/var/lib/containers/storage).
+                                    description: StoragePath can be used to set the path used by CRI-O to store images on each node. This path will be mounted on the cluster scanner to provide access to the node's images. If the path does not match what CRI-O uses on the nodes, then images will not be found and scanned as expected. If not specified, the default location of CRI-O is used (/var/lib/containers/storage).
                                     type: string
                                 type: object
                               endpoint:
@@ -2558,6 +2541,103 @@ spec:
                             type: object
                         type: object
                     type: object
+                  cndr:
+                    description: CBContainersCndrSpec defines the desired state of CBContainersCndr
+                    properties:
+                      companyCodeSecretName:
+                        default: cbcontainers-company-code
+                        type: string
+                      enabled:
+                        default: false
+                        type: boolean
+                      sensor:
+                        default: {}
+                        properties:
+                          daemonSetAnnotations:
+                            additionalProperties:
+                              type: string
+                            default: {}
+                            type: object
+                          env:
+                            additionalProperties:
+                              type: string
+                            default: {}
+                            type: object
+                          image:
+                            default:
+                              repository: cbartifactory/cndr
+                            properties:
+                              pullPolicy:
+                                default: IfNotPresent
+                                description: PullPolicy describes a policy for if/when to pull a container image
+                                type: string
+                              pullSecrets:
+                                description: "PullSecrets is a list of secret names, which will be used to pull the container image(s). \n The secrets must already exist."
+                                items:
+                                  type: string
+                                type: array
+                              repository:
+                                type: string
+                              tag:
+                                type: string
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            default: {}
+                            type: object
+                          logLevel:
+                            default: info
+                            type: string
+                          podTemplateAnnotations:
+                            additionalProperties:
+                              type: string
+                            default: {}
+                            type: object
+                          prometheus:
+                            default:
+                              port: 7071
+                            properties:
+                              enabled:
+                                default: false
+                                type: boolean
+                              port:
+                                type: integer
+                            type: object
+                          resources:
+                            default:
+                              limits:
+                                cpu: 500m
+                                memory: 1024Mi
+                              requests:
+                                cpu: 30m
+                                memory: 64Mi
+                            description: ResourceRequirements describes the compute resource requirements.
+                            properties:
+                              limits:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: 'Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                                type: object
+                              requests:
+                                additionalProperties:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                                description: 'Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                                type: object
+                            type: object
+                          verbosity_level:
+                            default: 2
+                            type: integer
+                        type: object
+                    type: object
                   runtimeProtection:
                     default: {}
                     description: CBContainersRuntimeProtectionSpec defines the desired state of CBContainersRuntime
@@ -3075,6 +3155,10 @@ spec:
                               type: string
                             default: {}
                             type: object
+                          nodesToReplicasRatio:
+                            default: 5
+                            format: int32
+                            type: integer
                           podTemplateAnnotations:
                             additionalProperties:
                               type: string
@@ -3128,7 +3212,6 @@ spec:
                                 type: integer
                             type: object
                           replicasCount:
-                            default: 1
                             format: int32
                             type: integer
                           resources:
@@ -3381,6 +3464,7 @@ spec:
                 type: object
               namespace:
                 default: cbcontainers-dataplane
+                description: Namespace is deprecated and the value has no effect. Do not use.
                 type: string
               version:
                 type: string
@@ -3472,87 +3556,82 @@ rules:
   - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   creationTimestamp: null
   name: cbcontainers-manager-role
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 rules:
 - apiGroups:
-  - ""
-  - discovery.k8s.io
-  resources:
-  - endpoints
-  - endpointslices
-  - services
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - admissionregistration.k8s.io
-  resources:
-  - mutatingwebhookconfigurations
-  - validatingwebhookconfigurations
-  verbs:
-  - '*'
-- apiGroups:
-  - apiextensions.k8s.io
   - apps
-  - batch
   - ""
-  - extensions
-  - networking.k8s.io
-  - rbac
-  - rbac.authorization.k8s.io
   resources:
-  - clusterrolebindings
-  - cronjobs
-  - customresourcedefinitions
   - daemonsets
   - deployments
-  - ingresses
-  - jobs
-  - namespaces
-  - networkpolicies
-  - nodes
-  - pods
-  - replicasets
-  - replicationcontrollers
-  - rolebindings
   - services
-  - statefulsets
   verbs:
+  - create
+  - delete
+  - deletecollection
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
-  - apps
   - ""
   resources:
-  - daemonsets
-  - deployments
-  - services
+  - configmaps
+  - secrets
   verbs:
   - create
   - delete
+  - deletecollection
   - get
   - list
   - patch
   - update
   - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: cbcontainers-manager-role
+rules:
 - apiGroups:
-  - ""
+  - admissionregistration.k8s.io
   resources:
-  - configmaps
-  - secrets
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
   verbs:
   - create
+  - list
+  - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resourceNames:
+  - cbcontainers-hardening-enforcer
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  verbs:
   - delete
   - get
-  - list
   - patch
   - update
-  - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
 - apiGroups:
   - operator.containers.carbonblack.io
   resources:
@@ -3592,7 +3671,20 @@ rules:
   resources:
   - priorityclasses
   verbs:
-  - '*'
+  - create
+  - list
+  - watch
+- apiGroups:
+  - scheduling.k8s.io
+  resourceNames:
+  - cbcontainers-dataplane-priority-class
+  resources:
+  - priorityclasses
+  verbs:
+  - delete
+  - get
+  - patch
+  - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -3627,6 +3719,20 @@ subjects:
   namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cbcontainers-manager-namespaced-rolebinding
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cbcontainers-manager-role
+subjects:
+- kind: ServiceAccount
+  name: cbcontainers-operator
+  namespace: {{ default "cbcontainers-dataplane" .Values.operatorNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: cbcontainers-manager-rolebinding
@@ -3691,6 +3797,7 @@ spec:
   ports:
   - name: https
     port: 8443
+    protocol: TCP
     targetPort: https
   selector:
     control-plane: operator
diff --git a/config/crd/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml b/config/crd/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml
index 1009057e..f2733d5e 100644
--- a/config/crd/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml
+++ b/config/crd/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml
@@ -6036,6 +6036,9 @@ spec:
                 type: object
               namespace:
                 default: cbcontainers-dataplane
+                description: 'Namespace is deprecated and the value has no effect.
+                  Do not use. Deprecated: The operator and agent always run in the
+                  same namespace. See documentation for ways to customize this namespace.'
                 type: string
               version:
                 type: string
diff --git a/config/crd_v1beta1/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml b/config/crd_v1beta1/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml
index 233baf9c..2bc77744 100644
--- a/config/crd_v1beta1/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml
+++ b/config/crd_v1beta1/bases/operator.containers.carbonblack.io_cbcontainersagents.yaml
@@ -5608,6 +5608,9 @@ spec:
               - runtimeEventsGateway
               type: object
             namespace:
+              description: 'Namespace is deprecated and the value has no effect. Do
+                not use. Deprecated: The operator and agent always run in the same
+                namespace. See documentation for ways to customize this namespace.'
               type: string
             version:
               type: string
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index 472e6f2b..8a3b8821 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -75,5 +75,10 @@ spec:
           requests:
             cpu: 100m
             memory: 64Mi
+        env:
+          - name: OPERATOR_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
       serviceAccountName: operator
-      terminationGracePeriodSeconds: 10
+      terminationGracePeriodSeconds: 10
\ No newline at end of file
diff --git a/config/rbac/dataplane_roles.yaml b/config/rbac/dataplane/dataplane_roles.yaml
similarity index 100%
rename from config/rbac/dataplane_roles.yaml
rename to config/rbac/dataplane/dataplane_roles.yaml
diff --git a/config/rbac/dataplane/role_binding.yaml b/config/rbac/dataplane/role_binding.yaml
new file mode 100644
index 00000000..e54e864e
--- /dev/null
+++ b/config/rbac/dataplane/role_binding.yaml
@@ -0,0 +1,91 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: state-reporter-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: state-reporter-role
+subjects:
+  - kind: ServiceAccount
+    name: state-reporter
+    namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: enforcer-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: enforcer-role
+subjects:
+  - kind: ServiceAccount
+    name: enforcer
+    namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: monitor-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: monitor-role
+subjects:
+  - kind: ServiceAccount
+    name: monitor
+    namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: image-scanning-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: image-scanning-role
+subjects:
+  - kind: ServiceAccount
+    name: image-scanning
+    namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: runtime-resolver-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: runtime-resolver-role
+subjects:
+  - kind: ServiceAccount
+    name: runtime-resolver
+    namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: agent-node-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: agent-node-role
+subjects:
+  - kind: ServiceAccount
+    name: agent-node
+    namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: runtime-resolver-to-agent-node-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: runtime-resolver-role
+subjects:
+  - kind: ServiceAccount
+    name: agent-node
+    namespace: system
diff --git a/config/rbac/dataplane/service_account.yaml b/config/rbac/dataplane/service_account.yaml
new file mode 100644
index 00000000..1cbbfac7
--- /dev/null
+++ b/config/rbac/dataplane/service_account.yaml
@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: state-reporter
+  namespace: system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: enforcer
+  namespace: system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: monitor
+  namespace: system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: image-scanning
+  namespace: system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: runtime-resolver
+  namespace: system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: agent-node
+  namespace: system
+
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
index 40dca000..93b3bacb 100644
--- a/config/rbac/kustomization.yaml
+++ b/config/rbac/kustomization.yaml
@@ -1,6 +1,8 @@
 resources:
 - role.yaml
-- dataplane_roles.yaml
+- dataplane/dataplane_roles.yaml
+- dataplane/role_binding.yaml
+- dataplane/service_account.yaml
 - role_binding.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 6e6f84c5..b3ad61ea 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -12,35 +12,21 @@ rules:
   - mutatingwebhookconfigurations
   - validatingwebhookconfigurations
   verbs:
-  - '*'
-- apiGroups:
-  - apps
-  - ""
-  resources:
-  - daemonsets
-  - deployments
-  - services
-  verbs:
   - create
-  - delete
-  - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
-  - ""
+  - admissionregistration.k8s.io
+  resourceNames:
+  - cbcontainers-hardening-enforcer
   resources:
-  - configmaps
-  - secrets
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
   verbs:
-  - create
   - delete
   - get
-  - list
   - patch
   - update
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -92,4 +78,56 @@ rules:
   resources:
   - priorityclasses
   verbs:
-  - '*'
+  - create
+  - list
+  - watch
+- apiGroups:
+  - scheduling.k8s.io
+  resourceNames:
+  - cbcontainers-dataplane-priority-class
+  resources:
+  - priorityclasses
+  verbs:
+  - delete
+  - get
+  - patch
+  - update
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  creationTimestamp: null
+  name: manager-role
+  namespace: cbcontainers-dataplane
+rules:
+- apiGroups:
+  - apps
+  - ""
+  resources:
+  - daemonsets
+  - deployments
+  - services
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml
index cb9f682d..dff03bf6 100644
--- a/config/rbac/role_binding.yaml
+++ b/config/rbac/role_binding.yaml
@@ -12,92 +12,15 @@ subjects:
   namespace: system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: state-reporter-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: state-reporter-role
-subjects:
-  - kind: ServiceAccount
-    name: state-reporter
-    namespace: system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: enforcer-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: enforcer-role
-subjects:
-  - kind: ServiceAccount
-    name: enforcer
-    namespace: system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: monitor-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: monitor-role
-subjects:
-  - kind: ServiceAccount
-    name: monitor
-    namespace: system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: image-scanning-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: image-scanning-role
-subjects:
-  - kind: ServiceAccount
-    name: image-scanning
-    namespace: system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: runtime-resolver-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: runtime-resolver-role
-subjects:
-  - kind: ServiceAccount
-    name: runtime-resolver
-    namespace: system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: agent-node-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: agent-node-role
-subjects:
-  - kind: ServiceAccount
-    name: agent-node
-    namespace: system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
-  name: runtime-resolver-to-agent-node-rolebinding
+  name: manager-namespaced-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: runtime-resolver-role
+  kind: Role
+  name: manager-role
 subjects:
   - kind: ServiceAccount
-    name: agent-node
+    name: operator
     namespace: system
diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml
index e209e470..a63e646e 100644
--- a/config/rbac/service_account.yaml
+++ b/config/rbac/service_account.yaml
@@ -14,52 +14,4 @@ metadata:
   namespace: system
 imagePullSecrets:
   - name: cbcontainers-operator-public-registry-secret
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: state-reporter
-  namespace: system
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: enforcer
-  namespace: system
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: monitor
-  namespace: system
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: image-scanning
-  namespace: system
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: runtime-resolver
-  namespace: system
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: agent-node
-  namespace: system
-imagePullSecrets:
-  - name: cbcontainers-operator-public-registry-secret
 
diff --git a/controllers/agent_defaults.go b/controllers/agent_defaults.go
index 04cc4424..39faca9b 100644
--- a/controllers/agent_defaults.go
+++ b/controllers/agent_defaults.go
@@ -2,7 +2,6 @@ package controllers
 
 import (
 	cbcontainersv1 "github.com/vmware/cbcontainers-operator/api/v1"
-	"github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 )
 
 func (r *CBContainersAgentController) setAgentDefaults(agentSpec *cbcontainersv1.CBContainersAgentSpec) error {
@@ -16,13 +15,6 @@ func (r *CBContainersAgentController) setAgentDefaults(agentSpec *cbcontainersv1
 		return err
 	}
 
-	// The namespace field of the agent spec should always be populated, because it has a default value,
-	// but just in case include this check here in case it turns out to be empty in the future.
-	// By default all objects have the "cbcontainers-dataplane" as namespace.
-	if agentSpec.Namespace == "" {
-		agentSpec.Namespace = common.DataPlaneNamespaceName
-	}
-
 	return nil
 }
 
diff --git a/controllers/cbcontainersagent_controller.go b/controllers/cbcontainersagent_controller.go
index b367844a..496895b8 100644
--- a/controllers/cbcontainersagent_controller.go
+++ b/controllers/cbcontainersagent_controller.go
@@ -52,6 +52,8 @@ type CBContainersAgentController struct {
 	ClusterProcessor AgentProcessor
 	StateApplier     StateApplier
 	K8sVersion       string
+	// Namespace is the kubernetes namespace for all agent components
+	Namespace string
 }
 
 func (r *CBContainersAgentController) getContainersAgentObject(ctx context.Context) (*cbcontainersv1.CBContainersAgent, error) {
@@ -71,16 +73,23 @@ func (r *CBContainersAgentController) getContainersAgentObject(ctx context.Conte
 	return &cbContainersAgentsList.Items[0], nil
 }
 
+// The following values must be kept in-sync with constants for generated RBAC to work properly:
+// - default dataplane namespace (see common.DataPlaneNamespaceName)
+// - cluster-wide dataplane priority class  (see common.DataPlanePriorityClassName) - avoids access to all priority classes on the cluster
+// - the cluster-wide webhooks (see components.EnforcerName) - avoids access to all webhooks on the cluster
+
 // +kubebuilder:rbac:groups=operator.containers.carbonblack.io,resources=cbcontainersagents,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=operator.containers.carbonblack.io,resources=cbcontainersagents/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=operator.containers.carbonblack.io,resources=cbcontainersagents/finalizers,verbs=update
-// +kubebuilder:rbac:groups=core,resources={configmaps,secrets},verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=scheduling.k8s.io,resources=priorityclasses,verbs=*
-// +kubebuilder:rbac:groups={apps,core},resources={deployments,services,daemonsets},verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources={validatingwebhookconfigurations,mutatingwebhookconfigurations},verbs=*
+// +kubebuilder:rbac:groups=scheduling.k8s.io,resources=priorityclasses,verbs=delete;get;patch;update,resourceNames=cbcontainers-dataplane-priority-class
+// +kubebuilder:rbac:groups=scheduling.k8s.io,resources=priorityclasses,verbs=create;list;watch
+// +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources={validatingwebhookconfigurations,mutatingwebhookconfigurations},verbs=delete;get;patch;update,resourceNames=cbcontainers-hardening-enforcer
+// +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources={validatingwebhookconfigurations,mutatingwebhookconfigurations},verbs=create;list;watch
 // +kubebuilder:rbac:groups={core},resources={nodes},verbs=list
 // +kubebuilder:rbac:groups={core},resources={namespaces},verbs=get
 // +kubebuilder:rbac:groups={policy},resources={podsecuritypolicies},verbs=use,resourceNames={cbcontainers-manager-psp}
+// +kubebuilder:rbac:groups={apps,core},resources={deployments,services,daemonsets},namespace=cbcontainers-dataplane,verbs=get;list;watch;create;update;patch;delete;deletecollection
+// +kubebuilder:rbac:groups=core,resources={configmaps,secrets},namespace=cbcontainers-dataplane,verbs=get;list;watch;create;update;patch;delete;deletecollection
 
 func (r *CBContainersAgentController) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	r.Log.Info("\n\n")
@@ -94,6 +103,7 @@ func (r *CBContainersAgentController) Reconcile(ctx context.Context, req ctrl.Re
 	}
 
 	if cbContainersAgent == nil {
+		r.Log.Info("No CBContainersAgent object found")
 		return ctrl.Result{}, nil
 	}
 
@@ -137,7 +147,7 @@ func (r *CBContainersAgentController) getRegistrySecretValues(ctx context.Contex
 }
 
 func (r *CBContainersAgentController) getAccessToken(ctx context.Context, cbContainersCluster *cbcontainersv1.CBContainersAgent) (string, error) {
-	accessTokenSecretNamespacedName := types.NamespacedName{Name: cbContainersCluster.Spec.AccessTokenSecretName, Namespace: cbContainersCluster.Spec.Namespace}
+	accessTokenSecretNamespacedName := types.NamespacedName{Name: cbContainersCluster.Spec.AccessTokenSecretName, Namespace: r.Namespace}
 	accessTokenSecret := &corev1.Secret{}
 	if err := r.Get(ctx, accessTokenSecretNamespacedName, accessTokenSecret); err != nil {
 		return "", fmt.Errorf("couldn't find access token secret k8s object: %v", err)
diff --git a/controllers/cbcontainersagent_controller_test.go b/controllers/cbcontainersagent_controller_test.go
index e86836f2..7ab2b3af 100644
--- a/controllers/cbcontainersagent_controller_test.go
+++ b/controllers/cbcontainersagent_controller_test.go
@@ -32,6 +32,8 @@ type ClusterControllerTestMocks struct {
 
 const (
 	MyClusterTokenValue = "my-token-value"
+	// agentNamespace helps validate we don't depend on a hardcoded namespace anywhere
+	agentNamespace = "dummy-namespace"
 )
 
 var (
@@ -70,9 +72,10 @@ func testCBContainersClusterController(t *testing.T, setups ...SetupClusterContr
 	}
 
 	controller := &controllers.CBContainersAgentController{
-		Client: mocksObjects.client,
-		Log:    logrTesting.NewTestLogger(t),
-		Scheme: &runtime.Scheme{},
+		Client:    mocksObjects.client,
+		Log:       logrTesting.NewTestLogger(t),
+		Scheme:    &runtime.Scheme{},
+		Namespace: agentNamespace,
 
 		ClusterProcessor: mocksObjects.ClusterProcessor,
 		StateApplier:     mocksObjects.StateApplier,
@@ -90,7 +93,7 @@ func setupClusterCustomResource(testMocks *ClusterControllerTestMocks) {
 }
 
 func setUpTokenSecretValues(testMocks *ClusterControllerTestMocks) {
-	accessTokenSecretNamespacedName := types.NamespacedName{Name: ClusterAccessTokenSecretName, Namespace: commonState.DataPlaneNamespaceName}
+	accessTokenSecretNamespacedName := types.NamespacedName{Name: ClusterAccessTokenSecretName, Namespace: agentNamespace}
 	testMocks.client.EXPECT().Get(testMocks.ctx, accessTokenSecretNamespacedName, &corev1.Secret{}).
 		Do(func(ctx context.Context, namespacedName types.NamespacedName, secret *corev1.Secret, _ ...interface{}) {
 			secret.Data = map[string][]byte{
@@ -132,7 +135,7 @@ func TestFindingMoreThanOneClusterResourceShouldReturnError(t *testing.T) {
 
 func TestGetTokenSecretErrorShouldReturnError(t *testing.T) {
 	_, err := testCBContainersClusterController(t, setupClusterCustomResource, func(testMocks *ClusterControllerTestMocks) {
-		accessTokenSecretNamespacedName := types.NamespacedName{Name: ClusterAccessTokenSecretName, Namespace: commonState.DataPlaneNamespaceName}
+		accessTokenSecretNamespacedName := types.NamespacedName{Name: ClusterAccessTokenSecretName, Namespace: agentNamespace}
 		testMocks.client.EXPECT().Get(testMocks.ctx, accessTokenSecretNamespacedName, &corev1.Secret{}).Return(fmt.Errorf(""))
 	})
 
@@ -141,7 +144,7 @@ func TestGetTokenSecretErrorShouldReturnError(t *testing.T) {
 
 func TestTokenSecretWithoutTokenValueShouldReturnError(t *testing.T) {
 	_, err := testCBContainersClusterController(t, setupClusterCustomResource, func(testMocks *ClusterControllerTestMocks) {
-		accessTokenSecretNamespacedName := types.NamespacedName{Name: ClusterAccessTokenSecretName, Namespace: commonState.DataPlaneNamespaceName}
+		accessTokenSecretNamespacedName := types.NamespacedName{Name: ClusterAccessTokenSecretName, Namespace: agentNamespace}
 		testMocks.client.EXPECT().Get(testMocks.ctx, accessTokenSecretNamespacedName, &corev1.Secret{}).Return(nil)
 	})
 
diff --git a/docs/rbac.md b/docs/rbac.md
new file mode 100644
index 00000000..397b1da9
--- /dev/null
+++ b/docs/rbac.md
@@ -0,0 +1,22 @@
+# How to configure and use the VMWare Carbon Black Cloud Container Operator's Role-based access control (RBAC)
+
+## Design for the operator and agent RBAC definition
+Following the principle of least-privilege, any permission given to the operator should have good reason and be scoped as tightly as possible. 
+
+In practice, this means:
+* If the resource is namespaced and part of the agent, use a `Role` to give permissions in the agent's namespace only
+* If the resource is namespaced and not part of the agent,
+  * and you need to read it - use a `ClusterRole` unless you are 100% sure what the namespace will be
+  * and you need to modify it - do you _really_ need to? 
+* If the resource is non-namespaced, use a `ClusterRole` and try to restrict `delete,get,update,patch` via `resourceNames` (`create, list, watch` either don't support this restriction or require extra care)
+
+## Changing the operator's access levels
+These permissions are generated by `controller-gen` and controlled via `+kubebuilder` directives. See [the controller definitions](../controllers/cbcontainersagent_controller.go).
+Any change to those directives requires running `make manifests` to update the respective [`role.yaml`](../config/rbac/role.yaml) file. Changes should also be propagated to the helm charts as well. 
+
+
+## Changing the agent components access levels
+These are maintained manually in [dataplane_roles.yaml](../config/rbac/dataplane/dataplane_roles.yaml) and [the helm equivalent](../charts/cbcontainers-operator/cbcontainers-operator-chart/templates/dataplane_rbac.yaml). 
+Same goes for the service accounts and role bindings. Changes should be applied in both places.
+
+The roles should follow the least-privilege principle, same as the operator. Note that the agent components often need _more_ permissions than the operator to work as expected.
\ No newline at end of file
diff --git a/main.go b/main.go
index 4c44a08c..b5a727ca 100644
--- a/main.go
+++ b/main.go
@@ -23,10 +23,13 @@ import (
 	"github.com/vmware/cbcontainers-operator/cbcontainers/state"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/state/agent_applyment"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/state/applyment"
+	"github.com/vmware/cbcontainers-operator/cbcontainers/state/common"
 	"github.com/vmware/cbcontainers-operator/cbcontainers/state/operator"
+	"go.uber.org/zap/zapcore"
 	"os"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 
 	coreV1 "k8s.io/api/core/v1"
 
@@ -72,12 +75,21 @@ func main() {
 			"Enabling this will ensure there is only one active controller manager.")
 	opts := zap.Options{
 		Development: true,
+		TimeEncoder: zapcore.RFC3339TimeEncoder,
 	}
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
 
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
+	setupLog.Info("Getting the namespace where operator is running and which should host the agent")
+	operatorNamespace := os.Getenv("OPERATOR_NAMESPACE")
+	if operatorNamespace == "" {
+		setupLog.Info(fmt.Sprintf("Operator namespace variable was not found. Falling back to default %s", common.DataPlaneNamespaceName))
+		operatorNamespace = common.DataPlaneNamespaceName
+	}
+	setupLog.Info(fmt.Sprintf("Operator and agent namespace: %s", operatorNamespace))
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                 scheme,
 		MetricsBindAddress:     metricsAddr,
@@ -86,31 +98,14 @@ func main() {
 		LeaderElection:         enableLeaderElection,
 		LeaderElectionID:       "d27fd235.operator.containers.carbonblack.io",
 		Logger:                 ctrl.Log,
+		Namespace:              operatorNamespace,
 	})
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")
 		os.Exit(1)
 	}
 
-	setupLog.Info(fmt.Sprintf("Getting Cluster Identifier: %v uid", NamespaceIdentifier))
-	namespace := &coreV1.Namespace{}
-	apiReader := mgr.GetAPIReader()
-	if err = apiReader.Get(context.Background(), client.ObjectKey{Namespace: NamespaceIdentifier, Name: NamespaceIdentifier}, namespace); err != nil {
-		setupLog.Error(err, fmt.Sprintf("unable to get the %v namespace", NamespaceIdentifier))
-		os.Exit(1)
-	}
-	clusterIdentifier := string(namespace.UID)
-
-	setupLog.Info(fmt.Sprintf("Cluster Identifier: %v", clusterIdentifier))
-
-	setupLog.Info("Getting Nodes list")
-	nodesList := &coreV1.NodeList{}
-	if err := apiReader.List(context.Background(), nodesList); err != nil || nodesList.Items == nil || len(nodesList.Items) < 1 {
-		setupLog.Error(err, "couldn't get nodes list")
-		os.Exit(1)
-	}
-	k8sVersion := nodesList.Items[0].Status.NodeInfo.KubeletVersion
-	setupLog.Info(fmt.Sprintf("K8s version is: %v", k8sVersion))
+	clusterIdentifier, k8sVersion := extractConfigurationVariables(mgr)
 
 	cbContainersAgentLogger := ctrl.Log.WithName("controllers").WithName("CBContainersAgent")
 	if err = (&controllers.CBContainersAgentController{
@@ -118,8 +113,9 @@ func main() {
 		Log:              cbContainersAgentLogger,
 		Scheme:           mgr.GetScheme(),
 		K8sVersion:       k8sVersion,
+		Namespace:        operatorNamespace,
 		ClusterProcessor: processors.NewAgentProcessor(cbContainersAgentLogger, processors.NewDefaultGatewayCreator(), operator.NewEnvVersionProvider(), clusterIdentifier),
-		StateApplier:     state.NewStateApplier(mgr.GetAPIReader(), agent_applyment.NewAgentComponent(applyment.NewComponentApplier(mgr.GetClient())), k8sVersion, certificatesUtils.NewCertificateCreator(), cbContainersAgentLogger),
+		StateApplier:     state.NewStateApplier(mgr.GetAPIReader(), agent_applyment.NewAgentComponent(applyment.NewComponentApplier(mgr.GetClient())), k8sVersion, operatorNamespace, certificatesUtils.NewCertificateCreator(), cbContainersAgentLogger),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "CBContainersAgent")
 		os.Exit(1)
@@ -142,3 +138,27 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+func extractConfigurationVariables(mgr manager.Manager) (clusterIdentifier string, k8sVersion string) {
+	setupLog.Info(fmt.Sprintf("Getting Cluster Identifier: %v uid", NamespaceIdentifier))
+	namespace := &coreV1.Namespace{}
+	apiReader := mgr.GetAPIReader()
+	if err := apiReader.Get(context.Background(), client.ObjectKey{Namespace: NamespaceIdentifier, Name: NamespaceIdentifier}, namespace); err != nil {
+		setupLog.Error(err, fmt.Sprintf("unable to get the %v namespace", NamespaceIdentifier))
+		os.Exit(1)
+	}
+	clusterIdentifier = string(namespace.UID)
+
+	setupLog.Info(fmt.Sprintf("Cluster Identifier: %v", clusterIdentifier))
+
+	setupLog.Info("Getting Nodes list")
+	nodesList := &coreV1.NodeList{}
+	if err := apiReader.List(context.Background(), nodesList); err != nil || nodesList.Items == nil || len(nodesList.Items) < 1 {
+		setupLog.Error(err, "couldn't get nodes list")
+		os.Exit(1)
+	}
+	k8sVersion = nodesList.Items[0].Status.NodeInfo.KubeletVersion
+	setupLog.Info(fmt.Sprintf("K8s version is: %v", k8sVersion))
+
+	return
+}