diff --git a/workspaces/backend/api/suite_test.go b/workspaces/backend/api/suite_test.go
index 7ad4e5462..17021c983 100644
--- a/workspaces/backend/api/suite_test.go
+++ b/workspaces/backend/api/suite_test.go
@@ -82,11 +82,11 @@ var _ = BeforeSuite(func() {
 	ctx, cancel = context.WithCancel(context.Background())
 
 	By("bootstrapping test environment")
-	path := filepath.Join("..", "..", "controller", "config", "crd", "bases")
+	path := filepath.Join("..", "..", "controller", "manifests", "kustomize", "base", "crd")
 	fmt.Println(path)
 	testEnv = &envtest.Environment{
 		CRDDirectoryPaths: []string{
-			filepath.Join("..", "..", "controller", "config", "crd", "bases"),
+			filepath.Join("..", "..", "controller", "manifests", "kustomize", "base", "crd"),
 		},
 		ErrorIfCRDPathMissing: true,
 
diff --git a/workspaces/backend/manifests/kustomize/base/kustomization.yaml b/workspaces/backend/manifests/kustomize/base/kustomization.yaml
index 6162f9d3e..793103ae6 100644
--- a/workspaces/backend/manifests/kustomize/base/kustomization.yaml
+++ b/workspaces/backend/manifests/kustomize/base/kustomization.yaml
@@ -13,4 +13,9 @@ resources:
 labels:
 - includeSelectors: true
   pairs:
-    app.kubernetes.io/component: api
\ No newline at end of file
+    app.kubernetes.io/component: api
+
+images:
+- name: workspaces-backend
+  newName: ghcr.io/kubeflow/notebooks/workspaces-backend
+  newTag: latest
diff --git a/workspaces/controller/Makefile b/workspaces/controller/Makefile
index c81a3fa5b..10d320479 100644
--- a/workspaces/controller/Makefile
+++ b/workspaces/controller/Makefile
@@ -49,7 +49,10 @@ help: ## Display this help.
 
 .PHONY: manifests
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
-	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." \
+		output:crd:artifacts:config=manifests/kustomize/base/crd \
+		output:webhook:artifacts:config=manifests/kustomize/base/webhook \
+		output:rbac:artifacts:config=manifests/kustomize/base/manager
 
 .PHONY: generate
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -124,12 +127,6 @@ docker-build-multi-arch:
 docker-build-push-multi-arch:
 	docker buildx build --platform ${ARCH} --tag ${IMG} --push .
 
-.PHONY: build-installer
-build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
-	mkdir -p dist
-	cd config/manager && $(KUSTOMIZE) edit set image workspaces-controller=${IMG}
-	$(KUSTOMIZE) build config/default > dist/install.yaml
-
 ##@ Deployment
 
 ifndef ignore-not-found
@@ -138,20 +135,20 @@ endif
 
 .PHONY: install
 install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
-	$(KUSTOMIZE) build config/crd | $(KUBECTL) apply -f -
+	$(KUSTOMIZE) build manifests/kustomize/base/crd | $(KUBECTL) apply -f -
 
 .PHONY: uninstall
 uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
-	$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
+	$(KUSTOMIZE) build manifests/kustomize/base/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
 
 .PHONY: deploy
 deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
-	cd config/manager && $(KUSTOMIZE) edit set image workspaces-controller=${IMG}
-	$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -
+	cd manifests/kustomize/overlays/istio && $(KUSTOMIZE) edit set image workspaces-controller=${IMG}
+	$(KUBECTL) apply -k manifests/kustomize/overlays/istio
 
 .PHONY: undeploy
 undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
-	$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
+	$(KUBECTL) delete -k manifests/kustomize/overlays/istio --ignore-not-found=$(ignore-not-found)
 
 ##@ Dependencies
 
diff --git a/workspaces/controller/README.md b/workspaces/controller/README.md
index d98e1fc7b..08fd1cfdb 100644
--- a/workspaces/controller/README.md
+++ b/workspaces/controller/README.md
@@ -41,10 +41,10 @@ make deploy IMG=<some-registry>/workspaces-controller:tag
 privileges or be logged in as admin.
 
 **Create instances of your solution**
-You can apply the samples (examples) from the config/sample:
+You can apply the samples (examples) from the manifests/kustomize/samples:
 
 ```sh
-kubectl apply -k config/samples/
+kubectl apply -k manifests/kustomize/samples/
 ```
 
 >**NOTE**: Ensure that the samples has default values to test it out.
@@ -53,7 +53,7 @@ kubectl apply -k config/samples/
 **Delete the instances (CRs) from the cluster:**
 
 ```sh
-kubectl delete -k config/samples/
+kubectl delete -k manifests/kustomize/samples/
 ```
 
 **Delete the APIs(CRDs) from the cluster:**
@@ -67,26 +67,3 @@ make uninstall
 ```sh
 make undeploy
 ```
-
-## Project Distribution
-
-Following are the steps to build the installer and distribute this project to users.
-
-1. Build the installer for the image built and published in the registry:
-
-```sh
-make build-installer IMG=<some-registry>/workspaces-controller:tag
-```
-
-NOTE: The makefile target mentioned above generates an 'install.yaml'
-file in the dist directory. This file contains all the resources built
-with Kustomize, which are necessary to install this project without
-its dependencies.
-
-2. Using the installer
-
-Users can just run kubectl apply -f <URL for YAML BUNDLE> to install the project, i.e.:
-
-```sh
-kubectl apply -f https://raw.githubusercontent.com/<org>/workspaces-controller/<tag or branch>/dist/install.yaml
-```
diff --git a/workspaces/controller/config/certmanager/kustomization.yaml b/workspaces/controller/config/certmanager/kustomization.yaml
deleted file mode 100644
index 7cfada1f5..000000000
--- a/workspaces/controller/config/certmanager/kustomization.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-labels:
-- pairs:
-    app.kubernetes.io/component: webhook
-
-resources:
-- certificate.yaml
-
-configurations:
-- kustomizeconfig.yaml
diff --git a/workspaces/controller/config/default/kustomization.yaml b/workspaces/controller/config/default/kustomization.yaml
deleted file mode 100644
index 3a29effb6..000000000
--- a/workspaces/controller/config/default/kustomization.yaml
+++ /dev/null
@@ -1,121 +0,0 @@
-# Adds namespace to all resources.
-namespace: kubeflow-workspaces
-
-resources:
-- ../crd
-- ../rbac
-- ../manager
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
-# crd/kustomization.yaml
-- ../webhook
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
-- ../certmanager
-# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
-#- ../prometheus
-
-components:
-- components/common
-- components/istio
-
-patches:
-# [METRICS] The following patch will enable the metrics endpoint. Ensure that you also protect this endpoint.
-# More info: https://book.kubebuilder.io/reference/metrics
-# If you want to expose the metric endpoint of your controller-manager uncomment the following line.
-#- path: manager_metrics_patch.yaml
-
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
-# crd/kustomization.yaml
-- path: manager_webhook_patch.yaml
-
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
-# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
-# 'CERTMANAGER' needs to be enabled to use ca injection
-- path: webhookcainjection_patch.yaml
-
-# [ISTIO] Enable Istion injection on the kubeflow-workspaces namespace but disable it for the controller deployment
-# to prevent webhook issues
-- path: istio_inject_patch.yaml
-
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
-# Uncomment the following replacements to add the cert-manager CA injection annotations
-replacements:
-  - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
-      kind: Certificate
-      group: cert-manager.io
-      version: v1
-      name: serving-cert # this name should match the one in certificate.yaml
-      fieldPath: .metadata.namespace # namespace of the certificate CR
-    targets:
-      - select:
-          kind: ValidatingWebhookConfiguration
-        fieldPaths:
-          - .metadata.annotations.[cert-manager.io/inject-ca-from]
-        options:
-          delimiter: '/'
-          index: 0
-          create: true
-      - select:
-          kind: CustomResourceDefinition
-        fieldPaths:
-          - .metadata.annotations.[cert-manager.io/inject-ca-from]
-        options:
-          delimiter: '/'
-          index: 0
-          create: true
-  - source:
-      kind: Certificate
-      group: cert-manager.io
-      version: v1
-      name: serving-cert # this name should match the one in certificate.yaml
-      fieldPath: .metadata.name
-    targets:
-      - select:
-          kind: ValidatingWebhookConfiguration
-        fieldPaths:
-          - .metadata.annotations.[cert-manager.io/inject-ca-from]
-        options:
-          delimiter: '/'
-          index: 1
-          create: true
-      - select:
-          kind: CustomResourceDefinition
-        fieldPaths:
-          - .metadata.annotations.[cert-manager.io/inject-ca-from]
-        options:
-          delimiter: '/'
-          index: 1
-          create: true
-  - source: # Add cert-manager annotation to the webhook Service
-      kind: Service
-      version: v1
-      name: webhook-service
-      fieldPath: .metadata.name # namespace of the service
-    targets:
-      - select:
-          kind: Certificate
-          group: cert-manager.io
-          version: v1
-        fieldPaths:
-          - .spec.dnsNames.0
-          - .spec.dnsNames.1
-        options:
-          delimiter: '.'
-          index: 0
-          create: true
-  - source:
-      kind: Service
-      version: v1
-      name: webhook-service
-      fieldPath: .metadata.namespace # namespace of the service
-    targets:
-      - select:
-          kind: Certificate
-          group: cert-manager.io
-          version: v1
-        fieldPaths:
-          - .spec.dnsNames.0
-          - .spec.dnsNames.1
-        options:
-          delimiter: '.'
-          index: 1
-          create: true
diff --git a/workspaces/controller/config/default/manager_config_patch.yaml b/workspaces/controller/config/default/manager_config_patch.yaml
deleted file mode 100644
index 71a1a0db0..000000000
--- a/workspaces/controller/config/default/manager_config_patch.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: workspaces-controller
-spec:
-  template:
-    spec:
-      containers:
-      - name: manager
diff --git a/workspaces/controller/config/default/webhookcainjection_patch.yaml b/workspaces/controller/config/default/webhookcainjection_patch.yaml
deleted file mode 100644
index 5403ad05e..000000000
--- a/workspaces/controller/config/default/webhookcainjection_patch.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-# This patch add annotation to admission webhook config and
-# CERTIFICATE_NAMESPACE and CERTIFICATE_NAME will be substituted by kustomize
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  labels:
-    app.kubernetes.io/instance: validating-webhook-configuration
-  name: validating-webhook-configuration
-  annotations:
-    cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
diff --git a/workspaces/controller/config/prometheus/kustomization.yaml b/workspaces/controller/config/prometheus/kustomization.yaml
deleted file mode 100644
index 614884a96..000000000
--- a/workspaces/controller/config/prometheus/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-resources:
-- monitor.yaml
-
-labels:
-- pairs:
-    app.kubernetes.io/component: metrics
diff --git a/workspaces/controller/config/rbac/kustomization.yaml b/workspaces/controller/config/rbac/kustomization.yaml
deleted file mode 100644
index b5f0bf15f..000000000
--- a/workspaces/controller/config/rbac/kustomization.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-labels:
-- pairs:
-    app.kubernetes.io/component: controller-manager
-
-resources:
-# All RBAC will be applied under this service account in
-# the deployment namespace. You may comment out this resource
-# if your manager will use a service account that exists at
-# runtime. Be sure to update RoleBinding and ClusterRoleBinding
-# subjects if changing service account names.
-- service_account.yaml
-- role.yaml
-- role_binding.yaml
-- leader_election_role.yaml
-- leader_election_role_binding.yaml
-- metrics_service.yaml
-# For each CRD, "Editor" and "Viewer" roles are scaffolded by
-# default, aiding admins in cluster management. Those roles are
-# not used by the Project itself. You can comment the following lines
-# if you do not want those helpers be installed with your Project.
-- workspacekind_editor_role.yaml
-- workspacekind_viewer_role.yaml
-- workspace_editor_role.yaml
-- workspace_viewer_role.yaml
-
diff --git a/workspaces/controller/config/rbac/workspace_editor_role.yaml b/workspaces/controller/config/rbac/workspace_editor_role.yaml
deleted file mode 100644
index 8915c201e..000000000
--- a/workspaces/controller/config/rbac/workspace_editor_role.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# permissions for end users to edit workspaces.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: workspace-editor-role
-rules:
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspaces
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspaces/status
-  verbs:
-  - get
diff --git a/workspaces/controller/config/rbac/workspace_viewer_role.yaml b/workspaces/controller/config/rbac/workspace_viewer_role.yaml
deleted file mode 100644
index 6a1b5b9a7..000000000
--- a/workspaces/controller/config/rbac/workspace_viewer_role.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# permissions for end users to view workspaces.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: workspace-viewer-role
-rules:
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspaces
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspaces/status
-  verbs:
-  - get
diff --git a/workspaces/controller/config/rbac/workspacekind_editor_role.yaml b/workspaces/controller/config/rbac/workspacekind_editor_role.yaml
deleted file mode 100644
index 685626c2d..000000000
--- a/workspaces/controller/config/rbac/workspacekind_editor_role.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# permissions for end users to edit workspacekinds.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: workspacekind-editor-role
-rules:
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspacekinds
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspacekinds/status
-  verbs:
-  - get
diff --git a/workspaces/controller/config/rbac/workspacekind_viewer_role.yaml b/workspaces/controller/config/rbac/workspacekind_viewer_role.yaml
deleted file mode 100644
index ce3095b59..000000000
--- a/workspaces/controller/config/rbac/workspacekind_viewer_role.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# permissions for end users to view workspacekinds.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: workspacekind-viewer-role
-rules:
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspacekinds
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - kubeflow.org
-  resources:
-  - workspacekinds/status
-  verbs:
-  - get
diff --git a/workspaces/controller/config/samples/kustomization.yaml b/workspaces/controller/config/samples/kustomization.yaml
deleted file mode 100644
index 016ab77d5..000000000
--- a/workspaces/controller/config/samples/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./common
-- jupyterlab_v1beta1_workspace.yaml
-- jupyterlab_v1beta1_workspacekind.yaml
\ No newline at end of file
diff --git a/workspaces/controller/config/webhook/kustomization.yaml b/workspaces/controller/config/webhook/kustomization.yaml
deleted file mode 100644
index e0bbf32bc..000000000
--- a/workspaces/controller/config/webhook/kustomization.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-labels:
-- pairs:
-    app.kubernetes.io/component: webhook
-
-resources:
-- manifests.yaml
-- service.yaml
-
-configurations:
-- kustomizeconfig.yaml
diff --git a/workspaces/controller/internal/controller/suite_test.go b/workspaces/controller/internal/controller/suite_test.go
index fb441513d..f553e89ac 100644
--- a/workspaces/controller/internal/controller/suite_test.go
+++ b/workspaces/controller/internal/controller/suite_test.go
@@ -74,7 +74,7 @@ var _ = BeforeSuite(func() {
 
 	By("bootstrapping test environment")
 	testEnv = &envtest.Environment{
-		CRDDirectoryPaths:     []string{filepath.Join("..", "..", "config", "crd", "bases")},
+		CRDDirectoryPaths:     []string{filepath.Join("..", "..", "manifests", "kustomize", "base", "crd")},
 		ErrorIfCRDPathMissing: true,
 
 		// The BinaryAssetsDirectory is only required if you want to run the tests directly without call the makefile target test.
diff --git a/workspaces/controller/internal/controller/workspacekind_controller.go b/workspaces/controller/internal/controller/workspacekind_controller.go
index 426d87d99..2eedd23da 100644
--- a/workspaces/controller/internal/controller/workspacekind_controller.go
+++ b/workspaces/controller/internal/controller/workspacekind_controller.go
@@ -48,7 +48,7 @@ type WorkspaceKindReconciler struct {
 	Scheme *runtime.Scheme
 }
 
-// +kubebuilder:rbac:groups=kubeflow.org,resources=workspacekinds,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=kubeflow.org,resources=workspacekinds,verbs=create;delete;get;list;patch;update;watch
 // +kubebuilder:rbac:groups=kubeflow.org,resources=workspacekinds/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=kubeflow.org,resources=workspacekinds/finalizers,verbs=update
 // +kubebuilder:rbac:groups=kubeflow.org,resources=workspaces,verbs=get;list;watch
diff --git a/workspaces/controller/internal/webhook/suite_test.go b/workspaces/controller/internal/webhook/suite_test.go
index 8c0302cb6..46a07772a 100644
--- a/workspaces/controller/internal/webhook/suite_test.go
+++ b/workspaces/controller/internal/webhook/suite_test.go
@@ -77,7 +77,7 @@ var _ = BeforeSuite(func() {
 
 	By("bootstrapping test environment")
 	testEnv = &envtest.Environment{
-		CRDDirectoryPaths:     []string{filepath.Join("..", "..", "config", "crd", "bases")},
+		CRDDirectoryPaths:     []string{filepath.Join("..", "..", "manifests", "kustomize", "base", "crd")},
 		ErrorIfCRDPathMissing: true,
 
 		// The BinaryAssetsDirectory is only required if you want to run the tests directly without call the makefile target test.
@@ -87,7 +87,7 @@ var _ = BeforeSuite(func() {
 		BinaryAssetsDirectory: filepath.Join("..", "..", "bin", "k8s", fmt.Sprintf("1.31.0-%s-%s", runtime.GOOS, runtime.GOARCH)),
 
 		WebhookInstallOptions: envtest.WebhookInstallOptions{
-			Paths: []string{filepath.Join("..", "..", "config", "webhook")},
+			Paths: []string{filepath.Join("..", "..", "manifests", "kustomize", "base", "webhook", "manifests.yaml")},
 		},
 	}
 	var err error
diff --git a/workspaces/controller/config/crd/bases/kubeflow.org_workspacekinds.yaml b/workspaces/controller/manifests/kustomize/base/crd/kubeflow.org_workspacekinds.yaml
similarity index 100%
rename from workspaces/controller/config/crd/bases/kubeflow.org_workspacekinds.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/kubeflow.org_workspacekinds.yaml
diff --git a/workspaces/controller/config/crd/bases/kubeflow.org_workspaces.yaml b/workspaces/controller/manifests/kustomize/base/crd/kubeflow.org_workspaces.yaml
similarity index 100%
rename from workspaces/controller/config/crd/bases/kubeflow.org_workspaces.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/kubeflow.org_workspaces.yaml
diff --git a/workspaces/controller/config/crd/kustomization.yaml b/workspaces/controller/manifests/kustomize/base/crd/kustomization.yaml
similarity index 64%
rename from workspaces/controller/config/crd/kustomization.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/kustomization.yaml
index 642e76564..68dc2d6c2 100644
--- a/workspaces/controller/config/crd/kustomization.yaml
+++ b/workspaces/controller/manifests/kustomize/base/crd/kustomization.yaml
@@ -1,24 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
 # This kustomization.yaml is not intended to be run by itself,
 # since it depends on service name and namespace that are out of this kustomize package.
-# It should be run by config/default
+# It should be run by manifests/kustomize/base
 resources:
-- bases/kubeflow.org_workspaces.yaml
-- bases/kubeflow.org_workspacekinds.yaml
+- kubeflow.org_workspaces.yaml
+- kubeflow.org_workspacekinds.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 patches:
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
 # patches here are for enabling the conversion webhook for each CRD
+#- path: workspaces_webhook_patch.yaml
+#- path: workspacekinds_webhook_patch.yaml
 #+kubebuilder:scaffold:crdkustomizewebhookpatch
 
 # [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
 # patches here are for enabling the CA injection for each CRD
-- path: patches/cainjection_in_workspaces.yaml
-- path: patches/cainjection_in_workspacekinds.yaml
+- path: workspaces_cainjection_patch.yaml
+- path: workspacekinds_cainjection_patch.yaml
 #+kubebuilder:scaffold:crdkustomizecainjectionpatch
 
-# [WEBHOOK] To enable webhook, uncomment the following section
-# the following config is for teaching kustomize how to do kustomization for CRDs.
-
 configurations:
 - kustomizeconfig.yaml
diff --git a/workspaces/controller/config/crd/kustomizeconfig.yaml b/workspaces/controller/manifests/kustomize/base/crd/kustomizeconfig.yaml
similarity index 100%
rename from workspaces/controller/config/crd/kustomizeconfig.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/kustomizeconfig.yaml
diff --git a/workspaces/controller/config/crd/patches/cainjection_in_workspacekinds.yaml b/workspaces/controller/manifests/kustomize/base/crd/workspacekinds_cainjection_patch.yaml
similarity index 100%
rename from workspaces/controller/config/crd/patches/cainjection_in_workspacekinds.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/workspacekinds_cainjection_patch.yaml
diff --git a/workspaces/controller/config/crd/patches/webhook_in_workspacekinds.yaml b/workspaces/controller/manifests/kustomize/base/crd/workspacekinds_webhook_patch.yaml
similarity index 100%
rename from workspaces/controller/config/crd/patches/webhook_in_workspacekinds.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/workspacekinds_webhook_patch.yaml
diff --git a/workspaces/controller/config/crd/patches/cainjection_in_workspaces.yaml b/workspaces/controller/manifests/kustomize/base/crd/workspaces_cainjection_patch.yaml
similarity index 100%
rename from workspaces/controller/config/crd/patches/cainjection_in_workspaces.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/workspaces_cainjection_patch.yaml
diff --git a/workspaces/controller/config/crd/patches/webhook_in_workspaces.yaml b/workspaces/controller/manifests/kustomize/base/crd/workspaces_webhook_patch.yaml
similarity index 100%
rename from workspaces/controller/config/crd/patches/webhook_in_workspaces.yaml
rename to workspaces/controller/manifests/kustomize/base/crd/workspaces_webhook_patch.yaml
diff --git a/workspaces/controller/manifests/kustomize/base/kustomization.yaml b/workspaces/controller/manifests/kustomize/base/kustomization.yaml
new file mode 100644
index 000000000..464f72993
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/base/kustomization.yaml
@@ -0,0 +1,29 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Adds namespace to all resources.
+namespace: kubeflow-workspaces
+
+resources:
+- crd
+- manager
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+- webhook
+
+
+# [WEBHOOK] Replacements to keep webhook-service name in sync for CRD conversion webhooks
+# Uncomment when CRD conversion webhook patches are enabled in crd/kustomization.yaml
+#replacements:
+#  - source:
+#      kind: Service
+#      version: v1
+#      name: webhook-service
+#      fieldPath: .metadata.name
+#    targets:
+#    - select:
+#        kind: CustomResourceDefinition
+#      fieldPaths:
+#      - .spec.conversion.webhook.clientConfig.service.name
+#      options:
+#        create: false
diff --git a/workspaces/controller/config/manager/kustomization.yaml b/workspaces/controller/manifests/kustomize/base/manager/kustomization.yaml
similarity index 64%
rename from workspaces/controller/config/manager/kustomization.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/kustomization.yaml
index ea39fc1f5..582347253 100644
--- a/workspaces/controller/config/manager/kustomization.yaml
+++ b/workspaces/controller/manifests/kustomize/base/manager/kustomization.yaml
@@ -1,7 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+
 resources:
+- leader_election_role.yaml
+- leader_election_role_binding.yaml
 - manager.yaml
+- namespace.yaml
+- role.yaml
+- role_binding.yaml
+- service_account.yaml
+- user_cluster_roles.yaml
 
 labels:
 - includeSelectors: true
diff --git a/workspaces/controller/config/rbac/leader_election_role.yaml b/workspaces/controller/manifests/kustomize/base/manager/leader_election_role.yaml
similarity index 100%
rename from workspaces/controller/config/rbac/leader_election_role.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/leader_election_role.yaml
diff --git a/workspaces/controller/config/rbac/leader_election_role_binding.yaml b/workspaces/controller/manifests/kustomize/base/manager/leader_election_role_binding.yaml
similarity index 100%
rename from workspaces/controller/config/rbac/leader_election_role_binding.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/leader_election_role_binding.yaml
diff --git a/workspaces/controller/config/manager/manager.yaml b/workspaces/controller/manifests/kustomize/base/manager/manager.yaml
similarity index 97%
rename from workspaces/controller/config/manager/manager.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/manager.yaml
index 0452b6131..7b365c905 100644
--- a/workspaces/controller/config/manager/manager.yaml
+++ b/workspaces/controller/manifests/kustomize/base/manager/manager.yaml
@@ -1,8 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kubeflow-workspaces
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/workspaces/controller/config/webhook/manifests.yaml b/workspaces/controller/manifests/kustomize/base/manager/manifests.yaml
similarity index 100%
rename from workspaces/controller/config/webhook/manifests.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/manifests.yaml
diff --git a/workspaces/controller/manifests/kustomize/base/manager/namespace.yaml b/workspaces/controller/manifests/kustomize/base/manager/namespace.yaml
new file mode 100644
index 000000000..444d2a577
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/base/manager/namespace.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubeflow-workspaces
+
diff --git a/workspaces/controller/config/rbac/role.yaml b/workspaces/controller/manifests/kustomize/base/manager/role.yaml
similarity index 100%
rename from workspaces/controller/config/rbac/role.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/role.yaml
diff --git a/workspaces/controller/config/rbac/role_binding.yaml b/workspaces/controller/manifests/kustomize/base/manager/role_binding.yaml
similarity index 100%
rename from workspaces/controller/config/rbac/role_binding.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/role_binding.yaml
diff --git a/workspaces/controller/config/webhook/service.yaml b/workspaces/controller/manifests/kustomize/base/manager/service.yaml
similarity index 100%
rename from workspaces/controller/config/webhook/service.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/service.yaml
diff --git a/workspaces/controller/config/rbac/service_account.yaml b/workspaces/controller/manifests/kustomize/base/manager/service_account.yaml
similarity index 100%
rename from workspaces/controller/config/rbac/service_account.yaml
rename to workspaces/controller/manifests/kustomize/base/manager/service_account.yaml
diff --git a/workspaces/controller/manifests/kustomize/base/manager/user_cluster_roles.yaml b/workspaces/controller/manifests/kustomize/base/manager/user_cluster_roles.yaml
new file mode 100644
index 000000000..7eb237706
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/base/manager/user_cluster_roles.yaml
@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubeflow-workspaces-admin
+  labels:
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.authorization.kubeflow.org/aggregate-to-kubeflow-workspaces-admin: "true"
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubeflow-workspaces-edit
+  labels:
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-workspaces-admin: "true"
+rules:
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - workspaces
+  - workspaces/status
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - deletecollection
+  - patch
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubeflow-workspaces-view
+  labels:
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true"
+rules:
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - workspaces
+  - workspaces/status
+  verbs:
+  - get
+  - list
+  - watch
\ No newline at end of file
diff --git a/workspaces/controller/manifests/kustomize/base/webhook/kustomization.yaml b/workspaces/controller/manifests/kustomize/base/webhook/kustomization.yaml
new file mode 100644
index 000000000..4991d70ba
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/base/webhook/kustomization.yaml
@@ -0,0 +1,37 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+labels:
+- pairs:
+    app.kubernetes.io/component: webhook
+
+resources:
+- manifests.yaml
+- service.yaml
+
+configurations:
+- kustomizeconfig.yaml
+
+replacements:
+- source:
+    kind: ValidatingWebhookConfiguration
+    fieldPath: .metadata.name
+  targets:
+  - select:
+      kind: ValidatingWebhookConfiguration
+    fieldPaths:
+    - .metadata.labels.[app.kubernetes.io/instance]
+    options:
+      create: true
+- source:
+    kind: Service
+    version: v1
+    name: webhook-service
+    fieldPath: .metadata.name
+  targets:
+  - select:
+      kind: ValidatingWebhookConfiguration
+    fieldPaths:
+    - .webhooks.*.clientConfig.service.name
+    options:
+      create: false
diff --git a/workspaces/controller/config/webhook/kustomizeconfig.yaml b/workspaces/controller/manifests/kustomize/base/webhook/kustomizeconfig.yaml
similarity index 100%
rename from workspaces/controller/config/webhook/kustomizeconfig.yaml
rename to workspaces/controller/manifests/kustomize/base/webhook/kustomizeconfig.yaml
diff --git a/workspaces/controller/manifests/kustomize/base/webhook/manifests.yaml b/workspaces/controller/manifests/kustomize/base/webhook/manifests.yaml
new file mode 100644
index 000000000..d757a5976
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/base/webhook/manifests.yaml
@@ -0,0 +1,47 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-kubeflow-org-v1beta1-workspace
+  failurePolicy: Fail
+  name: vworkspace.kb.io
+  rules:
+  - apiGroups:
+    - kubeflow.org
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - workspaces
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-kubeflow-org-v1beta1-workspacekind
+  failurePolicy: Fail
+  name: vworkspacekind.kb.io
+  rules:
+  - apiGroups:
+    - kubeflow.org
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    - DELETE
+    resources:
+    - workspacekinds
+  sideEffects: None
diff --git a/workspaces/controller/manifests/kustomize/base/webhook/service.yaml b/workspaces/controller/manifests/kustomize/base/webhook/service.yaml
new file mode 100644
index 000000000..22427aff6
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/base/webhook/service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-service
+spec:
+  ports:
+    - name: webhook
+      port: 443
+      protocol: TCP
+      targetPort: 9443
+  selector:
+    app.kubernetes.io/component: controller-manager
diff --git a/workspaces/controller/config/certmanager/certificate.yaml b/workspaces/controller/manifests/kustomize/components/certmanager/certificate.yaml
similarity index 92%
rename from workspaces/controller/config/certmanager/certificate.yaml
rename to workspaces/controller/manifests/kustomize/components/certmanager/certificate.yaml
index 75e2fb171..67248600c 100644
--- a/workspaces/controller/config/certmanager/certificate.yaml
+++ b/workspaces/controller/manifests/kustomize/components/certmanager/certificate.yaml
@@ -5,6 +5,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   labels:
+    app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: serving-cert
   name: selfsigned-issuer
 spec:
@@ -14,6 +15,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   labels:
+    app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: serving-cert
   name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml
 spec:
diff --git a/workspaces/controller/manifests/kustomize/components/certmanager/kustomization.yaml b/workspaces/controller/manifests/kustomize/components/certmanager/kustomization.yaml
new file mode 100644
index 000000000..b35483302
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/components/certmanager/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- certificate.yaml
+
+patches:
+- path: manager_webhook_patch.yaml
+
+configurations:
+- kustomizeconfig.yaml
diff --git a/workspaces/controller/config/certmanager/kustomizeconfig.yaml b/workspaces/controller/manifests/kustomize/components/certmanager/kustomizeconfig.yaml
similarity index 100%
rename from workspaces/controller/config/certmanager/kustomizeconfig.yaml
rename to workspaces/controller/manifests/kustomize/components/certmanager/kustomizeconfig.yaml
diff --git a/workspaces/controller/config/default/manager_webhook_patch.yaml b/workspaces/controller/manifests/kustomize/components/certmanager/manager_webhook_patch.yaml
similarity index 99%
rename from workspaces/controller/config/default/manager_webhook_patch.yaml
rename to workspaces/controller/manifests/kustomize/components/certmanager/manager_webhook_patch.yaml
index abfb290d2..f83faa7ca 100644
--- a/workspaces/controller/config/default/manager_webhook_patch.yaml
+++ b/workspaces/controller/manifests/kustomize/components/certmanager/manager_webhook_patch.yaml
@@ -20,3 +20,4 @@ spec:
         secret:
           defaultMode: 420
           secretName: webhook-server-cert
+
diff --git a/workspaces/controller/config/default/components/common/kustomization.yaml b/workspaces/controller/manifests/kustomize/components/common/kustomization.yaml
similarity index 100%
rename from workspaces/controller/config/default/components/common/kustomization.yaml
rename to workspaces/controller/manifests/kustomize/components/common/kustomization.yaml
diff --git a/workspaces/controller/config/default/istio_inject_patch.yaml b/workspaces/controller/manifests/kustomize/components/istio/istio_inject_patch.yaml
similarity index 79%
rename from workspaces/controller/config/default/istio_inject_patch.yaml
rename to workspaces/controller/manifests/kustomize/components/istio/istio_inject_patch.yaml
index 4850acf87..cb7f205f4 100644
--- a/workspaces/controller/config/default/istio_inject_patch.yaml
+++ b/workspaces/controller/manifests/kustomize/components/istio/istio_inject_patch.yaml
@@ -1,12 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kubeflow-workspaces
-  labels:
-    istio-injection: enabled
-    app.kubernetes.io/component: null
-    app.kubernetes.io/name: null
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,3 +7,10 @@ spec:
     metadata:
       annotations:
         sidecar.istio.io/inject: "false"
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubeflow-workspaces
+  labels:
+    istio-injection: enabled
diff --git a/workspaces/controller/config/default/components/istio/kustomization.yaml b/workspaces/controller/manifests/kustomize/components/istio/kustomization.yaml
similarity index 85%
rename from workspaces/controller/config/default/components/istio/kustomization.yaml
rename to workspaces/controller/manifests/kustomize/components/istio/kustomization.yaml
index 4c34c605b..10cd29572 100644
--- a/workspaces/controller/config/default/components/istio/kustomization.yaml
+++ b/workspaces/controller/manifests/kustomize/components/istio/kustomization.yaml
@@ -8,3 +8,4 @@ configMapGenerator:
 
 patches:
 - path: manager_istio_patch.yaml
+- path: istio_inject_patch.yaml
diff --git a/workspaces/controller/config/default/components/istio/manager_istio_patch.yaml b/workspaces/controller/manifests/kustomize/components/istio/manager_istio_patch.yaml
similarity index 100%
rename from workspaces/controller/config/default/components/istio/manager_istio_patch.yaml
rename to workspaces/controller/manifests/kustomize/components/istio/manager_istio_patch.yaml
diff --git a/workspaces/controller/config/default/components/istio/params.env b/workspaces/controller/manifests/kustomize/components/istio/params.env
similarity index 100%
rename from workspaces/controller/config/default/components/istio/params.env
rename to workspaces/controller/manifests/kustomize/components/istio/params.env
diff --git a/workspaces/controller/manifests/kustomize/components/prometheus/kustomization.yaml b/workspaces/controller/manifests/kustomize/components/prometheus/kustomization.yaml
new file mode 100644
index 000000000..23f09ae97
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/components/prometheus/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- metrics_service.yaml
+- monitor.yaml
+
+patches:
+# This patch enables the metrics endpoint on the controller manager
+# which is required for the ServiceMonitor to scrape metrics
+- path: manager_metrics_patch.yaml
diff --git a/workspaces/controller/config/default/manager_metrics_patch.yaml b/workspaces/controller/manifests/kustomize/components/prometheus/manager_metrics_patch.yaml
similarity index 100%
rename from workspaces/controller/config/default/manager_metrics_patch.yaml
rename to workspaces/controller/manifests/kustomize/components/prometheus/manager_metrics_patch.yaml
diff --git a/workspaces/controller/config/rbac/metrics_service.yaml b/workspaces/controller/manifests/kustomize/components/prometheus/metrics_service.yaml
similarity index 82%
rename from workspaces/controller/config/rbac/metrics_service.yaml
rename to workspaces/controller/manifests/kustomize/components/prometheus/metrics_service.yaml
index fcfe0bda3..c564d4dd5 100644
--- a/workspaces/controller/config/rbac/metrics_service.yaml
+++ b/workspaces/controller/manifests/kustomize/components/prometheus/metrics_service.yaml
@@ -1,6 +1,8 @@
 apiVersion: v1
 kind: Service
 metadata:
+  labels:
+    app.kubernetes.io/component: metrics
   name: workspaces-controller-metrics-service
 spec:
   ports:
diff --git a/workspaces/controller/config/prometheus/monitor.yaml b/workspaces/controller/manifests/kustomize/components/prometheus/monitor.yaml
similarity index 88%
rename from workspaces/controller/config/prometheus/monitor.yaml
rename to workspaces/controller/manifests/kustomize/components/prometheus/monitor.yaml
index fa6a4dd5d..577d94e3c 100644
--- a/workspaces/controller/config/prometheus/monitor.yaml
+++ b/workspaces/controller/manifests/kustomize/components/prometheus/monitor.yaml
@@ -2,6 +2,8 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
+  labels:
+    app.kubernetes.io/component: metrics
   name: workspaces-controller-metrics-monitor
 spec:
   endpoints:
diff --git a/workspaces/controller/manifests/kustomize/overlays/istio/kustomization.yaml b/workspaces/controller/manifests/kustomize/overlays/istio/kustomization.yaml
new file mode 100644
index 000000000..a592571ae
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/overlays/istio/kustomization.yaml
@@ -0,0 +1,130 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kubeflow-workspaces
+
+resources:
+- ../../base
+
+components:
+- ../../components/certmanager
+- ../../components/istio
+- ../../components/common
+#- ../../components/prometheus
+
+patches:
+- patch: |-
+    - op: remove
+      path: /metadata/labels/app.kubernetes.io~1component
+    - op: remove
+      path: /metadata/labels/app.kubernetes.io~1name
+  target:
+    kind: Namespace
+    name: kubeflow-workspaces
+
+# [CERTMANAGER] Cert-manager replacements for CA injection annotations
+# These replacements need to be in the overlay because they reference resources
+# that have namespaces applied by the parent kustomization
+replacements:
+- source:
+    fieldPath: .metadata.namespace
+    group: cert-manager.io
+    kind: Certificate
+    name: serving-cert
+    version: v1
+  targets:
+  - fieldPaths:
+    - .metadata.annotations.[cert-manager.io/inject-ca-from]
+    options:
+      create: true
+      delimiter: /
+    select:
+      kind: ValidatingWebhookConfiguration
+  - fieldPaths:
+    - .metadata.annotations.[cert-manager.io/inject-ca-from]
+    options:
+      create: true
+      delimiter: /
+    select:
+      kind: CustomResourceDefinition
+- source:
+    fieldPath: .metadata.name
+    group: cert-manager.io
+    kind: Certificate
+    name: serving-cert
+    version: v1
+  targets:
+  - fieldPaths:
+    - .metadata.annotations.[cert-manager.io/inject-ca-from]
+    options:
+      create: true
+      delimiter: /
+      index: 1
+    select:
+      kind: ValidatingWebhookConfiguration
+  - fieldPaths:
+    - .metadata.annotations.[cert-manager.io/inject-ca-from]
+    options:
+      create: true
+      delimiter: /
+      index: 1
+    select:
+      kind: CustomResourceDefinition
+- source:
+    fieldPath: .metadata.name
+    kind: Service
+    name: webhook-service
+    version: v1
+  targets:
+  - fieldPaths:
+    - .spec.dnsNames.0
+    - .spec.dnsNames.1
+    options:
+      create: true
+      delimiter: .
+    select:
+      group: cert-manager.io
+      kind: Certificate
+      version: v1
+- source:
+    fieldPath: .metadata.namespace
+    kind: Service
+    name: webhook-service
+    version: v1
+  targets:
+  - fieldPaths:
+    - .spec.dnsNames.0
+    - .spec.dnsNames.1
+    options:
+      create: true
+      delimiter: .
+      index: 1
+    select:
+      group: cert-manager.io
+      kind: Certificate
+      version: v1
+- source:
+    fieldPath: .spec.secretName
+    group: cert-manager.io
+    kind: Certificate
+    name: serving-cert
+    version: v1
+  targets:
+  - fieldPaths:
+    - .spec.template.spec.volumes.[name=cert].secret.secretName
+    options: {}
+    select:
+      kind: Deployment
+      name: workspaces-controller
+- source:
+    fieldPath: .spec.ports.[name=webhook].targetPort
+    kind: Service
+    name: webhook-service
+    version: v1
+  targets:
+  - fieldPaths:
+    - .spec.template.spec.containers.[name=manager].ports.[name=webhook-server].containerPort
+    options: {}
+    select:
+      kind: Deployment
+      name: workspaces-controller
diff --git a/workspaces/controller/config/samples/common/kustomization.yaml b/workspaces/controller/manifests/kustomize/samples/common/kustomization.yaml
similarity index 64%
rename from workspaces/controller/config/samples/common/kustomization.yaml
rename to workspaces/controller/manifests/kustomize/samples/common/kustomization.yaml
index 376fa3448..3c4e669e8 100644
--- a/workspaces/controller/config/samples/common/kustomization.yaml
+++ b/workspaces/controller/manifests/kustomize/samples/common/kustomization.yaml
@@ -1,3 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
 resources:
 - workspace_data_pvc.yaml
 - workspace_home_pvc.yaml
diff --git a/workspaces/controller/config/samples/common/workspace_data_pvc.yaml b/workspaces/controller/manifests/kustomize/samples/common/workspace_data_pvc.yaml
similarity index 100%
rename from workspaces/controller/config/samples/common/workspace_data_pvc.yaml
rename to workspaces/controller/manifests/kustomize/samples/common/workspace_data_pvc.yaml
diff --git a/workspaces/controller/config/samples/common/workspace_home_pvc.yaml b/workspaces/controller/manifests/kustomize/samples/common/workspace_home_pvc.yaml
similarity index 100%
rename from workspaces/controller/config/samples/common/workspace_home_pvc.yaml
rename to workspaces/controller/manifests/kustomize/samples/common/workspace_home_pvc.yaml
diff --git a/workspaces/controller/config/samples/common/workspace_secret.yaml b/workspaces/controller/manifests/kustomize/samples/common/workspace_secret.yaml
similarity index 100%
rename from workspaces/controller/config/samples/common/workspace_secret.yaml
rename to workspaces/controller/manifests/kustomize/samples/common/workspace_secret.yaml
diff --git a/workspaces/controller/config/samples/common/workspace_service_account.yaml b/workspaces/controller/manifests/kustomize/samples/common/workspace_service_account.yaml
similarity index 100%
rename from workspaces/controller/config/samples/common/workspace_service_account.yaml
rename to workspaces/controller/manifests/kustomize/samples/common/workspace_service_account.yaml
diff --git a/workspaces/controller/config/samples/jupyterlab_v1beta1_workspace.yaml b/workspaces/controller/manifests/kustomize/samples/jupyterlab_v1beta1_workspace.yaml
similarity index 100%
rename from workspaces/controller/config/samples/jupyterlab_v1beta1_workspace.yaml
rename to workspaces/controller/manifests/kustomize/samples/jupyterlab_v1beta1_workspace.yaml
diff --git a/workspaces/controller/config/samples/jupyterlab_v1beta1_workspacekind.yaml b/workspaces/controller/manifests/kustomize/samples/jupyterlab_v1beta1_workspacekind.yaml
similarity index 100%
rename from workspaces/controller/config/samples/jupyterlab_v1beta1_workspacekind.yaml
rename to workspaces/controller/manifests/kustomize/samples/jupyterlab_v1beta1_workspacekind.yaml
diff --git a/workspaces/controller/manifests/kustomize/samples/kustomization.yaml b/workspaces/controller/manifests/kustomize/samples/kustomization.yaml
new file mode 100644
index 000000000..acb0e63ba
--- /dev/null
+++ b/workspaces/controller/manifests/kustomize/samples/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+sortOptions:
+  order: fifo
+
+resources:
+- ./common
+- jupyterlab_v1beta1_workspacekind.yaml
+- jupyterlab_v1beta1_workspace.yaml
\ No newline at end of file
diff --git a/workspaces/controller/test/e2e/e2e_test.go b/workspaces/controller/test/e2e/e2e_test.go
index f7bfcd362..f173d9c2b 100644
--- a/workspaces/controller/test/e2e/e2e_test.go
+++ b/workspaces/controller/test/e2e/e2e_test.go
@@ -85,7 +85,7 @@ var _ = Describe("controller", Ordered, func() {
 
 		By("creating common workspace resources")
 		cmd = exec.Command("kubectl", "apply",
-			"-k", filepath.Join(projectDir, "config/samples/common"),
+			"-k", filepath.Join(projectDir, "manifests/kustomize/samples/common"),
 			"-n", workspaceNamespace,
 		)
 		_, err = utils.Run(cmd)
@@ -161,7 +161,7 @@ var _ = Describe("controller", Ordered, func() {
 	AfterAll(func() {
 		By("deleting sample Workspace")
 		cmd := exec.Command("kubectl", "delete", "-f",
-			filepath.Join(projectDir, "config/samples/jupyterlab_v1beta1_workspace.yaml"),
+			filepath.Join(projectDir, "manifests/kustomize/samples/jupyterlab_v1beta1_workspace.yaml"),
 			"-n", workspaceNamespace,
 			"--wait",
 			fmt.Sprintf("--timeout=%s", timeout),
@@ -170,13 +170,13 @@ var _ = Describe("controller", Ordered, func() {
 
 		By("deleting sample WorkspaceKind")
 		cmd = exec.Command("kubectl", "delete",
-			"-f", filepath.Join(projectDir, "config/samples/jupyterlab_v1beta1_workspacekind.yaml"),
+			"-f", filepath.Join(projectDir, "manifests/kustomize/samples/jupyterlab_v1beta1_workspacekind.yaml"),
 		)
 		_, _ = utils.Run(cmd)
 
 		By("deleting common workspace resources")
 		cmd = exec.Command("kubectl", "delete",
-			"-k", filepath.Join(projectDir, "config/samples/common"),
+			"-k", filepath.Join(projectDir, "manifests/kustomize/samples/common"),
 			"-n", workspaceNamespace,
 		)
 		_, _ = utils.Run(cmd)
@@ -206,7 +206,7 @@ var _ = Describe("controller", Ordered, func() {
 			By("creating an instance of WorkspaceKind")
 			createWorkspaceKindSample := func() error {
 				cmd := exec.Command("kubectl", "apply",
-					"-f", filepath.Join(projectDir, "config/samples/jupyterlab_v1beta1_workspacekind.yaml"),
+					"-f", filepath.Join(projectDir, "manifests/kustomize/samples/jupyterlab_v1beta1_workspacekind.yaml"),
 				)
 				_, err := utils.Run(cmd)
 				return err
@@ -216,7 +216,7 @@ var _ = Describe("controller", Ordered, func() {
 			By("creating an instance of Workspace")
 			createWorkspaceSample := func() error {
 				cmd := exec.Command("kubectl", "apply",
-					"-f", filepath.Join(projectDir, "config/samples/jupyterlab_v1beta1_workspace.yaml"),
+					"-f", filepath.Join(projectDir, "manifests/kustomize/samples/jupyterlab_v1beta1_workspace.yaml"),
 					"-n", workspaceNamespace,
 				)
 				_, err := utils.Run(cmd)
diff --git a/workspaces/frontend/manifests/kustomize/base/kustomization.yaml b/workspaces/frontend/manifests/kustomize/base/kustomization.yaml
index de95d7719..5451a942a 100644
--- a/workspaces/frontend/manifests/kustomize/base/kustomization.yaml
+++ b/workspaces/frontend/manifests/kustomize/base/kustomization.yaml
@@ -12,3 +12,8 @@ labels:
   - includeSelectors: true
     pairs:
       app.kubernetes.io/component: ui
+
+images:
+  - name: workspaces-frontend
+    newName: ghcr.io/kubeflow/notebooks/workspaces-frontend
+    newTag: latest