diff --git a/clr-k8s-examples/7-rook/000-operator.yaml b/clr-k8s-examples/7-rook/000-operator.yaml
index ba30f99..c62e67a 100644
--- a/clr-k8s-examples/7-rook/000-operator.yaml
+++ b/clr-k8s-examples/7-rook/000-operator.yaml
@@ -2,8 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: rook-ceph-system
-  labels:
-    kata: "false"
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
diff --git a/clr-k8s-examples/7-rook/001-cluster.yaml b/clr-k8s-examples/7-rook/001-cluster.yaml
index 2e237c1..33c012b 100644
--- a/clr-k8s-examples/7-rook/001-cluster.yaml
+++ b/clr-k8s-examples/7-rook/001-cluster.yaml
@@ -2,8 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: rook-ceph
-  labels:
-    kata: "false"
 ---
 apiVersion: v1
 kind: ServiceAccount
diff --git a/clr-k8s-examples/README.md b/clr-k8s-examples/README.md
index 4bcb692..7b175e6 100644
--- a/clr-k8s-examples/README.md
+++ b/clr-k8s-examples/README.md
@@ -102,30 +102,11 @@ and sample admission controller we created by running -
 `kubectl apply -f admit-kata/`
 
 The [admission webhook](admit-kata/webhook-registration.yaml)
-is setup to exclude certian namespaces from being run with Kata using filters on namespace labels.
 
-```yaml
-    namespaceSelector:
-      matchExpressions:
-        -  {key: "kata", operator: NotIn, values: ["false"]}
-```
+The webhook mutates pods to use the kata runtime class for all pods except those with
 
-The rook operators for example are marked as such
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rook-ceph-system
-  labels:
-    kata: "false"
-```
-
-Pods not explicitly excluded by the namespace filter are dynamically tagged to
-run with Kata with some [exceptions](https://github.com/mcastelino/kubewebhook/blob/topic/hack-kata/examples/pod-annotate/main.go#L25) -
-
-* `hostNetwork: true`
-* `rook-ceph` and `rook-ceph-system` namespaces (buggy)
+- hostNetwork: true
+- namespace: rook-ceph and rook-ceph-system
 
 Other pod properties will be added as exceptions in future.
 
diff --git a/clr-k8s-examples/admit-kata/webhook-registration.yaml b/clr-k8s-examples/admit-kata/webhook-registration.yaml
index 2c9dd8f..3d44f82 100644
--- a/clr-k8s-examples/admit-kata/webhook-registration.yaml
+++ b/clr-k8s-examples/admit-kata/webhook-registration.yaml
@@ -18,7 +18,3 @@ webhooks:
         apiGroups: [""]
         apiVersions: ["v1"]
         resources: ["pods"]
-    namespaceSelector:
-      matchExpressions:
-        -  {key: "kata", operator: NotIn, values: ["false"]}
-