diff --git a/pkg/templates/charts/toggle/assisted-service/templates/assisted-service-clusterrole.yaml b/pkg/templates/charts/toggle/assisted-service/templates/assisted-service-clusterrole.yaml
index 05f178493..988c5691d 100644
--- a/pkg/templates/charts/toggle/assisted-service/templates/assisted-service-clusterrole.yaml
+++ b/pkg/templates/charts/toggle/assisted-service/templates/assisted-service-clusterrole.yaml
@@ -352,6 +352,7 @@ rules:
   - networking.k8s.io
   resources:
   - ingresses
+  - networkpolicies
   verbs:
   - create
   - delete
diff --git a/pkg/templates/charts/toggle/assisted-service/templates/infrastructure-operator-networkpolicy.yaml b/pkg/templates/charts/toggle/assisted-service/templates/infrastructure-operator-networkpolicy.yaml
new file mode 100644
index 000000000..058188bbd
--- /dev/null
+++ b/pkg/templates/charts/toggle/assisted-service/templates/infrastructure-operator-networkpolicy.yaml
@@ -0,0 +1,57 @@
+{{- if .Values.global.networkPolicies.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    control-plane: infrastructure-operator
+  name: infrastructure-operator
+  namespace: '{{ .Values.global.namespace }}'
+spec:
+  egress:
+  - ports:
+    - port: 5353
+      protocol: UDP
+    - port: 5353
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: openshift-dns
+  - ports:
+    - port: 6443
+      protocol: TCP
+    to:
+    - namespaceSelector: {}
+      podSelector:
+        matchLabels:
+          component: apiserver
+  - ports:
+    - port: 443
+      protocol: TCP
+    to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 169.254.169.254/32
+    - ipBlock:
+        cidr: ::/0
+  ingress:
+  - from:
+    - podSelector: {}
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          network.openshift.io/policy-group: monitoring
+    ports:
+    - port: 8080
+      protocol: TCP
+  - ports:
+    - port: 9443
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      control-plane: infrastructure-operator
+  policyTypes:
+  - Ingress
+  - Egress
+{{- end }}
diff --git a/pkg/templates/crds/hive-operator/hive.openshift.io_machinepools.yaml b/pkg/templates/crds/hive-operator/hive.openshift.io_machinepools.yaml
index ba670badc..b88c9361d 100644
--- a/pkg/templates/crds/hive-operator/hive.openshift.io_machinepools.yaml
+++ b/pkg/templates/crds/hive-operator/hive.openshift.io_machinepools.yaml
@@ -260,7 +260,10 @@ spec:
                             - diskSizeGB
                           type: object
                         osImage:
-                          description: OSImage defines the image to use for the OS.
+                          description: |-
+                            OSImage defines the marketplace image to use for the OS. Mutually exclusive with OSImageID;
+                            if both are specified, OSImage is ignored. If neither is specified, the managed cluster will
+                            inject a default.
                           properties:
                             offer:
                               description: Offer is the offer of the image.
@@ -288,6 +291,12 @@ spec:
                             - sku
                             - version
                           type: object
+                        osImageID:
+                          description: |-
+                            OSImageID is the resource path of the managed or gallery image to be used on the VMs.
+                            Mutually exclusive with OSImage; if both are specified, OSImage is ignored. If neither is
+                            specified, the managed cluster will inject a default.
+                          type: string
                         outboundType:
                           description: OutboundType is a strategy for how egress from cluster is achieved. When not specified default is "Loadbalancer".
                           type: string
diff --git a/pkg/templates/rbac_gen.go b/pkg/templates/rbac_gen.go
index 200eb41e4..be0d45db7 100644
--- a/pkg/templates/rbac_gen.go
+++ b/pkg/templates/rbac_gen.go
@@ -695,7 +695,7 @@ package main
 //+kubebuilder:rbac:groups=network.frontdoor.azure.com,resources=webapplicationfirewallpolicies,verbs=create;delete;get;list;patch;update;watch
 //+kubebuilder:rbac:groups=network.frontdoor.azure.com,resources=webapplicationfirewallpolicies/finalizers;webapplicationfirewallpolicies/status,verbs=get;patch;update
 //+kubebuilder:rbac:groups=network.frontdoor.azure.com,resources=webapplicationfirewallpolicies/finalizers;webapplicationfirewallpolicies/status,verbs=get;patch;update
-//+kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=create;delete;get;list;patch;update;watch
+//+kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses;networkpolicies,verbs=create;delete;get;list;patch;update;watch
 //+kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=create;get;list;update;watch;patch;delete
 //+kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=create;get;update
 //+kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete