diff --git a/hack/charts/cluster-api-operator/templates/_helpers.tpl b/hack/charts/cluster-api-operator/templates/_helpers.tpl
index a4c8b733d..4c5f62bb9 100644
--- a/hack/charts/cluster-api-operator/templates/_helpers.tpl
+++ b/hack/charts/cluster-api-operator/templates/_helpers.tpl
@@ -22,3 +22,13 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- end -}}
 {{- end -}}
 {{- end -}}
+
+{{- define "capi-operator.configSecret" -}}
+{{- $ := .ROOT -}}
+{{- $arg := .ARGUMENT -}}
+configSecret:
+  name: {{ default (($arg).configSecret).name (($.Values).configSecret).name }}
+  {{- if (default (($arg).configSecret).namespace (($.Values).configSecret).namespace) }}
+  namespace: {{ default (($arg).configSecret).namespace (($.Values).configSecret).namespace }}
+  {{- end }}
+{{- end -}}
diff --git a/hack/charts/cluster-api-operator/templates/bootstrap.yaml b/hack/charts/cluster-api-operator/templates/bootstrap.yaml
index 78dad47ee..be63c3bfb 100644
--- a/hack/charts/cluster-api-operator/templates/bootstrap.yaml
+++ b/hack/charts/cluster-api-operator/templates/bootstrap.yaml
@@ -26,18 +26,14 @@ metadata:
     "helm.sh/hook-weight": "2"
     {{- end }}
     "argocd.argoproj.io/sync-wave": "2"
-{{- if or $bootstrapVersion $.Values.configSecret.name }}
+{{- if or $bootstrapVersion $.Values.configSecret.name (($bootstrap).configSecret).name }}
 spec:
 {{- end}}
 {{- if $bootstrapVersion }}
   version: {{ $bootstrapVersion }}
 {{- end }}
-{{- if $.Values.configSecret.name }}
-  configSecret:
-    name: {{ $.Values.configSecret.name }}
-    {{- if $.Values.configSecret.namespace }}
-    namespace: {{ $.Values.configSecret.namespace }}
-    {{- end }}
+{{- if (default (($bootstrap).configSecret).name (($.Values).configSecret).name) }}
+{{- include "capi-operator.configSecret" (dict "ROOT" $ "ARGUMENT" $bootstrap) | nindent 2 }}
 {{- end }}
 {{- if $bootstrap.manifestPatches }}
   manifestPatches: {{ toYaml $bootstrap.manifestPatches | nindent 4 }}
diff --git a/hack/charts/cluster-api-operator/templates/control-plane.yaml b/hack/charts/cluster-api-operator/templates/control-plane.yaml
index 8a020afdf..350698a1d 100644
--- a/hack/charts/cluster-api-operator/templates/control-plane.yaml
+++ b/hack/charts/cluster-api-operator/templates/control-plane.yaml
@@ -26,7 +26,7 @@ metadata:
     "helm.sh/hook-weight": "2"
     {{- end }}
     "argocd.argoproj.io/sync-wave": "2"
-{{- if or $controlPlaneVersion $.Values.configSecret.name $.Values.manager }}
+{{- if or $controlPlaneVersion $.Values.configSecret.name $.Values.manager (($controlPlane).configSecret).name }}
 spec:
 {{- end}}
 {{- if $controlPlaneVersion }}
@@ -45,12 +45,8 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
-{{- if $.Values.configSecret.name }}
-  configSecret:
-    name: {{ $.Values.configSecret.name }}
-    {{- if $.Values.configSecret.namespace }}
-    namespace: {{ $.Values.configSecret.namespace }}
-    {{- end }}
+{{- if (default (($controlPlane).configSecret).name (($.Values).configSecret).name) }}
+{{- include "capi-operator.configSecret" (dict "ROOT" $ "ARGUMENT" $controlPlane) | nindent 2 }}
 {{- end }}
 {{- if $controlPlane.manifestPatches }}
   manifestPatches: {{ toYaml $controlPlane.manifestPatches | nindent 4 }}
diff --git a/hack/charts/cluster-api-operator/templates/core.yaml b/hack/charts/cluster-api-operator/templates/core.yaml
index 648e1b601..3292c6d73 100644
--- a/hack/charts/cluster-api-operator/templates/core.yaml
+++ b/hack/charts/cluster-api-operator/templates/core.yaml
@@ -26,7 +26,7 @@ metadata:
     "helm.sh/hook-weight": "2"
     {{- end }}
     "argocd.argoproj.io/sync-wave": "2"
-{{- if or $coreVersion $.Values.configSecret.name $.Values.manager }}
+{{- if or $coreVersion $.Values.configSecret.name $.Values.manager (($core).configSecret).name }}
 spec:
 {{- end}}
 {{- if $coreVersion }}
@@ -41,12 +41,8 @@ spec:
     {{- end }}
 {{- end }}
 {{- end }}
-{{- if $.Values.configSecret.name }}
-  configSecret:
-    name: {{ $.Values.configSecret.name }}
-    {{- if $.Values.configSecret.namespace }}
-    namespace: {{ $.Values.configSecret.namespace }}
-    {{- end }}
+{{- if (default (($core).configSecret).name (($.Values).configSecret).name) }}
+{{- include "capi-operator.configSecret" (dict "ROOT" $ "ARGUMENT" $core) | nindent 2 }}
 {{- end }}
 {{- if $core.manifestPatches }}
   manifestPatches: {{ toYaml $core.manifestPatches | nindent 4 }}
diff --git a/hack/charts/cluster-api-operator/templates/infra.yaml b/hack/charts/cluster-api-operator/templates/infra.yaml
index 835607d4d..c7284ae4b 100644
--- a/hack/charts/cluster-api-operator/templates/infra.yaml
+++ b/hack/charts/cluster-api-operator/templates/infra.yaml
@@ -26,7 +26,7 @@ metadata:
     "helm.sh/hook-weight": "2"
     {{- end }}
     "argocd.argoproj.io/sync-wave": "2"
-{{- if or $infrastructureVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments }}
+{{- if or $infrastructureVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments (($infra).configSecret).name }}
 spec:
 {{- end }}
 {{- if $infrastructureVersion }}
@@ -55,12 +55,8 @@ spec:
   {{- end }}
 {{- end }}
 {{- end }}
-{{- if $.Values.configSecret.name }}
-  configSecret:
-    name: {{ $.Values.configSecret.name }}
-    {{- if $.Values.configSecret.namespace }}
-    namespace: {{ $.Values.configSecret.namespace }}
-    {{- end }}
+{{- if (default (($infra).configSecret).name (($.Values).configSecret).name) }}
+{{- include "capi-operator.configSecret" (dict "ROOT" $ "ARGUMENT" $infra) | nindent 2 }}
 {{- end }}
 {{- if $.Values.additionalDeployments }}
   additionalDeployments: {{ toYaml $.Values.additionalDeployments | nindent 4 }}
diff --git a/hack/charts/cluster-api-operator/templates/ipam.yaml b/hack/charts/cluster-api-operator/templates/ipam.yaml
index 4a33c42fb..c1c5847c9 100644
--- a/hack/charts/cluster-api-operator/templates/ipam.yaml
+++ b/hack/charts/cluster-api-operator/templates/ipam.yaml
@@ -26,7 +26,7 @@ metadata:
     "helm.sh/hook-weight": "2"
     {{- end }}
     "argocd.argoproj.io/sync-wave": "2"
-{{- if or $ipamVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments }}
+{{- if or $ipamVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments (($ipam).configSecret).name }}
 spec:
 {{- end }}
 {{- if $ipamVersion }}
@@ -45,12 +45,8 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
-{{- if $.Values.configSecret.name }}
-  configSecret:
-    name: {{ $.Values.configSecret.name }}
-    {{- if $.Values.configSecret.namespace }}
-    namespace: {{ $.Values.configSecret.namespace }}
-    {{- end }}
+{{- if (default (($ipam).configSecret).name (($.Values).configSecret).name) }}
+{{- include "capi-operator.configSecret" (dict "ROOT" $ "ARGUMENT" $ipam) | nindent 2 }}
 {{- end }}
 {{- if $ipam.manifestPatches }}
   manifestPatches: {{ toYaml $ipam.manifestPatches | nindent 4 }}
diff --git a/hack/charts/cluster-api-operator/values.schema.json b/hack/charts/cluster-api-operator/values.schema.json
index d22038fce..e89f2b64f 100644
--- a/hack/charts/cluster-api-operator/values.schema.json
+++ b/hack/charts/cluster-api-operator/values.schema.json
@@ -1,47 +1,322 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
+  "$defs": {
+    "Provider": {
+      "type": "object",
+      "properties": {
+        "namespace": {
+          "$ref": "#/$defs/Rfc1123SubdomainNameOrNull"
+        },
+        "version": {
+          "$ref": "#/$defs/VersionOrNull"
+        },
+        "configSecret": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "$ref": "#/$defs/Rfc1123SubdomainNameOrNull"
+            },
+            "namespace": {
+              "$ref": "#/$defs/Rfc1123SubdomainNameOrNull"
+            }
+          },
+          "additionalProperties": false
+        },
+        "manifestPatches": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ]
+        },
+        "additionalManifests": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "$ref": "#/$defs/Rfc1123SubdomainNameOrNull"
+            },
+            "namespace": {
+              "$ref": "#/$defs/Rfc1123SubdomainNameOrNull"
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "Rfc1123SubdomainNameOrNull": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "type": "string",
+          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
+          "minLength": 1,
+          "maxLength": 253
+        }
+      ]
+    },
+    "VersionOrNull": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "type": "string",
+          "minLength": 1
+        }
+      ]
+    }
+  },
   "type": "object",
   "properties": {
     "core": {
       "oneOf": [
-        { "type": "object" },
-        { "type": "null" }
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$": {
+              "$ref": "#/$defs/Provider"
+            }
+          },
+          "additionalProperties": false
+        }
       ]
     },
     "bootstrap": {
       "type": "object",
       "oneOf": [
-        { "type": "object" },
-        { "type": "null" }
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$": {
+              "$ref": "#/$defs/Provider"
+            }
+          },
+          "additionalProperties": false
+        }
       ]
     },
     "controlPlane": {
       "type": "object",
       "oneOf": [
-        { "type": "object" },
-        { "type": "null" }
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$": {
+              "$ref": "#/$defs/Provider"
+            }
+          },
+          "additionalProperties": false
+        }
       ]
     },
     "infrastructure": {
       "type": "object",
       "oneOf": [
-        { "type": "object" },
-        { "type": "null" }
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$": {
+              "$ref": "#/$defs/Provider"
+            }
+          },
+          "additionalProperties": false
+        }
       ]
     },
     "addon": {
       "type": "object",
       "oneOf": [
-        { "type": "object" },
-        { "type": "null" }
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$": {
+              "$ref": "#/$defs/Provider"
+            }
+          },
+          "additionalProperties": false
+        }
       ]
     },
     "ipam": {
       "type": "object",
       "oneOf": [
-        { "type": "object" },
-        { "type": "null" }
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$": {
+              "$ref": "#/$defs/Provider"
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "manager.featureGates": {
+      "type": [
+        "null",
+        "object"
+      ]
+    },
+    "fetchConfig": {
+      "type": [
+        "null",
+        "object"
+      ]
+    },
+    "configSecret": {
+      "type": [
+        "null",
+        "object"
       ]
+    },
+    "logLevel": {
+      "type": [
+        "null",
+        "integer"
+      ]
+    },
+    "replicaCount": {
+      "type": "integer"
+    },
+    "leaderElection": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    },
+    "image": {
+      "type": "object",
+      "properties": {
+        "manager": {
+          "type": "object",
+          "properties": {
+            "repository": {
+              "type": "string"
+            },
+            "tag": {
+              "type": "string"
+            },
+            "pullPolicy": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "env": {
+      "type": "object",
+      "properties": {
+        "manager": {
+          "type": "array"
+        }
+      },
+      "additionalProperties": false
+    },
+    "diagnosticsAddress": {
+      "type": [
+        "null",
+        "string"
+      ]
+    },
+    "healthAddr": {
+      "type": [
+        "null",
+        "string"
+      ]
+    },
+    "insecureDiagnostics": {
+      "type": "boolean"
+    },
+    "watchConfigSecret": {
+      "type": "boolean"
+    },
+    "imagePullSecrets": {
+      "type": "array"
+    },
+    "resources": {
+      "type": "object",
+      "properties": {
+        "manager": {
+          "type": [
+            "null",
+            "object"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "containerSecurityContext": {
+      "type": "object",
+      "properties": {
+        "manager": {
+          "type": [
+            "null",
+            "object"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "affinity": {
+      "type": [
+        "null",
+        "object"
+      ]
+    },
+    "tolerations": {
+      "type": [
+        "array"
+      ]
+    },
+    "volumes": {
+      "type": [
+        "array"
+      ]
+    },
+    "volumeMounts": {
+      "type": "object",
+      "properties": {
+        "manager": {
+          "type": "array"
+        }
+      },
+      "additionalProperties": false
+    },
+    "enableHelmHook": {
+      "type": "boolean"
     }
-  }
-}
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/hack/charts/cluster-api-operator/values.yaml b/hack/charts/cluster-api-operator/values.yaml
index 9ec137109..6e27a41bd 100644
--- a/hack/charts/cluster-api-operator/values.yaml
+++ b/hack/charts/cluster-api-operator/values.yaml
@@ -47,7 +47,7 @@ diagnosticsAddress: ":8443"
 healthAddr: ":9440"
 insecureDiagnostics: false
 watchConfigSecret: false
-imagePullSecrets: {}
+imagePullSecrets: []
 resources:
   manager:
     limits: