diff --git a/manifests/meshnet/grpc/manifest.yaml b/manifests/meshnet/grpc/manifest.yaml
index a49fa5ce..3a299b99 100644
--- a/manifests/meshnet/grpc/manifest.yaml
+++ b/manifests/meshnet/grpc/manifest.yaml
@@ -221,13 +221,31 @@ metadata:
     app: meshnet
   name: meshnet-clusterrole
 rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
 - apiGroups:
   - networkop.co.uk
   resources:
   - topologies
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - networkop.co.uk
+  resources:
   - gwirekobjs
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - networkop.co.uk
   resources:
@@ -235,7 +253,9 @@ rules:
   - gwirekobjs/spec
   - gwirekobjs/status
   verbs:
-  - '*'
+  - get
+  - update
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -293,15 +313,16 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2
+        image: public.ecr.aws/drivenets/meshnet-cni:v0.5.0-dn
         imagePullPolicy: IfNotPresent
         name: meshnet
         resources:
           limits:
-            memory: 512Mi
+            cpu: "2"
+            memory: 10G
           requests:
-            cpu: 50m
-            memory: 256Mi
+            cpu: 200m
+            memory: 1G
         securityContext:
           privileged: true
         volumeMounts:
@@ -312,7 +333,6 @@ spec:
         - mountPath: /var/run/netns
           mountPropagation: Bidirectional
           name: var-run-netns
-      hostIPC: true
       hostNetwork: true
       hostPID: true
       nodeSelector:
diff --git a/manifests/meshnet/vxlan/manifest.yaml b/manifests/meshnet/vxlan/manifest.yaml
index 0346ed42..d9f808bb 100644
--- a/manifests/meshnet/vxlan/manifest.yaml
+++ b/manifests/meshnet/vxlan/manifest.yaml
@@ -221,13 +221,31 @@ metadata:
     app: meshnet
   name: meshnet-clusterrole
 rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
 - apiGroups:
   - networkop.co.uk
   resources:
   - topologies
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - networkop.co.uk
+  resources:
   - gwirekobjs
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - networkop.co.uk
   resources:
@@ -235,7 +253,9 @@ rules:
   - gwirekobjs/spec
   - gwirekobjs/status
   verbs:
-  - '*'
+  - get
+  - update
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -293,15 +313,16 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2
+        image: public.ecr.aws/drivenets/meshnet-cni:v0.5.0-dn
         imagePullPolicy: IfNotPresent
         name: meshnet
         resources:
           limits:
-            memory: 512Mi
+            cpu: "2"
+            memory: 10G
           requests:
-            cpu: 50m
-            memory: 256Mi
+            cpu: 200m
+            memory: 1G
         securityContext:
           privileged: true
         volumeMounts:
@@ -312,7 +333,6 @@ spec:
         - mountPath: /var/run/netns
           mountPropagation: Bidirectional
           name: var-run-netns
-      hostIPC: true
       hostNetwork: true
       hostPID: true
       nodeSelector: