diff --git a/e2e/tests/ingressclasses/delete.bats b/e2e/tests/ingressclasses/delete.bats
index d68c1d5a..2c99e397 100644
--- a/e2e/tests/ingressclasses/delete.bats
+++ b/e2e/tests/ingressclasses/delete.bats
@@ -8,14 +8,14 @@ load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
 
 setup() {
   create_tenant ingressclassuser alice User
-  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:ingressclassuser-namespace:sa"}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/2", "value": {"kind": "Group", "name": "foo.clastix.io"}}]'
   create_namespace alice ingressclassuser-namespace
   create_serviceaccount sa ingressclassuser-namespace
 
   create_tenant ingressclassgroup foo.clastix.io Group
-  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom2"]}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom2"]}}}]'
 
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -gt 17 ]]; then
     local version="v1"
@@ -44,7 +44,7 @@ teardown() {
 @test "Delete ingressClass without permissions" {
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -lt 18 ]]; then
     kubectl version
-    skip "IngressClass resources is not suported on Kubernetes < 1.18"
+    skip "IngressClass resources is not supported on Kubernetes < 1.18"
   fi
 
   echo "Delete ingressClass without List and Delete operations" >&3
@@ -72,7 +72,7 @@ teardown() {
 @test "Delete ingressClass with List and Delete operations" {
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -lt 18 ]]; then
     kubectl version
-    skip "IngressClass resources is not suported on Kubernetes < 1.18"
+    skip "IngressClass resources is not supported on Kubernetes < 1.18"
   fi
 
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/0/proxySettings","value":[{"kind": "IngressClasses", "operations": ["List", "Delete"]}]}]'
diff --git a/e2e/tests/ingressclasses/get.bats b/e2e/tests/ingressclasses/get.bats
index 4be2f37d..b4ecf0e8 100644
--- a/e2e/tests/ingressclasses/get.bats
+++ b/e2e/tests/ingressclasses/get.bats
@@ -8,14 +8,14 @@ load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
 
 setup() {
   create_tenant ingressclassuser alice User
-  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:ingressclassuser-namespace:sa"}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/2", "value": {"kind": "Group", "name": "foo.clastix.io"}}]'
   create_namespace alice ingressclassuser-namespace
   create_serviceaccount sa ingressclassuser-namespace
 
   create_tenant ingressclassgroup foo.clastix.io Group
-  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom2"]}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom2"]}}}]'
 
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -gt 17 ]]; then
     local version="v1"
@@ -44,7 +44,7 @@ teardown() {
 @test "Get ingressClass without permissions" {
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -lt 18 ]]; then
     kubectl version
-    skip "IngressClass resources is not suported on Kubernetes < 1.18"
+    skip "IngressClass resources is not supported on Kubernetes < 1.18"
   fi
 
   poll_until_equals "User" "" "kubectl --kubeconfig=${HACK_DIR}/alice.kubeconfig get ingressclasses.networking.k8s.io custom --output=name" 3 5
diff --git a/e2e/tests/ingressclasses/list.bats b/e2e/tests/ingressclasses/list.bats
index 07d9ecf8..8068264f 100644
--- a/e2e/tests/ingressclasses/list.bats
+++ b/e2e/tests/ingressclasses/list.bats
@@ -8,14 +8,14 @@ load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
 
 setup() {
   create_tenant ingressclassuser alice User
-  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:ingressclassuser-namespace:sa"}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/2", "value": {"kind": "Group", "name": "foo.clastix.io"}}]'
   create_namespace alice ingressclassuser-namespace
   create_serviceaccount sa ingressclassuser-namespace
 
   create_tenant ingressclassgroup foo.clastix.io Group
-  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom2"]}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom2"]}}}]'
 
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -gt 17 ]]; then
     local version="v1"
diff --git a/e2e/tests/ingressclasses/update.bats b/e2e/tests/ingressclasses/update.bats
index 5d068838..66ea49a0 100644
--- a/e2e/tests/ingressclasses/update.bats
+++ b/e2e/tests/ingressclasses/update.bats
@@ -8,14 +8,14 @@ load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
 
 setup() {
   create_tenant ingressclassuser alice User
-  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom"], "allowedRegex": "\\w+-lb"}}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:ingressclassuser-namespace:sa"}}]'
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/2", "value": {"kind": "Group", "name": "foo.clastix.io"}}]'
   create_namespace alice ingressclassuser-namespace
   create_serviceaccount sa ingressclassuser-namespace
 
   create_tenant ingressclassgroup foo.clastix.io Group
-  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressClasses", "value": {"allowed": ["custom2"]}}]'
+  kubectl patch tenants.capsule.clastix.io ingressclassgroup --type=json -p '[{"op": "add", "path": "/spec/ingressOptions", "value": {"allowedClasses": {"allowed": ["custom2"]}}}]'
 
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -gt 17 ]]; then
     local version="v1"
@@ -44,7 +44,7 @@ teardown() {
 @test "Update ingressClass without permissions" {
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -lt 18 ]]; then
     kubectl version
-    skip "IngressClass resources is not suported on Kubernetes < 1.18"
+    skip "IngressClass resources is not supported on Kubernetes < 1.18"
   fi
 
   echo "Update ingressClass without List and Update operations" >&3
@@ -72,7 +72,7 @@ teardown() {
 @test "Update ingressClass with List and Update operations" {
   if [[ $(kubectl version -o json | jq -r .serverVersion.minor) -lt 18 ]]; then
     kubectl version
-    skip "IngressClass resources is not suported on Kubernetes < 1.18"
+    skip "IngressClass resources is not supported on Kubernetes < 1.18"
   fi
 
   kubectl patch tenants.capsule.clastix.io ingressclassuser --type=json -p '[{"op": "add", "path": "/spec/owners/0/proxySettings","value":[{"kind": "IngressClasses", "operations": ["List", "Update"]}]}]'
diff --git a/e2e/tests/namespaces/list.bats b/e2e/tests/namespaces/list.bats
index f0ecb9c7..4d91ce31 100644
--- a/e2e/tests/namespaces/list.bats
+++ b/e2e/tests/namespaces/list.bats
@@ -9,18 +9,18 @@ setup() {
   create_tenant oil alice User
   kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:oil-dev:sa"}}]'
   kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/2", "value": {"kind": "Group", "name": "foo.clastix.io"}}]'
-  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/namespacesMetadata", "value": {"additionalLabels": {"bizz": "buzz"}}}]'
+  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/namespaceOptions", "value": {"additionalMetadata": {"labels": {"bizz": "buzz"}}}}]'
   create_namespace alice oil-dev
   create_namespace alice oil-staging
   create_namespace alice oil-production
   create_serviceaccount sa oil-dev
 
   create_tenant metal alice User
-  kubectl patch tenants.capsule.clastix.io metal --type=json -p '[{"op": "add", "path": "/spec/namespacesMetadata", "value": {"additionalLabels": {"foo": "bar"}}}]'
+  kubectl patch tenants.capsule.clastix.io metal --type=json -p '[{"op": "add", "path": "/spec/namespaceOptions", "value": {"additionalMetadata": {"labels": {"foo": "bar"}}}}]'
   create_namespace alice metal-staging
 
   create_tenant gas foo.clastix.io Group
-  kubectl patch tenants.capsule.clastix.io gas --type=json -p '[{"op": "add", "path": "/spec/namespacesMetadata", "value": {"additionalLabels": {"bizz": "buzz"}}}]'
+  kubectl patch tenants.capsule.clastix.io gas --type=json -p '[{"op": "add", "path": "/spec/namespaceOptions", "value": {"additionalMetadata": {"labels": {"bizz": "buzz"}}}}]'
   create_namespace joe gas-qa foo.clastix.io
 }