diff --git a/Makefile b/Makefile
index 137656d..4976bde 100644
--- a/Makefile
+++ b/Makefile
@@ -19,17 +19,17 @@ test:	## Run test suite
 test/coverage:	## Run test suite with coverage report
 	go test -v ./... -cover
 
-build:	## Build operator Docker image
-	@docker build -f Dockerfile --build-arg operator_version=$(curVersion) -t $(DOCKER_IMG_TAG) .
+build/operator:	## Build operator Docker image
+	@docker build -f operator/Dockerfile --build-arg operator_version=$(curVersion) -t $(DOCKER_IMG_TAG) .
 	@echo "Successfully built and tagged image."
 	@echo "Tag: $(DOCKER_IMG_TAG)"
 
-build/local:	## Build local version of the operator Docker image
-	@docker build -f Dockerfile -t local/$(DOCKER_IMG_TAG) .
+build/operator/local:	## Build local version of the operator Docker image 
+	@docker build -f operator/Dockerfile -t local/$(DOCKER_IMG_TAG) .
 
-build/binary: clean	## Build operator binary
+build/operator/binary: clean	## Build operator binary
 	@mkdir -p dist
-	@go build -mod vendor -a -o manager ./cmd/manager/main.go
+	@go build -mod vendor -a -o manager ./operator/cmd/manager/main.go
 	@mv manager ./dist
 
 clean:
diff --git a/README.md b/README.md
index ca2e7d3..c315209 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,8 @@
-# 1Password Connect Kubernetes Operator
+# 1Password for Kubernetes
+
+This repository includes various tooling for integrating 1Password secrets wtih Kubernetes.
+
+## 1Password Connect Kubernetes Operator
 
 The 1Password Connect Kubernetes Operator provides the ability to integrate Kubernetes with 1Password. This Operator manages `OnePasswordItem` Custom Resource Definitions (CRDs) that define the location of an Item stored in 1Password. The `OnePasswordItem` CRD, when created, will be used to compose a Kubernetes Secret containing the contents of the specified item.
 
@@ -6,227 +10,10 @@ The 1Password Connect Kubernetes Operator also allows for Kubernetes Secrets to
 
 The 1Password Connect Kubernetes Operator will continually check for updates from 1Password for any Kubernetes Secret that it has generated. If a Kubernetes Secret is updated, any Deployment using that secret can be automatically restarted.
 
-## Setup
-
-Prerequisites:
-
-- [1Password Command Line Tool Installed](https://1password.com/downloads/command-line/)
-- [kubectl installed](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
-- [docker installed](https://docs.docker.com/get-docker/)
-- [Generated a 1password-credentials.json file and issued a 1Password Connect API Token for the K8s Operator integration](https://support.1password.com/secrets-automation/)
-- [1Password Connect deployed to Kubernetes](https://support.1password.com/connect-deploy-kubernetes/#step-2-deploy-a-1password-connect-server). **NOTE**: If customization of the 1Password Connect deployment is not required you can skip this prerequisite.
-
-### Quickstart for Deploying 1Password Connect to Kubernetes
+[Click here for more details on the 1Password Kubernetes Operator](operator/README.md)
 
 
-#### Deploy with Helm
-The 1Password Connect Helm Chart helps to simplify the deployment of 1Password Connect and the 1Password Connect Kubernetes Operator to Kubernetes. 
-
-[The 1Password Connect Helm Chart can be found here.](https://github.com/1Password/connect-helm-charts)
-
-#### Deploy using the Connect Operator
-If 1Password Connect is already running, you can skip this step. This guide will provide a quickstart option for deploying a default configuration of 1Password Connect via starting the deploying the 1Password Connect Operator, however it is recommended that you instead deploy your own manifest file if customization of the 1Password Connect deployment is desired.
-
-Encode the 1password-credentials.json file you generated in the prerequisite steps and save it to a file named op-session:
-
-```bash
-$ cat 1password-credentials.json | base64 | \
-  tr '/+' '_-' | tr -d '=' | tr -d '\n' > op-session
-```
-
-Create a Kubernetes secret from the op-session file:
-```bash
-
-$  kubectl create secret generic op-credentials --from-file=1password-credentials.json
-```
-
-Add the following environment variable to the onepassword-connect-operator container in `deploy/operator.yaml`:
-```yaml
-- name: MANAGE_CONNECT
-  value: "true"
-```
-Adding this environment variable will have the operator automatically deploy a default configuration of 1Password Connect to the `default` namespace.
-### Kubernetes Operator Deployment
-
-**Create Kubernetes Secret for OP_CONNECT_TOKEN**
-
-"Create a Connect token for the operator and save it as a Kubernetes Secret: 
-
-```bash
-$ kubectl create secret generic onepassword-token --from-literal=token=<OP_CONNECT_TOKEN>"
-```
-
-If you do not have a token for the operator, you can generate a token and save it to kubernetes with the following command:
-```bash
-$ kubectl create secret generic onepassword-token --from-literal=token=$(op create connect token <server> op-k8s-operator --vault <vault>)
-```
-
-[More information on generating a token can be found here](https://support.1password.com/secrets-automation/#appendix-issue-additional-access-tokens)
-
-**Set Permissions For Operator**
-
-We must create a service account, role, and role binding and Kubernetes. Examples can be found in the `/deploy` folder.
-
-```bash
-$ kubectl apply -f deploy/permissions.yaml
-```
-
-**Create Custom One Password Secret Resource**
-
-```bash
-$ kubectl apply -f deploy/crds/onepassword.com_onepassworditems_crd.yaml
-```
-
-**Deploying the Operator**
-
-An sample Deployment yaml can be found at `/deploy/operator.yaml`.
-
-
-To further configure the 1Password Kubernetes Operator the Following Environment variables can be set in the operator yaml:
-
-- **OP_CONNECT_HOST** (required): Specifies the host name within Kubernetes in which to access the 1Password Connect.
-- **WATCH_NAMESPACE:** (default: watch all namespaces): Comma separated list of what Namespaces to watch for changes.
-- **POLLING_INTERVAL** (default: 600): The number of seconds the 1Password Kubernetes Operator will wait before checking for updates from 1Password Connect.
-- **MANAGE_CONNECT** (default: false): If set to true, on deployment of the operator, a default configuration of the OnePassword Connect Service will be deployed to the `default` namespace.
-- **AUTO_RESTART** (default: false): If set to true, the operator will restart any deployment using a secret from 1Password Connect. This can be overwritten by namespace, deployment, or individual secret. More details on AUTO_RESTART can be found in the ["Configuring Automatic Rolling Restarts of Deployments"](#configuring-automatic-rolling-restarts-of-deployments) section.
-
-Apply the deployment file:
-
-```yaml
-kubectl apply -f deploy/operator.yaml
-```
-
-## Usage
-
-To create a Kubernetes Secret from a 1Password item, create a yaml file with the following
-
-```yaml
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: <item_name> #this name will also be used for naming the generated kubernetes secret
-spec:
-  itemPath: "vaults/<vault_id_or_title>/items/<item_id_or_title>" 
-```
-
-Deploy the OnePasswordItem to Kubernetes:
-
-```bash
-$ kubectl apply -f <your_item>.yaml
-```
-
-To test that the Kubernetes Secret check that the following command returns a secret:
-
-```bash
-$ kubectl get secret <secret_name>
-```
-
-Note: Deleting the `OnePasswordItem` that you've created will automatically delete the created Kubernetes Secret.
-
-To create a single Kubernetes Secret for a deployment, add the following annotations to the deployment metadata:
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: deployment-example
-  annotations:
-    operator.1password.io/item-path: "vaults/<vault_id_or_title>/items/<item_id_or_title>"
-    operator.1password.io/item-name: "<secret_name>"
-```
-
-Applying this yaml file will create a Kubernetes Secret with the name `<secret_name>` and contents from the location specified at the specified Item Path.
-
-Note: Deleting the Deployment that you've created will automatically delete the created Kubernetes Secret only if the deployment is still annotated with `operator.1password.io/item-path` and `operator.1password.io/item-name` and no other deployment is using the secret.
-
-If a 1Password Item that is linked to a Kubernetes Secret is updated within the POLLING_INTERVAL the associated Kubernetes Secret will be updated. However, if you do not want a specific secret to be updated you can add the tag `operator.1password.io:ignore-secret` to the item stored in 1Password. While this tag is in place, any updates made to an item will not trigger an update to the associated secret in Kubernetes.
-
----
-**NOTE**
-
-If multiple 1Password vaults/items have the same `title` when using a title in the access path, the desired action will be performed on the oldest vault/item. 
-
-Titles and field names that include white space and other characters that are not a valid [DNS subdomain name](https://kubernetes.io/docs/concepts/configuration/secret/) will create Kubernetes secrets that have titles and fields in the following format:
- - Invalid characters before the first alphanumeric character and after the last alphanumeric character will be removed
- - All whitespaces between words will be replaced by `-`
- - All the letters will be lower-cased.
-
----
-
-### Configuring Automatic Rolling Restarts of Deployments
-
-If a 1Password Item that is linked to a Kubernetes Secret is updated, any deployments configured to `auto-restart` AND are using that secret will be given a rolling restart the next time 1Password Connect is polled for updates.
-
-There are many levels of granularity on which to configure auto restarts on deployments: at the operator level, per-namespace, or per-deployment.
-
-**On the operator**: This method allows for managing auto restarts on all deployments within the namespaces watched by operator. Auto restarts can be enabled by setting the environemnt variable  `AUTO_RESTART` to true. If the value is not set, the operator will default this value to false.
-
-**Per Namespace**: This method allows for managing auto restarts on all deployments within a namespace. Auto restarts can by managed by setting the annotation `operator.1password.io/auto-restart` to either `true` or `false` on the desired namespace. An example of this is shown below:
-```yaml
-# enabled auto restarts for all deployments within a namespace unless overwritten within a deployment
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: "example-namespace"
-  annotations:
-    operator.1password.io/auto-restart: "true"
-```
-If the value is not set, the auto reset settings on the operator will be used. This value can be overwritten by deployment.
-
-**Per Deployment**
-This method allows for managing auto restarts on a given deployment. Auto restarts can by managed by setting the annotation `operator.1password.io/auto-restart` to either `true` or `false` on the desired deployment. An example of this is shown below:
-```yaml
-# enabled auto restarts for the deployment
-apiVersion: v1
-kind: Deployment
-metadata:
-  name: "example-deployment"
-  annotations:
-    operator.1password.io/auto-restart: "true"
-```
-If the value is not set, the auto reset settings on the namespace will be used.
-
-**Per OnePasswordItem Custom Resource**
-This method allows for managing auto restarts on a given OnePasswordItem custom resource. Auto restarts can by managed by setting the annotation `operator.1password.io/auto_restart` to either `true` or `false` on the desired OnePasswordItem. An example of this is shown below:
-```yaml
-# enabled auto restarts for the OnePasswordItem
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: example
-  annotations:
-    operator.1password.io/auto-restart: "true"
-```
-If the value is not set, the auto reset settings on the deployment will be used.
-
-## Development
-
-### Creating a Docker image
-
-To create a local version of the Docker image for testing, use the following `Makefile` target:
-```shell
-make build/local
-```
-
-### Building the Operator binary
-```shell
-make build/binary
-```
-
-The binary will be placed inside a `dist` folder within this repository.
-
-### Running Tests
-
-```shell
-make test
-```
-
-With coverage:
-```shell
-make test/coverage
-```
-
-## Security
+# Security
 
 1Password requests you practice responsible disclosure if you discover a vulnerability. 
 
diff --git a/build/Dockerfile b/build/Dockerfile
deleted file mode 100644
index b95fc69..0000000
--- a/build/Dockerfile
+++ /dev/null
@@ -1,15 +0,0 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal:latest
-
-ENV OPERATOR=/usr/local/bin/onepassword-connect-operator \
-    USER_UID=1001 \
-    USER_NAME=onepassword-connect-operator
-
-# install operator binary
-COPY build/_output/bin/op-kubernetes-connect-operator ${OPERATOR}
-
-COPY build/bin /usr/local/bin
-RUN  /usr/local/bin/user_setup
-
-ENTRYPOINT ["/usr/local/bin/entrypoint"]
-
-USER ${USER_UID}
diff --git a/build/bin/entrypoint b/build/bin/entrypoint
deleted file mode 100755
index 457186b..0000000
--- a/build/bin/entrypoint
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh -e
-
-exec ${OPERATOR} $@
diff --git a/build/bin/user_setup b/build/bin/user_setup
deleted file mode 100755
index 4b5b77d..0000000
--- a/build/bin/user_setup
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-set -x
-
-# ensure $HOME exists and is accessible by group 0 (we don't know what the runtime UID will be)
-echo "${USER_NAME}:x:${USER_UID}:0:${USER_NAME} user:${HOME}:/sbin/nologin" >> /etc/passwd
-mkdir -p "${HOME}"
-chown "${USER_UID}:0" "${HOME}"
-chmod ug+rwx "${HOME}"
-
-# no need for this script to remain in the image after running
-rm "$0"
diff --git a/Dockerfile b/operator/Dockerfile
similarity index 64%
rename from Dockerfile
rename to operator/Dockerfile
index 6af54ea..0792cbf 100644
--- a/Dockerfile
+++ b/operator/Dockerfile
@@ -7,18 +7,18 @@ COPY go.mod go.mod
 COPY go.sum go.sum
 
 # Copy the go source
-COPY cmd/manager/main.go main.go
-COPY pkg/ pkg/
-COPY version/ version/
+COPY operator/cmd/manager/main.go operator/main.go
+COPY operator/pkg/ operator/pkg/
+COPY operator/version/ operator/version/
 COPY vendor/ vendor/
 # Build
 ARG operator_version=dev
 RUN CGO_ENABLED=0 \
     GO111MODULE=on \
     go build \
-    -ldflags "-X \"github.com/1Password/onepassword-operator/version.Version=$operator_version\"" \
+    -ldflags "-X \"github.com/1Password/onepassword-operator/operator/version.Version=$operator_version\"" \
     -mod vendor \
-    -a -o manager main.go
+    -a -o manager operator/main.go
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
@@ -26,6 +26,6 @@ FROM gcr.io/distroless/static:nonroot
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER nonroot:nonroot
-COPY deploy/connect/ deploy/connect/
+COPY operator/deploy/connect/ operator/deploy/connect/
 
 ENTRYPOINT ["/manager"]
diff --git a/operator/README.md b/operator/README.md
new file mode 100644
index 0000000..ca2e7d3
--- /dev/null
+++ b/operator/README.md
@@ -0,0 +1,235 @@
+# 1Password Connect Kubernetes Operator
+
+The 1Password Connect Kubernetes Operator provides the ability to integrate Kubernetes with 1Password. This Operator manages `OnePasswordItem` Custom Resource Definitions (CRDs) that define the location of an Item stored in 1Password. The `OnePasswordItem` CRD, when created, will be used to compose a Kubernetes Secret containing the contents of the specified item.
+
+The 1Password Connect Kubernetes Operator also allows for Kubernetes Secrets to be composed from a 1Password Item through annotation of an Item Path on a deployment.
+
+The 1Password Connect Kubernetes Operator will continually check for updates from 1Password for any Kubernetes Secret that it has generated. If a Kubernetes Secret is updated, any Deployment using that secret can be automatically restarted.
+
+## Setup
+
+Prerequisites:
+
+- [1Password Command Line Tool Installed](https://1password.com/downloads/command-line/)
+- [kubectl installed](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
+- [docker installed](https://docs.docker.com/get-docker/)
+- [Generated a 1password-credentials.json file and issued a 1Password Connect API Token for the K8s Operator integration](https://support.1password.com/secrets-automation/)
+- [1Password Connect deployed to Kubernetes](https://support.1password.com/connect-deploy-kubernetes/#step-2-deploy-a-1password-connect-server). **NOTE**: If customization of the 1Password Connect deployment is not required you can skip this prerequisite.
+
+### Quickstart for Deploying 1Password Connect to Kubernetes
+
+
+#### Deploy with Helm
+The 1Password Connect Helm Chart helps to simplify the deployment of 1Password Connect and the 1Password Connect Kubernetes Operator to Kubernetes. 
+
+[The 1Password Connect Helm Chart can be found here.](https://github.com/1Password/connect-helm-charts)
+
+#### Deploy using the Connect Operator
+If 1Password Connect is already running, you can skip this step. This guide will provide a quickstart option for deploying a default configuration of 1Password Connect via starting the deploying the 1Password Connect Operator, however it is recommended that you instead deploy your own manifest file if customization of the 1Password Connect deployment is desired.
+
+Encode the 1password-credentials.json file you generated in the prerequisite steps and save it to a file named op-session:
+
+```bash
+$ cat 1password-credentials.json | base64 | \
+  tr '/+' '_-' | tr -d '=' | tr -d '\n' > op-session
+```
+
+Create a Kubernetes secret from the op-session file:
+```bash
+
+$  kubectl create secret generic op-credentials --from-file=1password-credentials.json
+```
+
+Add the following environment variable to the onepassword-connect-operator container in `deploy/operator.yaml`:
+```yaml
+- name: MANAGE_CONNECT
+  value: "true"
+```
+Adding this environment variable will have the operator automatically deploy a default configuration of 1Password Connect to the `default` namespace.
+### Kubernetes Operator Deployment
+
+**Create Kubernetes Secret for OP_CONNECT_TOKEN**
+
+"Create a Connect token for the operator and save it as a Kubernetes Secret: 
+
+```bash
+$ kubectl create secret generic onepassword-token --from-literal=token=<OP_CONNECT_TOKEN>"
+```
+
+If you do not have a token for the operator, you can generate a token and save it to kubernetes with the following command:
+```bash
+$ kubectl create secret generic onepassword-token --from-literal=token=$(op create connect token <server> op-k8s-operator --vault <vault>)
+```
+
+[More information on generating a token can be found here](https://support.1password.com/secrets-automation/#appendix-issue-additional-access-tokens)
+
+**Set Permissions For Operator**
+
+We must create a service account, role, and role binding and Kubernetes. Examples can be found in the `/deploy` folder.
+
+```bash
+$ kubectl apply -f deploy/permissions.yaml
+```
+
+**Create Custom One Password Secret Resource**
+
+```bash
+$ kubectl apply -f deploy/crds/onepassword.com_onepassworditems_crd.yaml
+```
+
+**Deploying the Operator**
+
+An sample Deployment yaml can be found at `/deploy/operator.yaml`.
+
+
+To further configure the 1Password Kubernetes Operator the Following Environment variables can be set in the operator yaml:
+
+- **OP_CONNECT_HOST** (required): Specifies the host name within Kubernetes in which to access the 1Password Connect.
+- **WATCH_NAMESPACE:** (default: watch all namespaces): Comma separated list of what Namespaces to watch for changes.
+- **POLLING_INTERVAL** (default: 600): The number of seconds the 1Password Kubernetes Operator will wait before checking for updates from 1Password Connect.
+- **MANAGE_CONNECT** (default: false): If set to true, on deployment of the operator, a default configuration of the OnePassword Connect Service will be deployed to the `default` namespace.
+- **AUTO_RESTART** (default: false): If set to true, the operator will restart any deployment using a secret from 1Password Connect. This can be overwritten by namespace, deployment, or individual secret. More details on AUTO_RESTART can be found in the ["Configuring Automatic Rolling Restarts of Deployments"](#configuring-automatic-rolling-restarts-of-deployments) section.
+
+Apply the deployment file:
+
+```yaml
+kubectl apply -f deploy/operator.yaml
+```
+
+## Usage
+
+To create a Kubernetes Secret from a 1Password item, create a yaml file with the following
+
+```yaml
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: <item_name> #this name will also be used for naming the generated kubernetes secret
+spec:
+  itemPath: "vaults/<vault_id_or_title>/items/<item_id_or_title>" 
+```
+
+Deploy the OnePasswordItem to Kubernetes:
+
+```bash
+$ kubectl apply -f <your_item>.yaml
+```
+
+To test that the Kubernetes Secret check that the following command returns a secret:
+
+```bash
+$ kubectl get secret <secret_name>
+```
+
+Note: Deleting the `OnePasswordItem` that you've created will automatically delete the created Kubernetes Secret.
+
+To create a single Kubernetes Secret for a deployment, add the following annotations to the deployment metadata:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment-example
+  annotations:
+    operator.1password.io/item-path: "vaults/<vault_id_or_title>/items/<item_id_or_title>"
+    operator.1password.io/item-name: "<secret_name>"
+```
+
+Applying this yaml file will create a Kubernetes Secret with the name `<secret_name>` and contents from the location specified at the specified Item Path.
+
+Note: Deleting the Deployment that you've created will automatically delete the created Kubernetes Secret only if the deployment is still annotated with `operator.1password.io/item-path` and `operator.1password.io/item-name` and no other deployment is using the secret.
+
+If a 1Password Item that is linked to a Kubernetes Secret is updated within the POLLING_INTERVAL the associated Kubernetes Secret will be updated. However, if you do not want a specific secret to be updated you can add the tag `operator.1password.io:ignore-secret` to the item stored in 1Password. While this tag is in place, any updates made to an item will not trigger an update to the associated secret in Kubernetes.
+
+---
+**NOTE**
+
+If multiple 1Password vaults/items have the same `title` when using a title in the access path, the desired action will be performed on the oldest vault/item. 
+
+Titles and field names that include white space and other characters that are not a valid [DNS subdomain name](https://kubernetes.io/docs/concepts/configuration/secret/) will create Kubernetes secrets that have titles and fields in the following format:
+ - Invalid characters before the first alphanumeric character and after the last alphanumeric character will be removed
+ - All whitespaces between words will be replaced by `-`
+ - All the letters will be lower-cased.
+
+---
+
+### Configuring Automatic Rolling Restarts of Deployments
+
+If a 1Password Item that is linked to a Kubernetes Secret is updated, any deployments configured to `auto-restart` AND are using that secret will be given a rolling restart the next time 1Password Connect is polled for updates.
+
+There are many levels of granularity on which to configure auto restarts on deployments: at the operator level, per-namespace, or per-deployment.
+
+**On the operator**: This method allows for managing auto restarts on all deployments within the namespaces watched by operator. Auto restarts can be enabled by setting the environemnt variable  `AUTO_RESTART` to true. If the value is not set, the operator will default this value to false.
+
+**Per Namespace**: This method allows for managing auto restarts on all deployments within a namespace. Auto restarts can by managed by setting the annotation `operator.1password.io/auto-restart` to either `true` or `false` on the desired namespace. An example of this is shown below:
+```yaml
+# enabled auto restarts for all deployments within a namespace unless overwritten within a deployment
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: "example-namespace"
+  annotations:
+    operator.1password.io/auto-restart: "true"
+```
+If the value is not set, the auto reset settings on the operator will be used. This value can be overwritten by deployment.
+
+**Per Deployment**
+This method allows for managing auto restarts on a given deployment. Auto restarts can by managed by setting the annotation `operator.1password.io/auto-restart` to either `true` or `false` on the desired deployment. An example of this is shown below:
+```yaml
+# enabled auto restarts for the deployment
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: "example-deployment"
+  annotations:
+    operator.1password.io/auto-restart: "true"
+```
+If the value is not set, the auto reset settings on the namespace will be used.
+
+**Per OnePasswordItem Custom Resource**
+This method allows for managing auto restarts on a given OnePasswordItem custom resource. Auto restarts can by managed by setting the annotation `operator.1password.io/auto_restart` to either `true` or `false` on the desired OnePasswordItem. An example of this is shown below:
+```yaml
+# enabled auto restarts for the OnePasswordItem
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: example
+  annotations:
+    operator.1password.io/auto-restart: "true"
+```
+If the value is not set, the auto reset settings on the deployment will be used.
+
+## Development
+
+### Creating a Docker image
+
+To create a local version of the Docker image for testing, use the following `Makefile` target:
+```shell
+make build/local
+```
+
+### Building the Operator binary
+```shell
+make build/binary
+```
+
+The binary will be placed inside a `dist` folder within this repository.
+
+### Running Tests
+
+```shell
+make test
+```
+
+With coverage:
+```shell
+make test/coverage
+```
+
+## Security
+
+1Password requests you practice responsible disclosure if you discover a vulnerability. 
+
+Please file requests via [**BugCrowd**](https://bugcrowd.com/agilebits). 
+
+For information about security practices, please visit our [Security homepage](https://bugcrowd.com/agilebits).
diff --git a/cmd/manager/main.go b/operator/cmd/manager/main.go
similarity index 97%
rename from cmd/manager/main.go
rename to operator/cmd/manager/main.go
index 2d7904c..f66cd8d 100644
--- a/cmd/manager/main.go
+++ b/operator/cmd/manager/main.go
@@ -11,16 +11,16 @@ import (
 	"strings"
 	"time"
 
-	"github.com/1Password/onepassword-operator/pkg/controller"
-	op "github.com/1Password/onepassword-operator/pkg/onepassword"
+	"github.com/1Password/onepassword-operator/operator/pkg/controller"
+	op "github.com/1Password/onepassword-operator/operator/pkg/onepassword"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/client-go/rest"
 
-	"github.com/1Password/onepassword-operator/pkg/apis"
-	"github.com/1Password/onepassword-operator/version"
+	"github.com/1Password/onepassword-operator/operator/pkg/apis"
+	"github.com/1Password/onepassword-operator/operator/version"
 
 	"github.com/1Password/connect-sdk-go/connect"
 
diff --git a/deploy/connect/deployment.yaml b/operator/deploy/connect/deployment.yaml
similarity index 100%
rename from deploy/connect/deployment.yaml
rename to operator/deploy/connect/deployment.yaml
diff --git a/deploy/connect/service.yaml b/operator/deploy/connect/service.yaml
similarity index 100%
rename from deploy/connect/service.yaml
rename to operator/deploy/connect/service.yaml
diff --git a/deploy/crds/onepassword.com_onepassworditems_crd.yaml b/operator/deploy/crds/onepassword.com_onepassworditems_crd.yaml
similarity index 100%
rename from deploy/crds/onepassword.com_onepassworditems_crd.yaml
rename to operator/deploy/crds/onepassword.com_onepassworditems_crd.yaml
diff --git a/deploy/crds/onepassword.com_v1_onepassworditem_cr.yaml b/operator/deploy/crds/onepassword.com_v1_onepassworditem_cr.yaml
similarity index 100%
rename from deploy/crds/onepassword.com_v1_onepassworditem_cr.yaml
rename to operator/deploy/crds/onepassword.com_v1_onepassworditem_cr.yaml
diff --git a/deploy/operator.yaml b/operator/deploy/operator.yaml
similarity index 100%
rename from deploy/operator.yaml
rename to operator/deploy/operator.yaml
diff --git a/deploy/operator_multi_namespace_example.yaml b/operator/deploy/operator_multi_namespace_example.yaml
similarity index 100%
rename from deploy/operator_multi_namespace_example.yaml
rename to operator/deploy/operator_multi_namespace_example.yaml
diff --git a/deploy/permissions.yaml b/operator/deploy/permissions.yaml
similarity index 100%
rename from deploy/permissions.yaml
rename to operator/deploy/permissions.yaml
diff --git a/deploy/permissions_multi_namespace_example.yaml b/operator/deploy/permissions_multi_namespace_example.yaml
similarity index 100%
rename from deploy/permissions_multi_namespace_example.yaml
rename to operator/deploy/permissions_multi_namespace_example.yaml
diff --git a/pkg/apis/addtoscheme_onepassword_v1.go b/operator/pkg/apis/addtoscheme_onepassword_v1.go
similarity index 72%
rename from pkg/apis/addtoscheme_onepassword_v1.go
rename to operator/pkg/apis/addtoscheme_onepassword_v1.go
index a0ffb86..70c8b49 100644
--- a/pkg/apis/addtoscheme_onepassword_v1.go
+++ b/operator/pkg/apis/addtoscheme_onepassword_v1.go
@@ -1,7 +1,7 @@
 package apis
 
 import (
-	v1 "github.com/1Password/onepassword-operator/pkg/apis/onepassword/v1"
+	v1 "github.com/1Password/onepassword-operator/operator/pkg/apis/onepassword/v1"
 )
 
 func init() {
diff --git a/pkg/apis/apis.go b/operator/pkg/apis/apis.go
similarity index 100%
rename from pkg/apis/apis.go
rename to operator/pkg/apis/apis.go
diff --git a/pkg/apis/onepassword/group.go b/operator/pkg/apis/onepassword/group.go
similarity index 100%
rename from pkg/apis/onepassword/group.go
rename to operator/pkg/apis/onepassword/group.go
diff --git a/pkg/apis/onepassword/v1/doc.go b/operator/pkg/apis/onepassword/v1/doc.go
similarity index 100%
rename from pkg/apis/onepassword/v1/doc.go
rename to operator/pkg/apis/onepassword/v1/doc.go
diff --git a/pkg/apis/onepassword/v1/onepasswordsecret_types.go b/operator/pkg/apis/onepassword/v1/onepasswordsecret_types.go
similarity index 100%
rename from pkg/apis/onepassword/v1/onepasswordsecret_types.go
rename to operator/pkg/apis/onepassword/v1/onepasswordsecret_types.go
diff --git a/pkg/apis/onepassword/v1/register.go b/operator/pkg/apis/onepassword/v1/register.go
similarity index 100%
rename from pkg/apis/onepassword/v1/register.go
rename to operator/pkg/apis/onepassword/v1/register.go
diff --git a/pkg/apis/onepassword/v1/zz_generated.deepcopy.go b/operator/pkg/apis/onepassword/v1/zz_generated.deepcopy.go
similarity index 100%
rename from pkg/apis/onepassword/v1/zz_generated.deepcopy.go
rename to operator/pkg/apis/onepassword/v1/zz_generated.deepcopy.go
diff --git a/pkg/controller/add_deployment.go b/operator/pkg/controller/add_deployment.go
similarity index 71%
rename from pkg/controller/add_deployment.go
rename to operator/pkg/controller/add_deployment.go
index 61e5b63..e98b2af 100644
--- a/pkg/controller/add_deployment.go
+++ b/operator/pkg/controller/add_deployment.go
@@ -1,7 +1,7 @@
 package controller
 
 import (
-	"github.com/1Password/onepassword-operator/pkg/controller/deployment"
+	"github.com/1Password/onepassword-operator/operator/pkg/controller/deployment"
 )
 
 func init() {
diff --git a/pkg/controller/add_onepassworditem.go b/operator/pkg/controller/add_onepassworditem.go
similarity index 71%
rename from pkg/controller/add_onepassworditem.go
rename to operator/pkg/controller/add_onepassworditem.go
index 84dbce3..061e38f 100644
--- a/pkg/controller/add_onepassworditem.go
+++ b/operator/pkg/controller/add_onepassworditem.go
@@ -1,7 +1,7 @@
 package controller
 
 import (
-	"github.com/1Password/onepassword-operator/pkg/controller/onepassworditem"
+	"github.com/1Password/onepassword-operator/operator/pkg/controller/onepassworditem"
 )
 
 func init() {
diff --git a/pkg/controller/controller.go b/operator/pkg/controller/controller.go
similarity index 100%
rename from pkg/controller/controller.go
rename to operator/pkg/controller/controller.go
diff --git a/pkg/controller/deployment/deployment_controller.go b/operator/pkg/controller/deployment/deployment_controller.go
similarity index 96%
rename from pkg/controller/deployment/deployment_controller.go
rename to operator/pkg/controller/deployment/deployment_controller.go
index 3b81fdf..39e30e5 100644
--- a/pkg/controller/deployment/deployment_controller.go
+++ b/operator/pkg/controller/deployment/deployment_controller.go
@@ -4,9 +4,9 @@ import (
 	"context"
 	"fmt"
 
-	kubeSecrets "github.com/1Password/onepassword-operator/pkg/kubernetessecrets"
-	op "github.com/1Password/onepassword-operator/pkg/onepassword"
-	"github.com/1Password/onepassword-operator/pkg/utils"
+	kubeSecrets "github.com/1Password/onepassword-operator/operator/pkg/kubernetessecrets"
+	op "github.com/1Password/onepassword-operator/operator/pkg/onepassword"
+	"github.com/1Password/onepassword-operator/operator/pkg/utils"
 
 	"regexp"
 
diff --git a/pkg/controller/deployment/deployment_controller_test.go b/operator/pkg/controller/deployment/deployment_controller_test.go
similarity index 98%
rename from pkg/controller/deployment/deployment_controller_test.go
rename to operator/pkg/controller/deployment/deployment_controller_test.go
index 25ae956..9ee8687 100644
--- a/pkg/controller/deployment/deployment_controller_test.go
+++ b/operator/pkg/controller/deployment/deployment_controller_test.go
@@ -6,8 +6,8 @@ import (
 	"regexp"
 	"testing"
 
-	"github.com/1Password/onepassword-operator/pkg/mocks"
-	op "github.com/1Password/onepassword-operator/pkg/onepassword"
+	"github.com/1Password/onepassword-operator/operator/pkg/mocks"
+	op "github.com/1Password/onepassword-operator/operator/pkg/onepassword"
 
 	"github.com/1Password/connect-sdk-go/onepassword"
 	"github.com/stretchr/testify/assert"
diff --git a/pkg/controller/onepassworditem/onepassworditem_controller.go b/operator/pkg/controller/onepassworditem/onepassworditem_controller.go
similarity index 93%
rename from pkg/controller/onepassworditem/onepassworditem_controller.go
rename to operator/pkg/controller/onepassworditem/onepassworditem_controller.go
index dc7fdff..ad6f3db 100644
--- a/pkg/controller/onepassworditem/onepassworditem_controller.go
+++ b/operator/pkg/controller/onepassworditem/onepassworditem_controller.go
@@ -3,11 +3,12 @@ package onepassworditem
 import (
 	"context"
 	"fmt"
-	onepasswordv1 "github.com/1Password/onepassword-operator/pkg/apis/onepassword/v1"
-	kubeSecrets "github.com/1Password/onepassword-operator/pkg/kubernetessecrets"
-	"github.com/1Password/onepassword-operator/pkg/onepassword"
-	op "github.com/1Password/onepassword-operator/pkg/onepassword"
-	"github.com/1Password/onepassword-operator/pkg/utils"
+
+	onepasswordv1 "github.com/1Password/onepassword-operator/operator/pkg/apis/onepassword/v1"
+	kubeSecrets "github.com/1Password/onepassword-operator/operator/pkg/kubernetessecrets"
+	"github.com/1Password/onepassword-operator/operator/pkg/onepassword"
+	op "github.com/1Password/onepassword-operator/operator/pkg/onepassword"
+	"github.com/1Password/onepassword-operator/operator/pkg/utils"
 
 	"github.com/1Password/connect-sdk-go/connect"
 
diff --git a/pkg/controller/onepassworditem/onepassworditem_test.go b/operator/pkg/controller/onepassworditem/onepassworditem_test.go
similarity index 96%
rename from pkg/controller/onepassworditem/onepassworditem_test.go
rename to operator/pkg/controller/onepassworditem/onepassworditem_test.go
index 381e336..e0a7911 100644
--- a/pkg/controller/onepassworditem/onepassworditem_test.go
+++ b/operator/pkg/controller/onepassworditem/onepassworditem_test.go
@@ -5,10 +5,10 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/1Password/onepassword-operator/pkg/mocks"
-	op "github.com/1Password/onepassword-operator/pkg/onepassword"
+	"github.com/1Password/onepassword-operator/operator/pkg/mocks"
+	op "github.com/1Password/onepassword-operator/operator/pkg/onepassword"
 
-	onepasswordv1 "github.com/1Password/onepassword-operator/pkg/apis/onepassword/v1"
+	onepasswordv1 "github.com/1Password/onepassword-operator/operator/pkg/apis/onepassword/v1"
 
 	"github.com/1Password/connect-sdk-go/onepassword"
 	"github.com/stretchr/testify/assert"
@@ -119,7 +119,7 @@ var tests = []testReconcileItem{
 				Name:      name,
 				Namespace: namespace,
 				Annotations: map[string]string{
-					op.VersionAnnotation: fmt.Sprint(version),
+					op.VersionAnnotation:  fmt.Sprint(version),
 					op.ItemPathAnnotation: itemPath,
 				},
 			},
@@ -131,7 +131,7 @@ var tests = []testReconcileItem{
 				Name:      name,
 				Namespace: namespace,
 				Annotations: map[string]string{
-					op.VersionAnnotation: fmt.Sprint(version),
+					op.VersionAnnotation:  fmt.Sprint(version),
 					op.ItemPathAnnotation: itemPath,
 				},
 			},
@@ -153,7 +153,7 @@ var tests = []testReconcileItem{
 				Name:      name,
 				Namespace: namespace,
 				Annotations: map[string]string{
-					op.VersionAnnotation: fmt.Sprint(version),
+					op.VersionAnnotation:  fmt.Sprint(version),
 					op.ItemPathAnnotation: itemPath,
 				},
 				Labels: map[string]string{},
@@ -167,7 +167,7 @@ var tests = []testReconcileItem{
 				Name:      name,
 				Namespace: namespace,
 				Annotations: map[string]string{
-					op.VersionAnnotation: "456",
+					op.VersionAnnotation:  "456",
 					op.ItemPathAnnotation: itemPath,
 				},
 				Labels: map[string]string{},
@@ -180,7 +180,7 @@ var tests = []testReconcileItem{
 				Name:      name,
 				Namespace: namespace,
 				Annotations: map[string]string{
-					op.VersionAnnotation: fmt.Sprint(version),
+					op.VersionAnnotation:  fmt.Sprint(version),
 					op.ItemPathAnnotation: itemPath,
 				},
 				Labels: map[string]string{},
diff --git a/pkg/kubernetessecrets/kubernetes_secrets_builder.go b/operator/pkg/kubernetessecrets/kubernetes_secrets_builder.go
similarity index 96%
rename from pkg/kubernetessecrets/kubernetes_secrets_builder.go
rename to operator/pkg/kubernetessecrets/kubernetes_secrets_builder.go
index 48e80fa..734899d 100644
--- a/pkg/kubernetessecrets/kubernetes_secrets_builder.go
+++ b/operator/pkg/kubernetessecrets/kubernetes_secrets_builder.go
@@ -7,13 +7,14 @@ import (
 	"regexp"
 	"strings"
 
+	"reflect"
+
 	"github.com/1Password/connect-sdk-go/onepassword"
-	"github.com/1Password/onepassword-operator/pkg/utils"
+	"github.com/1Password/onepassword-operator/operator/pkg/utils"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
-	"reflect"
 	kubeValidate "k8s.io/apimachinery/pkg/util/validation"
 
 	kubernetesClient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -60,7 +61,7 @@ func CreateKubernetesSecretFromItem(kubeClient kubernetesClient.Client, secretNa
 		return err
 	}
 
-	if ! reflect.DeepEqual(currentSecret.Annotations, secretAnnotations) || ! reflect.DeepEqual(currentSecret.Labels, labels) {
+	if !reflect.DeepEqual(currentSecret.Annotations, secretAnnotations) || !reflect.DeepEqual(currentSecret.Labels, labels) {
 		log.Info(fmt.Sprintf("Updating Secret %v at namespace '%v'", secret.Name, secret.Namespace))
 		currentSecret.ObjectMeta.Annotations = secretAnnotations
 		currentSecret.ObjectMeta.Labels = labels
diff --git a/pkg/kubernetessecrets/kubernetes_secrets_builder_test.go b/operator/pkg/kubernetessecrets/kubernetes_secrets_builder_test.go
similarity index 100%
rename from pkg/kubernetessecrets/kubernetes_secrets_builder_test.go
rename to operator/pkg/kubernetessecrets/kubernetes_secrets_builder_test.go
diff --git a/pkg/mocks/mocksecretserver.go b/operator/pkg/mocks/mocksecretserver.go
similarity index 100%
rename from pkg/mocks/mocksecretserver.go
rename to operator/pkg/mocks/mocksecretserver.go
diff --git a/pkg/onepassword/annotations.go b/operator/pkg/onepassword/annotations.go
similarity index 100%
rename from pkg/onepassword/annotations.go
rename to operator/pkg/onepassword/annotations.go
diff --git a/pkg/onepassword/annotations_test.go b/operator/pkg/onepassword/annotations_test.go
similarity index 100%
rename from pkg/onepassword/annotations_test.go
rename to operator/pkg/onepassword/annotations_test.go
diff --git a/pkg/onepassword/connect_setup.go b/operator/pkg/onepassword/connect_setup.go
similarity index 100%
rename from pkg/onepassword/connect_setup.go
rename to operator/pkg/onepassword/connect_setup.go
diff --git a/pkg/onepassword/connect_setup_test.go b/operator/pkg/onepassword/connect_setup_test.go
similarity index 100%
rename from pkg/onepassword/connect_setup_test.go
rename to operator/pkg/onepassword/connect_setup_test.go
diff --git a/pkg/onepassword/containers.go b/operator/pkg/onepassword/containers.go
similarity index 100%
rename from pkg/onepassword/containers.go
rename to operator/pkg/onepassword/containers.go
diff --git a/pkg/onepassword/containers_test.go b/operator/pkg/onepassword/containers_test.go
similarity index 100%
rename from pkg/onepassword/containers_test.go
rename to operator/pkg/onepassword/containers_test.go
diff --git a/pkg/onepassword/deployments.go b/operator/pkg/onepassword/deployments.go
similarity index 100%
rename from pkg/onepassword/deployments.go
rename to operator/pkg/onepassword/deployments.go
diff --git a/pkg/onepassword/deployments_test.go b/operator/pkg/onepassword/deployments_test.go
similarity index 100%
rename from pkg/onepassword/deployments_test.go
rename to operator/pkg/onepassword/deployments_test.go
diff --git a/pkg/onepassword/items.go b/operator/pkg/onepassword/items.go
similarity index 100%
rename from pkg/onepassword/items.go
rename to operator/pkg/onepassword/items.go
diff --git a/pkg/onepassword/object_generators_for_test.go b/operator/pkg/onepassword/object_generators_for_test.go
similarity index 100%
rename from pkg/onepassword/object_generators_for_test.go
rename to operator/pkg/onepassword/object_generators_for_test.go
diff --git a/pkg/onepassword/secret_update_handler.go b/operator/pkg/onepassword/secret_update_handler.go
similarity index 98%
rename from pkg/onepassword/secret_update_handler.go
rename to operator/pkg/onepassword/secret_update_handler.go
index ad2e8d6..899c188 100644
--- a/pkg/onepassword/secret_update_handler.go
+++ b/operator/pkg/onepassword/secret_update_handler.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"time"
 
-	kubeSecrets "github.com/1Password/onepassword-operator/pkg/kubernetessecrets"
-	"github.com/1Password/onepassword-operator/pkg/utils"
+	kubeSecrets "github.com/1Password/onepassword-operator/operator/pkg/kubernetessecrets"
+	"github.com/1Password/onepassword-operator/operator/pkg/utils"
 
 	"github.com/1Password/connect-sdk-go/connect"
 	"github.com/1Password/connect-sdk-go/onepassword"
diff --git a/pkg/onepassword/secret_update_handler_test.go b/operator/pkg/onepassword/secret_update_handler_test.go
similarity index 99%
rename from pkg/onepassword/secret_update_handler_test.go
rename to operator/pkg/onepassword/secret_update_handler_test.go
index 269a179..4155e4e 100644
--- a/pkg/onepassword/secret_update_handler_test.go
+++ b/operator/pkg/onepassword/secret_update_handler_test.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/1Password/onepassword-operator/pkg/mocks"
+	"github.com/1Password/onepassword-operator/operator/pkg/mocks"
 
 	"github.com/1Password/connect-sdk-go/onepassword"
 	"github.com/stretchr/testify/assert"
diff --git a/pkg/onepassword/uuid.go b/operator/pkg/onepassword/uuid.go
similarity index 100%
rename from pkg/onepassword/uuid.go
rename to operator/pkg/onepassword/uuid.go
diff --git a/pkg/onepassword/volumes.go b/operator/pkg/onepassword/volumes.go
similarity index 100%
rename from pkg/onepassword/volumes.go
rename to operator/pkg/onepassword/volumes.go
diff --git a/pkg/onepassword/volumes_test.go b/operator/pkg/onepassword/volumes_test.go
similarity index 100%
rename from pkg/onepassword/volumes_test.go
rename to operator/pkg/onepassword/volumes_test.go
diff --git a/pkg/utils/string.go b/operator/pkg/utils/string.go
similarity index 100%
rename from pkg/utils/string.go
rename to operator/pkg/utils/string.go
diff --git a/version/version.go b/operator/version/version.go
similarity index 100%
rename from version/version.go
rename to operator/version/version.go