These manifests should live in kube-system; otherwise the label selector
won't work.