diff --git a/charts/shield/templates/_helpers.tpl b/charts/shield/templates/_helpers.tpl
index 4460399f8..e5e8f50ab 100644
--- a/charts/shield/templates/_helpers.tpl
+++ b/charts/shield/templates/_helpers.tpl
@@ -34,12 +34,14 @@ Create chart name and version as used by the chart label.
 Common labels
 */}}
 {{- define "shield.labels" -}}
-helm.sh/chart: {{ include "shield.chart" . }}
-{{ include "shield.selector_labels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- $labels := dict "helm.sh/chart" (include "shield.chart" .) -}}
+  {{- $_ := merge $labels (include "shield.selector_labels" . | fromYaml) -}}
+  {{- if .Chart.AppVersion -}}
+    {{- $_ := set $labels "app.kubernetes.io/version" .Chart.AppVersion -}}
+  {{- end -}}
+  {{- $_ := set $labels "app.kubernetes.io/managed-by" .Release.Service -}}
+  {{- $_ := merge $labels .Values.labels -}}
+  {{- $labels | toYaml -}}
 {{- end }}
 
 {{/*
@@ -65,6 +67,15 @@ Component labels
 {{- end }}
 {{- end }}
 
+{{/*
+Common annotations
+*/}}
+{{- define "shield.annotations" -}}
+  {{- with .Values.annotations -}}
+    {{- . | toYaml -}}
+  {{- end -}}
+{{- end -}}
+
 {{- define "shield.component_name_label" -}}
 sysdig/component
 {{- end }}
diff --git a/charts/shield/templates/cluster/_annotations.tpl b/charts/shield/templates/cluster/_annotations.tpl
index ca814ee4e..951724710 100644
--- a/charts/shield/templates/cluster/_annotations.tpl
+++ b/charts/shield/templates/cluster/_annotations.tpl
@@ -1,13 +1,27 @@
+{{- define "cluster.annotations" -}}
+  {{- $annotations := merge (dict) .Values.cluster.annotations (include "shield.annotations" . | fromYaml) -}}
+  {{- with $annotations -}}
+    {{- . | toYaml -}}
+  {{- end -}}
+{{- end -}}
+
 {{- define "cluster.workload_annotations" -}}
-  {{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.cluster.workload_annotations -}}
+  {{- $workloadAnnotations := merge (dict) .Values.cluster.workload_annotations .Values.workload_annotations (include "cluster.annotations" . | fromYaml) -}}
   {{- with $workloadAnnotations -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "cluster.pod_annotations" -}}
-  {{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.cluster.pod_annotations -}}
+  {{- $podAnnotations := merge (dict) .Values.cluster.pod_annotations .Values.pod_annotations (include "cluster.annotations" . | fromYaml) -}}
   {{- with $podAnnotations -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
+
+{{- define "cluster.rbac_annotations" -}}
+  {{- $rbacAnnotations := merge (dict) .Values.cluster.rbac.annotations (include "cluster.annotations" . | fromYaml) -}}
+  {{- with $rbacAnnotations -}}
+    {{- . | toYaml -}}
+  {{- end -}}
+{{- end -}}
diff --git a/charts/shield/templates/cluster/_labels.tpl b/charts/shield/templates/cluster/_labels.tpl
index 220f5f16e..93bbeadc8 100644
--- a/charts/shield/templates/cluster/_labels.tpl
+++ b/charts/shield/templates/cluster/_labels.tpl
@@ -2,7 +2,7 @@
 Common labels
 */}}
 {{- define "cluster.labels" -}}
-  {{- $labels := merge (dict) (include "cluster.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
+  {{- $labels := merge (dict) .Values.cluster.labels (include "cluster.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
   {{- with $labels -}}
     {{- . | toYaml -}}
   {{- end -}}
@@ -24,14 +24,14 @@ Selector labels
 {{- end }}
 
 {{- define "cluster.workload_labels" -}}
-  {{- $workloadLabels := merge (dict) (dict) .Values.workload_labels .Values.cluster.workload_labels (include "cluster.labels" . | fromYaml) }}
+  {{- $workloadLabels := merge (dict) .Values.cluster.workload_labels .Values.workload_labels (include "cluster.labels" . | fromYaml) }}
   {{- with $workloadLabels -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "cluster.pod_labels" -}}
-  {{- $podLabels := merge (dict) .Values.pod_labels .Values.cluster.pod_labels (include "cluster.labels" . | fromYaml) }}
+  {{- $podLabels := merge (dict) .Values.cluster.pod_labels .Values.pod_labels (include "cluster.labels" . | fromYaml) }}
   {{- with $podLabels -}}
     {{- . | toYaml -}}
   {{- end -}}
diff --git a/charts/shield/templates/cluster/clusterrole.yaml b/charts/shield/templates/cluster/clusterrole.yaml
index f394166bf..16e0720be 100644
--- a/charts/shield/templates/cluster/clusterrole.yaml
+++ b/charts/shield/templates/cluster/clusterrole.yaml
@@ -5,9 +5,10 @@ metadata:
   name: {{ include "cluster.fullname" . }}
   labels:
     {{- include "cluster.rbac_labels" . | nindent 4 }}
-  {{- with .Values.cluster.rbac.annotations }}
+  {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 rules:
 {{- if (include "cluster.audit_enabled" .) }}
diff --git a/charts/shield/templates/cluster/clusterrolebinding.yaml b/charts/shield/templates/cluster/clusterrolebinding.yaml
index 60ac13ac4..b6d5c395f 100644
--- a/charts/shield/templates/cluster/clusterrolebinding.yaml
+++ b/charts/shield/templates/cluster/clusterrolebinding.yaml
@@ -5,9 +5,10 @@ metadata:
   name: {{ include "cluster.fullname" . }}
   labels:
     {{- include "cluster.rbac_labels" . | nindent 4 }}
-  {{- with .Values.cluster.rbac.annotations }}
+  {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/charts/shield/templates/cluster/configmap.yaml b/charts/shield/templates/cluster/configmap.yaml
index d93cb2d57..e7067f6ea 100644
--- a/charts/shield/templates/cluster/configmap.yaml
+++ b/charts/shield/templates/cluster/configmap.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster.labels" . | nindent 4 }}
+  {{- $annotations := (include "cluster.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 data:
   cluster-shield.yaml: |
     {{- include "cluster.configmap" . | fromYaml | toYaml | nindent 4 }}
diff --git a/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml b/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml
index 239e6ee25..e341b3be7 100644
--- a/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml
+++ b/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml
@@ -5,6 +5,10 @@ metadata:
   annotations:
     kubernetes.io/description: |
       This provides the minimum requirements to the Sysdig Shield to run in the Openshift.
+    {{- $clusterAnnotations := (include "cluster.annotations" .) }}
+    {{- if $clusterAnnotations }}
+    {{- $clusterAnnotations | nindent 4 }}
+    {{- end }}
   name: {{ include "cluster.fullname" . }}
   labels:
     {{- include "cluster.labels" . | nindent 4 }}
diff --git a/charts/shield/templates/cluster/role.yaml b/charts/shield/templates/cluster/role.yaml
index 4f4c08fd1..dac3cb3f9 100644
--- a/charts/shield/templates/cluster/role.yaml
+++ b/charts/shield/templates/cluster/role.yaml
@@ -6,9 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster.rbac_labels" . | nindent 4 }}
-  {{- with .Values.cluster.rbac.annotations }}
+  {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 rules:
 {{- if (and (include "cluster.posture_enabled" .) (include "cluster.need_posture_lease" .) .) }}
diff --git a/charts/shield/templates/cluster/rolebinding.yaml b/charts/shield/templates/cluster/rolebinding.yaml
index f28fea1cc..c672542d0 100644
--- a/charts/shield/templates/cluster/rolebinding.yaml
+++ b/charts/shield/templates/cluster/rolebinding.yaml
@@ -6,9 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster.rbac_labels" . | nindent 4 }}
-  {{- with .Values.cluster.rbac.annotations }}
+  {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/charts/shield/templates/cluster/secret.yaml b/charts/shield/templates/cluster/secret.yaml
index 4d806cb04..b14ccf486 100644
--- a/charts/shield/templates/cluster/secret.yaml
+++ b/charts/shield/templates/cluster/secret.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster.labels" . | nindent 4 }}
+  {{- $annotations := (include "cluster.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 data:
   {{- include "cluster.secret" . | nindent 2 }}
diff --git a/charts/shield/templates/cluster/service-container-vulnerability-management.yaml b/charts/shield/templates/cluster/service-container-vulnerability-management.yaml
index 7a79b3dfa..dfdf5f9c4 100644
--- a/charts/shield/templates/cluster/service-container-vulnerability-management.yaml
+++ b/charts/shield/templates/cluster/service-container-vulnerability-management.yaml
@@ -9,9 +9,12 @@ metadata:
     {{- if and .Values.cluster.service .Values.cluster.service.labels }}
       {{- toYaml .Values.cluster.service.labels | nindent 4 }}
     {{- end }}
-  {{- if and .Values.cluster.service .Values.cluster.service.annotations }}
+  {{- $shieldAnnotations := (include "cluster.annotations" .) }}
+  {{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }}
+  {{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }}
+  {{- if $allAnnotations }}
   annotations:
-    {{- toYaml .Values.cluster.service.annotations | nindent 4 }}
+    {{- toYaml $allAnnotations | nindent 4 }}
   {{- end }}
 spec:
   {{- if and .Values.cluster.service .Values.cluster.service.type }}
diff --git a/charts/shield/templates/cluster/service.yaml b/charts/shield/templates/cluster/service.yaml
index 0bc09965b..3c693e70a 100644
--- a/charts/shield/templates/cluster/service.yaml
+++ b/charts/shield/templates/cluster/service.yaml
@@ -8,9 +8,12 @@ metadata:
     {{- if and .Values.cluster.service .Values.cluster.service.labels }}
       {{- toYaml .Values.cluster.service.labels | nindent 4 }}
     {{- end }}
-  {{- if and .Values.cluster.service .Values.cluster.service.annotations }}
+  {{- $shieldAnnotations := (include "cluster.annotations" .) }}
+  {{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }}
+  {{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }}
+  {{- if $allAnnotations }}
   annotations:
-    {{- toYaml .Values.cluster.service.annotations | nindent 4 }}
+    {{- toYaml $allAnnotations | nindent 4 }}
   {{- end }}
 spec:
   {{- if and .Values.cluster.service .Values.cluster.service.type }}
diff --git a/charts/shield/templates/cluster/serviceaccount.yaml b/charts/shield/templates/cluster/serviceaccount.yaml
index e6a49b1f2..8d8be8eae 100644
--- a/charts/shield/templates/cluster/serviceaccount.yaml
+++ b/charts/shield/templates/cluster/serviceaccount.yaml
@@ -6,8 +6,9 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster.rbac_labels" . | nindent 4 }}
-  {{- with .Values.cluster.rbac.annotations }}
+  {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 {{- end }}
diff --git a/charts/shield/templates/common/credentials-secret.yaml b/charts/shield/templates/common/credentials-secret.yaml
index d446ba037..b7f1a6691 100644
--- a/charts/shield/templates/common/credentials-secret.yaml
+++ b/charts/shield/templates/common/credentials-secret.yaml
@@ -7,6 +7,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "common.labels" . | nindent 4 }}
+  {{- $annotations := (include "shield.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 data:
   access-key: {{ .Values.sysdig_endpoint.access_key | b64enc | quote }}
@@ -20,6 +25,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "common.labels" . | nindent 4 }}
+  {{- $annotations := (include "shield.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 data:
   SECURE_API_TOKEN: {{ .Values.sysdig_endpoint.secure_api_token | b64enc | quote }}
diff --git a/charts/shield/templates/common/custom-ca-secret.yaml b/charts/shield/templates/common/custom-ca-secret.yaml
index 83d93e0e6..b1a2271e2 100644
--- a/charts/shield/templates/common/custom-ca-secret.yaml
+++ b/charts/shield/templates/common/custom-ca-secret.yaml
@@ -6,6 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "common.labels" . | nindent 4 }}
+  {{- $annotations := (include "shield.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 data:
   {{ include "common.custom_ca.key_name" . }}: {{ include "common.custom_ca.cert" . | b64enc | quote }}
 {{- end }}
diff --git a/charts/shield/templates/common/proxy-secret.yaml b/charts/shield/templates/common/proxy-secret.yaml
index 4ac716ad1..1567dcb90 100644
--- a/charts/shield/templates/common/proxy-secret.yaml
+++ b/charts/shield/templates/common/proxy-secret.yaml
@@ -6,6 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "common.labels" . | nindent 4 }}
+  {{- $annotations := (include "shield.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 data:
   {{- if and .Values.proxy.http_proxy (not .Values.proxy.http_proxy_existing_secret) }}
   http_proxy: {{ .Values.proxy.http_proxy | b64enc | quote }}
diff --git a/charts/shield/templates/host/_annotations.tpl b/charts/shield/templates/host/_annotations.tpl
index 7814f8d95..9fd978834 100644
--- a/charts/shield/templates/host/_annotations.tpl
+++ b/charts/shield/templates/host/_annotations.tpl
@@ -1,12 +1,19 @@
+{{- define "host.annotations" -}}
+  {{- $annotations := merge (dict) .Values.host.annotations (include "shield.annotations" . | fromYaml) -}}
+  {{- with $annotations -}}
+    {{- . | toYaml -}}
+  {{- end -}}
+{{- end -}}
+
 {{- define "host.workload_annotations" -}}
-  {{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.host.workload_annotations -}}
+  {{- $workloadAnnotations := merge (dict) .Values.host.workload_annotations .Values.workload_annotations (include "host.annotations" . | fromYaml) -}}
   {{- with $workloadAnnotations -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "host.pod_annotations" -}}
-  {{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.host.pod_annotations -}}
+  {{- $podAnnotations := merge (dict) .Values.host.pod_annotations .Values.pod_annotations (include "host.annotations" . | fromYaml) -}}
   {{- if (include "common.cluster_type.is_gke_autopilot" . ) -}}
     {{- $_ := set $podAnnotations "autopilot.gke.io/no-connect" "true" -}}
   {{- end -}}
@@ -15,3 +22,10 @@
   {{- end -}}
   {{- $podAnnotations | toYaml -}}
 {{- end -}}
+
+{{- define "host.rbac_annotations" -}}
+  {{- $rbacAnnotations := merge (dict) .Values.host.rbac.annotations (include "host.annotations" . | fromYaml) -}}
+  {{- with $rbacAnnotations -}}
+    {{- . | toYaml -}}
+  {{- end -}}
+{{- end -}}
diff --git a/charts/shield/templates/host/_labels.tpl b/charts/shield/templates/host/_labels.tpl
index c5b1765da..0f3e14539 100644
--- a/charts/shield/templates/host/_labels.tpl
+++ b/charts/shield/templates/host/_labels.tpl
@@ -13,7 +13,7 @@ GKE Autopilot labels
 Common labels
 */}}
 {{- define "host.labels" -}}
-  {{- $labels := merge (dict) (include "host.gke_autopilot_labels" . | fromYaml) (include "host.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
+  {{- $labels := merge (dict) .Values.host.labels (include "host.gke_autopilot_labels" . | fromYaml) (include "host.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
   {{- with $labels -}}
     {{- . | toYaml -}}
   {{- end -}}
@@ -35,14 +35,14 @@ Selector labels
 {{- end }}
 
 {{- define "host.workload_labels" -}}
-  {{- $workloadLabels := merge (dict) .Values.workload_labels .Values.host.workload_labels (include "host.labels" . | fromYaml) }}
+  {{- $workloadLabels := merge (dict) .Values.host.workload_labels .Values.workload_labels (include "host.labels" . | fromYaml) }}
   {{- with $workloadLabels -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "host.pod_labels" -}}
-  {{- $podLabels := merge (dict) .Values.pod_labels .Values.host.pod_labels (include "host.labels" . | fromYaml) }}
+  {{- $podLabels := merge (dict) .Values.host.pod_labels .Values.pod_labels (include "host.labels" . | fromYaml) }}
   {{- with $podLabels -}}
     {{- . | toYaml -}}
   {{- end -}}
diff --git a/charts/shield/templates/host/_windows_annotations.tpl b/charts/shield/templates/host/_windows_annotations.tpl
index a0f264a07..484aa4bd9 100644
--- a/charts/shield/templates/host/_windows_annotations.tpl
+++ b/charts/shield/templates/host/_windows_annotations.tpl
@@ -1,11 +1,18 @@
+{{- define "host_windows.annotations" -}}
+  {{- $annotations := merge (dict) .Values.host_windows.annotations (include "shield.annotations" . | fromYaml) -}}
+  {{- with $annotations -}}
+    {{- . | toYaml -}}
+  {{- end -}}
+{{- end -}}
+
 {{- define "host.windows.workload_annotations" -}}
-  {{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.host_windows.workload_annotations -}}
+  {{- $workloadAnnotations := merge (dict) .Values.host_windows.workload_annotations .Values.workload_annotations (include "host_windows.annotations" . | fromYaml) -}}
   {{- with $workloadAnnotations -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "host.windows.pod_annotations" -}}
-  {{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.host_windows.pod_annotations -}}
+  {{- $podAnnotations := merge (dict) .Values.host_windows.pod_annotations .Values.pod_annotations (include "host_windows.annotations" . | fromYaml) -}}
   {{- $podAnnotations | toYaml -}}
 {{- end -}}
diff --git a/charts/shield/templates/host/_windows_labels.tpl b/charts/shield/templates/host/_windows_labels.tpl
index be6a65630..5a0f32ae6 100644
--- a/charts/shield/templates/host/_windows_labels.tpl
+++ b/charts/shield/templates/host/_windows_labels.tpl
@@ -2,7 +2,7 @@
 Common labels
 */}}
 {{- define "host.windows.labels" -}}
-  {{- $labels := merge (dict) (include "host.windows.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
+  {{- $labels := merge (dict) .Values.host_windows.labels (include "host.windows.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
   {{- with $labels -}}
     {{- . | toYaml -}}
   {{- end -}}
@@ -24,14 +24,14 @@ Selector labels
 {{- end }}
 
 {{- define "host.windows.workload_labels" -}}
-  {{- $workloadLabels := merge (dict) .Values.workload_labels .Values.host_windows.workload_labels (include "host.windows.labels" . | fromYaml) }}
+  {{- $workloadLabels := merge (dict) .Values.host_windows.workload_labels .Values.workload_labels (include "host.windows.labels" . | fromYaml) }}
   {{- with $workloadLabels -}}
     {{- . | toYaml -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "host.windows.pod_labels" -}}
-  {{- $podLabels := merge (dict) .Values.pod_labels .Values.host_windows.pod_labels (include "host.windows.labels" . | fromYaml) }}
+  {{- $podLabels := merge (dict) .Values.host_windows.pod_labels .Values.pod_labels (include "host.windows.labels" . | fromYaml) }}
   {{- with $podLabels -}}
     {{- . | toYaml -}}
   {{- end -}}
diff --git a/charts/shield/templates/host/clusterrole.yaml b/charts/shield/templates/host/clusterrole.yaml
index 5204b840c..bf8925de3 100644
--- a/charts/shield/templates/host/clusterrole.yaml
+++ b/charts/shield/templates/host/clusterrole.yaml
@@ -5,9 +5,10 @@ metadata:
   name: {{ include "host.fullname" . }}
   labels:
     {{- include "host.rbac_labels" . | nindent 4 }}
-  {{- with .Values.host.rbac.annotations }}
+  {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 rules:
   - apiGroups:
diff --git a/charts/shield/templates/host/clusterrolebinding.yaml b/charts/shield/templates/host/clusterrolebinding.yaml
index 3c40882e1..017ddca50 100644
--- a/charts/shield/templates/host/clusterrolebinding.yaml
+++ b/charts/shield/templates/host/clusterrolebinding.yaml
@@ -5,9 +5,10 @@ metadata:
   name: {{ include "host.fullname" . }}
   labels:
     {{- include "host.rbac_labels" . | nindent 4 }}
-  {{- with .Values.host.rbac.annotations }}
+  {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/charts/shield/templates/host/configmap-windows.yaml b/charts/shield/templates/host/configmap-windows.yaml
index b2170ba3a..e991a8ee2 100644
--- a/charts/shield/templates/host/configmap-windows.yaml
+++ b/charts/shield/templates/host/configmap-windows.yaml
@@ -6,6 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.labels" . | nindent 4 }}
+  {{- $annotations := (include "host_windows.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 data:
   host-shield.yaml: |
     {{- include "host.windows.host_shield_config" . | nindent 4 }}
diff --git a/charts/shield/templates/host/configmap.yaml b/charts/shield/templates/host/configmap.yaml
index e7906acec..de59942ef 100644
--- a/charts/shield/templates/host/configmap.yaml
+++ b/charts/shield/templates/host/configmap.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.labels" . | nindent 4 }}
+  {{- $annotations := (include "host.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 data:
   host-shield.yaml: |
     {{- include "host.host_shield_config" . | nindent 4 }}
diff --git a/charts/shield/templates/host/gke-allowlist-synchronizer.yaml b/charts/shield/templates/host/gke-allowlist-synchronizer.yaml
index 4d13ed10f..303e7c12b 100644
--- a/charts/shield/templates/host/gke-allowlist-synchronizer.yaml
+++ b/charts/shield/templates/host/gke-allowlist-synchronizer.yaml
@@ -7,6 +7,10 @@ metadata:
   annotations:
     helm.sh/hook: "pre-install,pre-upgrade"
     helm.sh/hook-delete-policy: "before-hook-creation"
+    {{- $shieldAnnotations := (include "host.annotations" .) }}
+    {{- if $shieldAnnotations }}
+    {{- $shieldAnnotations | nindent 4 }}
+    {{- end }}
   labels:
     {{- include "host.labels" . | nindent 4 }}
 spec:
diff --git a/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml b/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml
index 348b300ed..478e2d62d 100644
--- a/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml
+++ b/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml
@@ -10,8 +10,9 @@ metadata:
     helm.sh/hook: "pre-install,pre-upgrade"
     helm.sh/hook-weight: "-5"
     helm.sh/hook-delete-policy: "before-hook-creation"
-    {{- with .Values.host.rbac.annotations }}
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+    {{- if $rbacAnnotations }}
+    {{- $rbacAnnotations | nindent 4 }}
     {{- end }}
 rules:
   - apiGroups:
diff --git a/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml b/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml
index 63872ef52..90d319fc2 100644
--- a/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml
+++ b/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml
@@ -10,8 +10,9 @@ metadata:
     helm.sh/hook: "pre-install,pre-upgrade"
     helm.sh/hook-weight: "-5"
     helm.sh/hook-delete-policy: "before-hook-creation"
-    {{- with .Values.host.rbac.annotations }}
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+    {{- if $rbacAnnotations }}
+    {{- $rbacAnnotations | nindent 4 }}
     {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/charts/shield/templates/host/gke-allowlist-waiter-job.yaml b/charts/shield/templates/host/gke-allowlist-waiter-job.yaml
index 552621c0a..65e82e3dd 100644
--- a/charts/shield/templates/host/gke-allowlist-waiter-job.yaml
+++ b/charts/shield/templates/host/gke-allowlist-waiter-job.yaml
@@ -10,6 +10,10 @@ metadata:
     helm.sh/hook: "pre-install,pre-upgrade"
     helm.sh/hook-weight: "5"
     helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded,hook-failed"
+    {{- $shieldAnnotations := (include "host.annotations" .) }}
+    {{- if $shieldAnnotations }}
+    {{- $shieldAnnotations | nindent 4 }}
+    {{- end }}
 spec:
   backoffLimit: 3
   activeDeadlineSeconds: {{ .Values.gke_autopilot.allowlist_waiter.active_deadline_seconds }}
@@ -22,9 +26,10 @@ spec:
                Autopilot block this Pod on the very allowlist it is waiting to
                load. */}}
         {{- include "shield.labels" . | nindent 8 }}
-      {{- with .Values.pod_annotations }}
+      {{- $podAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.pod_annotations }}
+      {{- if $podAnnotations }}
       annotations:
-        {{- toYaml . | nindent 8 }}
+        {{- toYaml $podAnnotations | nindent 8 }}
       {{- end }}
     spec:
       restartPolicy: OnFailure
diff --git a/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml b/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml
index 702fb6264..ff7929bf1 100644
--- a/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml
+++ b/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml
@@ -11,8 +11,9 @@ metadata:
     helm.sh/hook: "pre-install,pre-upgrade"
     helm.sh/hook-weight: "-5"
     helm.sh/hook-delete-policy: "before-hook-creation"
-    {{- with .Values.host.rbac.annotations }}
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+    {{- if $rbacAnnotations }}
+    {{- $rbacAnnotations | nindent 4 }}
     {{- end }}
 {{- end }}
 {{- end -}}
diff --git a/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml b/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml
index 946a78a10..5c179547a 100644
--- a/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml
+++ b/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml
@@ -7,9 +7,10 @@ metadata:
   name: {{ include "host.fullname" . }}-cluster-monitoring-view
   labels:
     {{- include "host.rbac_labels" . | nindent 4 }}
-  {{- with .Values.host.rbac.annotations }}
+  {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 roleRef:
   kind: ClusterRole
diff --git a/charts/shield/templates/host/openshift-securitycontextconstraint.yaml b/charts/shield/templates/host/openshift-securitycontextconstraint.yaml
index a7f05293d..727a1e74c 100644
--- a/charts/shield/templates/host/openshift-securitycontextconstraint.yaml
+++ b/charts/shield/templates/host/openshift-securitycontextconstraint.yaml
@@ -5,6 +5,10 @@ metadata:
   annotations:
     kubernetes.io/description: |
       This provides the minimum requirements to the Sysdig Shield to run in the Openshift.
+    {{- $hostAnnotations := (include "host.annotations" .) }}
+    {{- if $hostAnnotations }}
+    {{- $hostAnnotations | nindent 4 }}
+    {{- end }}
   name: {{ include "host.fullname" . }}
   labels:
     {{- include "host.labels" . | nindent 4 }}
diff --git a/charts/shield/templates/host/role.yaml b/charts/shield/templates/host/role.yaml
index 89aea8a49..cb895c073 100644
--- a/charts/shield/templates/host/role.yaml
+++ b/charts/shield/templates/host/role.yaml
@@ -6,9 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.rbac_labels" . | nindent 4 }}
-  {{- with .Values.host.rbac.annotations }}
+  {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 rules:
   - apiGroups:
diff --git a/charts/shield/templates/host/rolebinding.yaml b/charts/shield/templates/host/rolebinding.yaml
index 6ae0710de..4f21f1db8 100644
--- a/charts/shield/templates/host/rolebinding.yaml
+++ b/charts/shield/templates/host/rolebinding.yaml
@@ -6,9 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.rbac_labels" . | nindent 4 }}
-  {{- with .Values.host.rbac.annotations }}
+  {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/charts/shield/templates/host/secrets.yaml b/charts/shield/templates/host/secrets.yaml
index 32c05a740..b9119f569 100644
--- a/charts/shield/templates/host/secrets.yaml
+++ b/charts/shield/templates/host/secrets.yaml
@@ -7,6 +7,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.labels" . | nindent 4 }}
+  {{- $annotations := (include "host.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 data:
   password: {{ (include "host.rapid_response_password" .) | b64enc | quote }}
@@ -22,6 +27,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.labels" . | nindent 4 }}
+  {{- $annotations := (include "host.annotations" .) }}
+  {{- if $annotations }}
+  annotations:
+    {{- $annotations | nindent 4 }}
+  {{- end }}
 data:
   local_forwarder_config.yaml: {{ pick .Values.features.investigations.event_forwarder "integrations" | toYaml | b64enc | quote }}
 {{- end }}
diff --git a/charts/shield/templates/host/serviceaccount.yaml b/charts/shield/templates/host/serviceaccount.yaml
index 5d060dcc7..aa12f405f 100644
--- a/charts/shield/templates/host/serviceaccount.yaml
+++ b/charts/shield/templates/host/serviceaccount.yaml
@@ -6,8 +6,9 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "host.rbac_labels" . | nindent 4 }}
-  {{- with .Values.host.rbac.annotations }}
+  {{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
+  {{- if $rbacAnnotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- $rbacAnnotations | nindent 4 }}
   {{- end }}
 {{- end }}
diff --git a/charts/shield/tests/cluster/configmap_test.yaml b/charts/shield/tests/cluster/configmap_test.yaml
index 2ec54f521..617585aef 100644
--- a/charts/shield/tests/cluster/configmap_test.yaml
+++ b/charts/shield/tests/cluster/configmap_test.yaml
@@ -1,6 +1,8 @@
 suite: Cluster - Configmap
 templates:
   - templates/cluster/configmap.yaml
+chart:
+  version: 1.2.3-helmtest
 release:
   name: release-name
   namespace: shield-namespace
@@ -1040,3 +1042,95 @@ tests:
             cluster_scanner:
               runtime_status_integrator:
                 nats_server: {}
+
+  - it: Default labels present on ConfigMap
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            helm.sh/chart: shield-1.2.3-helmtest
+            app.kubernetes.io/name: shield
+            app.kubernetes.io/instance: release-name
+            app.kubernetes.io/version: "1.0.0"
+            app.kubernetes.io/managed-by: Helm
+            sysdig/component: cluster
+
+  - it: No annotations by default on ConfigMap
+    asserts:
+      - exists:
+          path: metadata.annotations
+        not: true
+
+  - it: cluster.annotations applied to ConfigMap
+    set:
+      cluster:
+        annotations:
+          cluster-annotation-key: cluster-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["cluster-annotation-key"]
+          value: cluster-annotation-value
+
+  - it: cluster.annotations merged with global annotations on ConfigMap
+    set:
+      annotations:
+        global-key: global-value
+      cluster:
+        annotations:
+          cluster-key: cluster-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["cluster-key"]
+          value: cluster-value
+
+  - it: cluster.labels applied to ConfigMap
+    set:
+      cluster:
+        labels:
+          cluster-label-key: cluster-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["cluster-label-key"]
+          value: cluster-label-value
+
+  - it: cluster.labels merged with global labels on ConfigMap
+    set:
+      labels:
+        global-key: global-value
+      cluster:
+        labels:
+          cluster-key: cluster-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["cluster-key"]
+          value: cluster-value
+
+  - it: cluster.annotations overrides global annotations on ConfigMap
+    set:
+      annotations:
+        env: global
+      cluster:
+        annotations:
+          env: cluster
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: cluster
+
+  - it: cluster.labels overrides global labels on ConfigMap
+    set:
+      labels:
+        env: global
+      cluster:
+        labels:
+          env: cluster
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: cluster
diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml
index 76aaa57f8..5dab37f92 100644
--- a/charts/shield/tests/cluster/deployment_test.yaml
+++ b/charts/shield/tests/cluster/deployment_test.yaml
@@ -290,6 +290,7 @@ tests:
       - isSubset:
           path: metadata.labels
           content:
+            helm.sh/chart: shield-1.2.3-helmtest
             app.kubernetes.io/instance: release-name
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: shield
@@ -1526,3 +1527,369 @@ tests:
             name: SYSDIG_SHIELD_CHART_VERSION
             value: 1.2.3-helmtest
     template: templates/cluster/deployment.yaml
+
+  - it: Global labels applied to workload metadata
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: metadata.labels["global-label-key"]
+          value: global-label-value
+    template: templates/cluster/deployment.yaml
+
+  - it: Global labels applied to pod metadata
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: spec.template.metadata.labels["global-label-key"]
+          value: global-label-value
+    template: templates/cluster/deployment.yaml
+
+  - it: Global labels merged with component workload and pod labels
+    set:
+      labels:
+        global-key: global-value
+      workload_labels:
+        global-workload-key: global-workload-value
+      pod_labels:
+        global-pod-key: global-pod-value
+      cluster:
+        image:
+          tag: 1.1.1
+        workload_labels:
+          component-workload-key: component-workload-value
+        pod_labels:
+          component-pod-key: component-pod-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["global-workload-key"]
+          value: global-workload-value
+      - equal:
+          path: metadata.labels["component-workload-key"]
+          value: component-workload-value
+      - equal:
+          path: spec.template.metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: spec.template.metadata.labels["global-pod-key"]
+          value: global-pod-value
+      - equal:
+          path: spec.template.metadata.labels["component-pod-key"]
+          value: component-pod-value
+    template: templates/cluster/deployment.yaml
+
+  - it: Global annotations applied to workload metadata
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+    template: templates/cluster/deployment.yaml
+
+  - it: Global annotations applied to pod metadata
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: spec.template.metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+    template: templates/cluster/deployment.yaml
+
+  - it: Global annotations merged with component workload and pod annotations
+    set:
+      annotations:
+        global-key: global-value
+      workload_annotations:
+        global-workload-key: global-workload-value
+      pod_annotations:
+        global-pod-key: global-pod-value
+      cluster:
+        workload_annotations:
+          component-workload-key: component-workload-value
+        pod_annotations:
+          component-pod-key: component-pod-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["global-workload-key"]
+          value: global-workload-value
+      - equal:
+          path: metadata.annotations["component-workload-key"]
+          value: component-workload-value
+      - equal:
+          path: spec.template.metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: spec.template.metadata.annotations["global-pod-key"]
+          value: global-pod-value
+      - equal:
+          path: spec.template.metadata.annotations["component-pod-key"]
+          value: component-pod-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.annotations applied to Deployment workload metadata
+    set:
+      cluster:
+        annotations:
+          cluster-annotation-key: cluster-annotation-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: metadata.annotations["cluster-annotation-key"]
+          value: cluster-annotation-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.annotations applied to Deployment pod metadata
+    set:
+      cluster:
+        annotations:
+          cluster-annotation-key: cluster-annotation-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: spec.template.metadata.annotations["cluster-annotation-key"]
+          value: cluster-annotation-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.annotations merged with global annotations and workload annotations
+    set:
+      annotations:
+        global-key: global-value
+      cluster:
+        annotations:
+          cluster-key: cluster-value
+        workload_annotations:
+          workload-key: workload-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["cluster-key"]
+          value: cluster-value
+      - equal:
+          path: metadata.annotations["workload-key"]
+          value: workload-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.labels applied to Deployment workload metadata
+    set:
+      cluster:
+        labels:
+          cluster-label-key: cluster-label-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: metadata.labels["cluster-label-key"]
+          value: cluster-label-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.labels applied to Deployment pod metadata
+    set:
+      cluster:
+        labels:
+          cluster-label-key: cluster-label-value
+    asserts:
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: release-name-shield-cluster
+          namespace: shield-namespace
+      - equal:
+          path: spec.template.metadata.labels["cluster-label-key"]
+          value: cluster-label-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.labels merged with global and workload labels
+    set:
+      labels:
+        global-key: global-value
+      cluster:
+        labels:
+          cluster-key: cluster-value
+        workload_labels:
+          workload-key: workload-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["cluster-key"]
+          value: cluster-value
+      - equal:
+          path: metadata.labels["workload-key"]
+          value: workload-value
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.annotations overrides global annotations on Deployment workload
+    set:
+      annotations:
+        env: global
+      cluster:
+        annotations:
+          env: cluster
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: cluster
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.annotations overrides global annotations on Deployment pod
+    set:
+      annotations:
+        env: global
+      cluster:
+        annotations:
+          env: cluster
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["env"]
+          value: cluster
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.workload_annotations overrides cluster.annotations on Deployment workload
+    set:
+      cluster:
+        annotations:
+          env: component
+        workload_annotations:
+          env: workload
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: workload
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.pod_annotations overrides cluster.annotations on Deployment pod
+    set:
+      cluster:
+        annotations:
+          env: component
+        pod_annotations:
+          env: pod
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["env"]
+          value: pod
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.workload_annotations overrides global workload_annotations on Deployment
+    set:
+      workload_annotations:
+        env: global-workload
+      cluster:
+        workload_annotations:
+          env: component-workload
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: component-workload
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.labels overrides global labels on Deployment workload
+    set:
+      labels:
+        env: global
+      cluster:
+        labels:
+          env: cluster
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: cluster
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.labels overrides global labels on Deployment pod
+    set:
+      labels:
+        env: global
+      cluster:
+        labels:
+          env: cluster
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["env"]
+          value: cluster
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.workload_labels overrides cluster.labels on Deployment workload
+    set:
+      cluster:
+        labels:
+          env: component
+        workload_labels:
+          env: workload
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: workload
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.pod_labels overrides cluster.labels on Deployment pod
+    set:
+      cluster:
+        labels:
+          env: component
+        pod_labels:
+          env: pod
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["env"]
+          value: pod
+    template: templates/cluster/deployment.yaml
+
+  - it: cluster.workload_labels overrides global workload_labels on Deployment
+    set:
+      workload_labels:
+        env: global-workload
+      cluster:
+        workload_labels:
+          env: component-workload
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: component-workload
+    template: templates/cluster/deployment.yaml
diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml
index c6d6b3f78..ec7c2fb2d 100644
--- a/charts/shield/tests/cluster/service_test.yaml
+++ b/charts/shield/tests/cluster/service_test.yaml
@@ -1,6 +1,8 @@
 suite: Cluster - Service
 templates:
   - templates/cluster/service.yaml
+chart:
+  version: 1.2.3-helmtest
 release:
   name: release-name
   namespace: shield-namespace
@@ -227,6 +229,18 @@ tests:
           path: spec.type
           value: NodePort
 
+  - it: Default labels present on Service
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            helm.sh/chart: shield-1.2.3-helmtest
+            app.kubernetes.io/name: shield
+            app.kubernetes.io/instance: release-name
+            app.kubernetes.io/version: "1.0.0"
+            app.kubernetes.io/managed-by: Helm
+            sysdig/component: cluster
+
   - it: Custom Lables
     set:
       cluster:
@@ -277,3 +291,135 @@ tests:
       - equal:
           path: metadata.annotations["custom-2"]
           value: annotation-2
+
+  - it: Global labels applied to Service
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.labels["global-label-key"]
+          value: global-label-value
+
+  - it: Global annotations applied to Service
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+
+  - it: Global annotations merged with service annotations
+    set:
+      annotations:
+        global-key: global-value
+      cluster:
+        service:
+          annotations:
+            service-key: service-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["service-key"]
+          value: service-value
+
+  - it: cluster.annotations applied to Service
+    set:
+      cluster:
+        annotations:
+          cluster-annotation-key: cluster-annotation-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.annotations["cluster-annotation-key"]
+          value: cluster-annotation-value
+
+  - it: cluster.annotations merged with global and service annotations on Service
+    set:
+      annotations:
+        global-key: global-value
+      cluster:
+        annotations:
+          cluster-key: cluster-value
+        service:
+          annotations:
+            service-key: service-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["cluster-key"]
+          value: cluster-value
+      - equal:
+          path: metadata.annotations["service-key"]
+          value: service-value
+
+  - it: cluster.labels applied to Service
+    set:
+      cluster:
+        labels:
+          cluster-label-key: cluster-label-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.labels["cluster-label-key"]
+          value: cluster-label-value
+
+  - it: cluster.labels merged with global labels on Service
+    set:
+      labels:
+        global-key: global-value
+      cluster:
+        labels:
+          cluster-key: cluster-value
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["cluster-key"]
+          value: cluster-value
+
+  - it: cluster.annotations overrides global annotations on Service
+    set:
+      annotations:
+        env: global
+      cluster:
+        annotations:
+          env: cluster
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.annotations["env"]
+          value: cluster
+
+  - it: cluster.labels overrides global labels on Service
+    set:
+      labels:
+        env: global
+      cluster:
+        labels:
+          env: cluster
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.labels["env"]
+          value: cluster
diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml
index 84e8bf5fe..b09d26dea 100644
--- a/charts/shield/tests/cluster/serviceaccount_test.yaml
+++ b/charts/shield/tests/cluster/serviceaccount_test.yaml
@@ -1,6 +1,8 @@
 suite: Cluster - ServiceAccount
 templates:
   - templates/cluster/serviceaccount.yaml
+chart:
+  version: 1.2.3-helmtest
 release:
   name: release-name
   namespace: shield-namespace
@@ -59,6 +61,24 @@ tests:
           path: metadata.name
           value: my-existing-sa
 
+  - it: Default labels present on ServiceAccount
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            helm.sh/chart: shield-1.2.3-helmtest
+            app.kubernetes.io/name: shield
+            app.kubernetes.io/instance: release-name
+            app.kubernetes.io/version: "1.0.0"
+            app.kubernetes.io/managed-by: Helm
+            sysdig/component: cluster
+
+  - it: No annotations by default on ServiceAccount
+    asserts:
+      - exists:
+          path: metadata.annotations
+        not: true
+
   - it: Applies rbac.labels and rbac.annotations to the ServiceAccount
     set:
       cluster:
@@ -76,3 +96,143 @@ tests:
           path: metadata.annotations
           content:
             app.kubernetes.io/description: "This is a test"
+
+  - it: Global labels applied to ServiceAccount
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-label-key"]
+          value: global-label-value
+
+  - it: Global annotations applied to ServiceAccount
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+
+  - it: Global annotations merged with rbac.annotations on ServiceAccount
+    set:
+      annotations:
+        global-key: global-value
+      cluster:
+        rbac:
+          annotations:
+            rbac-key: rbac-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["rbac-key"]
+          value: rbac-value
+
+  - it: cluster.annotations applied to ServiceAccount
+    set:
+      cluster:
+        annotations:
+          cluster-annotation-key: cluster-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["cluster-annotation-key"]
+          value: cluster-annotation-value
+
+  - it: cluster.annotations merged with global and rbac annotations on ServiceAccount
+    set:
+      annotations:
+        global-key: global-value
+      cluster:
+        annotations:
+          cluster-key: cluster-value
+        rbac:
+          annotations:
+            rbac-key: rbac-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["cluster-key"]
+          value: cluster-value
+      - equal:
+          path: metadata.annotations["rbac-key"]
+          value: rbac-value
+
+  - it: cluster.labels applied to ServiceAccount
+    set:
+      cluster:
+        labels:
+          cluster-label-key: cluster-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["cluster-label-key"]
+          value: cluster-label-value
+
+  - it: cluster.labels merged with global labels on ServiceAccount
+    set:
+      labels:
+        global-key: global-value
+      cluster:
+        labels:
+          cluster-key: cluster-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["cluster-key"]
+          value: cluster-value
+
+  - it: cluster.annotations overrides global annotations on ServiceAccount
+    set:
+      annotations:
+        env: global
+      cluster:
+        annotations:
+          env: cluster
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: cluster
+
+  - it: cluster.rbac.annotations overrides cluster.annotations on ServiceAccount
+    set:
+      cluster:
+        annotations:
+          env: component
+        rbac:
+          annotations:
+            env: rbac
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: rbac
+
+  - it: cluster.labels overrides global labels on ServiceAccount
+    set:
+      labels:
+        env: global
+      cluster:
+        labels:
+          env: cluster
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: cluster
+
+  - it: cluster.rbac.labels overrides cluster.labels on ServiceAccount
+    set:
+      cluster:
+        labels:
+          env: component
+        rbac:
+          labels:
+            env: rbac
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: rbac
diff --git a/charts/shield/tests/host/daemonset-windows_test.yaml b/charts/shield/tests/host/daemonset-windows_test.yaml
index 6a5493077..ea6a8c379 100644
--- a/charts/shield/tests/host/daemonset-windows_test.yaml
+++ b/charts/shield/tests/host/daemonset-windows_test.yaml
@@ -1,6 +1,8 @@
 suite: Host Windows - DaemonSet
 templates:
   - templates/host/daemonset-windows.yaml
+chart:
+  version: 1.2.3-helmtest
 release:
   name: release-name
   namespace: shield-namespace
@@ -517,3 +519,99 @@ tests:
           value:
               - company.public
               - company.internal
+
+  - it: host_windows.annotations overrides global annotations on DaemonSet workload
+    set:
+      annotations:
+        env: global
+      host_windows:
+        annotations:
+          env: host-windows
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: host-windows
+
+  - it: host_windows.annotations overrides global annotations on DaemonSet pod
+    set:
+      annotations:
+        env: global
+      host_windows:
+        annotations:
+          env: host-windows
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["env"]
+          value: host-windows
+
+  - it: host_windows.workload_annotations overrides host_windows.annotations on DaemonSet workload
+    set:
+      host_windows:
+        annotations:
+          env: component
+        workload_annotations:
+          env: workload
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: workload
+
+  - it: host_windows.workload_annotations overrides global workload_annotations on DaemonSet
+    set:
+      workload_annotations:
+        env: global-workload
+      host_windows:
+        workload_annotations:
+          env: component-workload
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: component-workload
+
+  - it: host_windows.labels overrides global labels on DaemonSet workload
+    set:
+      labels:
+        env: global
+      host_windows:
+        labels:
+          env: host-windows
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: host-windows
+
+  - it: host_windows.labels overrides global labels on DaemonSet pod
+    set:
+      labels:
+        env: global
+      host_windows:
+        labels:
+          env: host-windows
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["env"]
+          value: host-windows
+
+  - it: host_windows.workload_labels overrides host_windows.labels on DaemonSet workload
+    set:
+      host_windows:
+        labels:
+          env: component
+        workload_labels:
+          env: workload
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: workload
+
+  - it: host_windows.workload_labels overrides global workload_labels on DaemonSet
+    set:
+      workload_labels:
+        env: global-workload
+      host_windows:
+        workload_labels:
+          env: component-workload
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: component-workload
diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml
index 02eef90e5..38d2db1c1 100644
--- a/charts/shield/tests/host/daemonset_test.yaml
+++ b/charts/shield/tests/host/daemonset_test.yaml
@@ -1,6 +1,8 @@
 suite: Host - DaemonSet
 templates:
   - templates/host/daemonset.yaml
+chart:
+  version: 1.2.3-helmtest
 release:
   name: release-name
   namespace: shield-namespace
@@ -341,6 +343,7 @@ tests:
       - isSubset:
           path: metadata.labels
           content:
+            helm.sh/chart: shield-1.2.3-helmtest
             app.kubernetes.io/instance: release-name
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: shield
@@ -348,6 +351,16 @@ tests:
             sysdig/component: host
             sysdig/component-version: 11.11.11
 
+  - it: No global annotations do not add workload annotations
+    asserts:
+      - containsDocument:
+          kind: DaemonSet
+          apiVersion: apps/v1
+          name: release-name-shield-host
+          namespace: shield-namespace
+      - isNullOrEmpty:
+          path: metadata.annotations
+
   - it: Default pod labels
     set:
       host:
@@ -1057,3 +1070,305 @@ tests:
             mountPath: /opt/draios/etc/local_forwarder_config.yaml
             subPath: local_forwarder_config.yaml
         template: host/daemonset.yaml
+
+  - it: Global labels applied to DaemonSet workload metadata
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-label-key"]
+          value: global-label-value
+
+  - it: Global labels applied to DaemonSet pod metadata
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["global-label-key"]
+          value: global-label-value
+
+  - it: Global labels merged with component workload and pod labels
+    set:
+      labels:
+        global-key: global-value
+      workload_labels:
+        global-workload-key: global-workload-value
+      pod_labels:
+        global-pod-key: global-pod-value
+      host:
+        workload_labels:
+          component-workload-key: component-workload-value
+        pod_labels:
+          component-pod-key: component-pod-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["global-workload-key"]
+          value: global-workload-value
+      - equal:
+          path: metadata.labels["component-workload-key"]
+          value: component-workload-value
+      - equal:
+          path: spec.template.metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: spec.template.metadata.labels["global-pod-key"]
+          value: global-pod-value
+      - equal:
+          path: spec.template.metadata.labels["component-pod-key"]
+          value: component-pod-value
+
+  - it: Global annotations applied to DaemonSet workload metadata
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+
+  - it: Global annotations applied to DaemonSet pod metadata
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+
+  - it: Global annotations merged with component workload and pod annotations
+    set:
+      annotations:
+        global-key: global-value
+      workload_annotations:
+        global-workload-key: global-workload-value
+      pod_annotations:
+        global-pod-key: global-pod-value
+      host:
+        workload_annotations:
+          component-workload-key: component-workload-value
+        pod_annotations:
+          component-pod-key: component-pod-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["global-workload-key"]
+          value: global-workload-value
+      - equal:
+          path: metadata.annotations["component-workload-key"]
+          value: component-workload-value
+      - equal:
+          path: spec.template.metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: spec.template.metadata.annotations["global-pod-key"]
+          value: global-pod-value
+      - equal:
+          path: spec.template.metadata.annotations["component-pod-key"]
+          value: component-pod-value
+
+  - it: host.annotations applied to DaemonSet workload metadata
+    set:
+      host:
+        annotations:
+          host-annotation-key: host-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["host-annotation-key"]
+          value: host-annotation-value
+
+  - it: host.annotations applied to DaemonSet pod metadata
+    set:
+      host:
+        annotations:
+          host-annotation-key: host-annotation-value
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["host-annotation-key"]
+          value: host-annotation-value
+
+  - it: host.annotations merged with global annotations and workload annotations
+    set:
+      annotations:
+        global-key: global-value
+      host:
+        annotations:
+          host-key: host-value
+        workload_annotations:
+          workload-key: workload-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["host-key"]
+          value: host-value
+      - equal:
+          path: metadata.annotations["workload-key"]
+          value: workload-value
+
+  - it: host.labels applied to DaemonSet workload metadata
+    set:
+      host:
+        labels:
+          host-label-key: host-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["host-label-key"]
+          value: host-label-value
+
+  - it: host.labels applied to DaemonSet pod metadata
+    set:
+      host:
+        labels:
+          host-label-key: host-label-value
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["host-label-key"]
+          value: host-label-value
+
+  - it: host.labels merged with global and workload labels
+    set:
+      labels:
+        global-key: global-value
+      host:
+        labels:
+          host-key: host-value
+        workload_labels:
+          workload-key: workload-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["host-key"]
+          value: host-value
+      - equal:
+          path: metadata.labels["workload-key"]
+          value: workload-value
+
+  - it: host.annotations overrides global annotations on DaemonSet workload
+    set:
+      annotations:
+        env: global
+      host:
+        annotations:
+          env: host
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: host
+
+  - it: host.annotations overrides global annotations on DaemonSet pod
+    set:
+      annotations:
+        env: global
+      host:
+        annotations:
+          env: host
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["env"]
+          value: host
+
+  - it: host.workload_annotations overrides host.annotations on DaemonSet workload
+    set:
+      host:
+        annotations:
+          env: component
+        workload_annotations:
+          env: workload
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: workload
+
+  - it: host.pod_annotations overrides host.annotations on DaemonSet pod
+    set:
+      host:
+        annotations:
+          env: component
+        pod_annotations:
+          env: pod
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["env"]
+          value: pod
+
+  - it: host.workload_annotations overrides global workload_annotations on DaemonSet
+    set:
+      workload_annotations:
+        env: global-workload
+      host:
+        workload_annotations:
+          env: component-workload
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: component-workload
+
+  - it: host.labels overrides global labels on DaemonSet workload
+    set:
+      labels:
+        env: global
+      host:
+        labels:
+          env: host
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: host
+
+  - it: host.labels overrides global labels on DaemonSet pod
+    set:
+      labels:
+        env: global
+      host:
+        labels:
+          env: host
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["env"]
+          value: host
+
+  - it: host.workload_labels overrides host.labels on DaemonSet workload
+    set:
+      host:
+        labels:
+          env: component
+        workload_labels:
+          env: workload
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: workload
+
+  - it: host.pod_labels overrides host.labels on DaemonSet pod
+    set:
+      host:
+        labels:
+          env: component
+        pod_labels:
+          env: pod
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels["env"]
+          value: pod
+
+  - it: host.workload_labels overrides global workload_labels on DaemonSet
+    set:
+      workload_labels:
+        env: global-workload
+      host:
+        workload_labels:
+          env: component-workload
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: component-workload
diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml
index 8314a8b0a..b2a026ffd 100644
--- a/charts/shield/tests/host/serviceaccount_test.yaml
+++ b/charts/shield/tests/host/serviceaccount_test.yaml
@@ -1,6 +1,8 @@
 suite: Host - ServiceAccount
 templates:
   - templates/host/serviceaccount.yaml
+chart:
+  version: 1.2.3-helmtest
 release:
   name: release-name
   namespace: shield-namespace
@@ -59,6 +61,24 @@ tests:
           path: metadata.name
           value: my-existing-sa
 
+  - it: Default labels present on ServiceAccount
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            helm.sh/chart: shield-1.2.3-helmtest
+            app.kubernetes.io/name: shield
+            app.kubernetes.io/instance: release-name
+            app.kubernetes.io/version: "1.0.0"
+            app.kubernetes.io/managed-by: Helm
+            sysdig/component: host
+
+  - it: No annotations by default on ServiceAccount
+    asserts:
+      - exists:
+          path: metadata.annotations
+        not: true
+
   - it: Applies rbac.labels and rbac.annotations to the ServiceAccount
     set:
       host:
@@ -76,3 +96,143 @@ tests:
           path: metadata.annotations
           content:
             app.kubernetes.io/description: "This is a test"
+
+  - it: Global labels applied to ServiceAccount
+    set:
+      labels:
+        global-label-key: global-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-label-key"]
+          value: global-label-value
+
+  - it: Global annotations applied to ServiceAccount
+    set:
+      annotations:
+        global-annotation-key: global-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-annotation-key"]
+          value: global-annotation-value
+
+  - it: Global annotations merged with rbac.annotations on ServiceAccount
+    set:
+      annotations:
+        global-key: global-value
+      host:
+        rbac:
+          annotations:
+            rbac-key: rbac-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["rbac-key"]
+          value: rbac-value
+
+  - it: host.annotations applied to ServiceAccount
+    set:
+      host:
+        annotations:
+          host-annotation-key: host-annotation-value
+    asserts:
+      - equal:
+          path: metadata.annotations["host-annotation-key"]
+          value: host-annotation-value
+
+  - it: host.annotations merged with global and rbac annotations on ServiceAccount
+    set:
+      annotations:
+        global-key: global-value
+      host:
+        annotations:
+          host-key: host-value
+        rbac:
+          annotations:
+            rbac-key: rbac-value
+    asserts:
+      - equal:
+          path: metadata.annotations["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.annotations["host-key"]
+          value: host-value
+      - equal:
+          path: metadata.annotations["rbac-key"]
+          value: rbac-value
+
+  - it: host.labels applied to ServiceAccount
+    set:
+      host:
+        labels:
+          host-label-key: host-label-value
+    asserts:
+      - equal:
+          path: metadata.labels["host-label-key"]
+          value: host-label-value
+
+  - it: host.labels merged with global labels on ServiceAccount
+    set:
+      labels:
+        global-key: global-value
+      host:
+        labels:
+          host-key: host-value
+    asserts:
+      - equal:
+          path: metadata.labels["global-key"]
+          value: global-value
+      - equal:
+          path: metadata.labels["host-key"]
+          value: host-value
+
+  - it: host.annotations overrides global annotations on ServiceAccount
+    set:
+      annotations:
+        env: global
+      host:
+        annotations:
+          env: host
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: host
+
+  - it: host.rbac.annotations overrides host.annotations on ServiceAccount
+    set:
+      host:
+        annotations:
+          env: component
+        rbac:
+          annotations:
+            env: rbac
+    asserts:
+      - equal:
+          path: metadata.annotations["env"]
+          value: rbac
+
+  - it: host.labels overrides global labels on ServiceAccount
+    set:
+      labels:
+        env: global
+      host:
+        labels:
+          env: host
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: host
+
+  - it: host.rbac.labels overrides host.labels on ServiceAccount
+    set:
+      host:
+        labels:
+          env: component
+        rbac:
+          labels:
+            env: rbac
+    asserts:
+      - equal:
+          path: metadata.labels["env"]
+          value: rbac
diff --git a/charts/shield/values.schema.json b/charts/shield/values.schema.json
index ed39d1f97..1a00987c7 100644
--- a/charts/shield/values.schema.json
+++ b/charts/shield/values.schema.json
@@ -36,6 +36,20 @@
     "proxy": {
       "$ref": "#/$defs/Proxy"
     },
+    "annotations": {
+      "type": "object",
+      "description": "Additional annotations applied to all resources created by the chart.",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
+    "labels": {
+      "type": "object",
+      "description": "Additional labels applied to all resources created by the chart.",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
     "extra_capabilities_api_versions": {
       "type": "array",
       "items": {
@@ -371,6 +385,20 @@
         },
         "volume_mounts": {
           "$ref": "#/$defs/VolumeMounts"
+        },
+        "annotations": {
+          "type": "object",
+          "description": "Additional annotations applied to all cluster resources created by the chart.",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "labels": {
+          "type": "object",
+          "description": "Additional labels applied to all cluster resources created by the chart.",
+          "additionalProperties": {
+            "type": "string"
+          }
         }
       },
       "required": [
@@ -422,6 +450,20 @@
         },
         "volume_mounts": {
           "$ref": "#/$defs/VolumeMounts"
+        },
+        "annotations": {
+          "type": "object",
+          "description": "Additional annotations applied to all host resources created by the chart.",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "labels": {
+          "type": "object",
+          "description": "Additional labels applied to all host resources created by the chart.",
+          "additionalProperties": {
+            "type": "string"
+          }
         }
       },
       "required": [
@@ -443,6 +485,20 @@
         },
         "volume_mounts": {
           "$ref": "#/$defs/VolumeMounts"
+        },
+        "annotations": {
+          "type": "object",
+          "description": "Additional annotations applied to all host_windows resources created by the chart.",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "labels": {
+          "type": "object",
+          "description": "Additional labels applied to all host_windows resources created by the chart.",
+          "additionalProperties": {
+            "type": "string"
+          }
         }
       }
     },
diff --git a/charts/shield/values.yaml b/charts/shield/values.yaml
index dc7c8b4b3..5efb7bdbe 100644
--- a/charts/shield/values.yaml
+++ b/charts/shield/values.yaml
@@ -243,6 +243,10 @@ host_windows:
       memory: 384Mi
   # The host aliases for the windows host shield workloads
   host_aliases: []
+  # Additional annotations for all host_windows resources (metadata.annotations)
+  annotations: {}
+  # Additional labels for all host_windows resources (metadata.labels)
+  labels: {}
   # The annotations for the host shield workloads (metadata.annotations)
   workload_annotations: {}
   # The labels for the host shield workloads (metadata.labels)
@@ -372,6 +376,10 @@ host:
         memory: 384Mi
   # The host aliases for the linux host shield workloads
   host_aliases: []
+  # Additional annotations for all host resources (metadata.annotations)
+  annotations: {}
+  # Additional labels for all host resources (metadata.labels)
+  labels: {}
   # The annotations for the host shield workloads (metadata.annotations)
   workload_annotations: {}
   # The labels for the host shield workloads (metadata.labels)
@@ -551,6 +559,10 @@ cluster:
       memory: 1536Mi
   # The host aliases for the cluster shield workloads
   host_aliases: []
+  # Additional annotations for all cluster resources (metadata.annotations)
+  annotations: {}
+  # Additional labels for all cluster resources (metadata.labels)
+  labels: {}
   # The annotations for the cluster shield workloads (metadata.annotations)
   workload_annotations: {}
   # The labels for the cluster shield workloads (metadata.labels)
@@ -660,6 +672,10 @@ proxy:
 # Additional .APIVersions in .Capabilities, e.g. "security.openshift.io/v1"
 extra_capabilities_api_versions: []
 
+# Additional annotations for all resources (metadata.annotations)
+annotations: {}
+# Additional labels for all resources (metadata.labels)
+labels: {}
 # Additional annotations for the all the workloads (metadata.annotations)
 workload_annotations: {}
 # Additional labels for the all the workloads (metadata.labels)