diff --git a/cluster/kubernetes/manifests.go b/cluster/kubernetes/manifests.go
index 13368fdff2..cfd9457e34 100644
--- a/cluster/kubernetes/manifests.go
+++ b/cluster/kubernetes/manifests.go
@@ -2,6 +2,7 @@ package kubernetes
 
 import (
 	"github.com/weaveworks/flux"
+	"github.com/weaveworks/flux/cluster"
 	kresource "github.com/weaveworks/flux/cluster/kubernetes/resource"
 	"github.com/weaveworks/flux/image"
 	"github.com/weaveworks/flux/resource"
@@ -9,16 +10,17 @@ import (
 
 type Manifests struct {
 	AllowedNamespaces []string
+	Scoper            cluster.Scoper
 }
 
 func (c *Manifests) LoadManifests(base string, paths []string) (map[string]resource.Resource, error) {
-	resources, err := kresource.Load(base, paths)
+	resources, err := kresource.Load(base, paths, c.Scoper)
 	c.discardDisallowed(resources)
 	return resources, err
 }
 
 func (c *Manifests) ParseManifests(allDefs []byte) (map[string]resource.Resource, error) {
-	resources, err := kresource.ParseMultidoc(allDefs, "exported")
+	resources, err := kresource.ParseMultidoc(allDefs, "exported", c.Scoper)
 	c.discardDisallowed(resources)
 	return resources, err
 }
diff --git a/cluster/kubernetes/policies.go b/cluster/kubernetes/policies.go
index 79d51221ce..7a1be3ff2d 100644
--- a/cluster/kubernetes/policies.go
+++ b/cluster/kubernetes/policies.go
@@ -7,6 +7,7 @@ import (
 	"gopkg.in/yaml.v2"
 
 	"github.com/weaveworks/flux"
+	"github.com/weaveworks/flux/cluster"
 	kresource "github.com/weaveworks/flux/cluster/kubernetes/resource"
 	"github.com/weaveworks/flux/policy"
 	"github.com/weaveworks/flux/resource"
@@ -21,7 +22,7 @@ func (m *Manifests) UpdatePolicies(def []byte, id flux.ResourceID, update policy
 	// what all the containers are.
 	if tagAll, ok := update.Add.Get(policy.TagAll); ok {
 		add = add.Without(policy.TagAll)
-		containers, err := extractContainers(def, id)
+		containers, err := extractContainers(def, id, m.Scoper)
 		if err != nil {
 			return nil, err
 		}
@@ -66,8 +67,8 @@ func extractAnnotations(def []byte) (map[string]string, error) {
 	return m.Metadata.Annotations, nil
 }
 
-func extractContainers(def []byte, id flux.ResourceID) ([]resource.Container, error) {
-	resources, err := kresource.ParseMultidoc(def, "stdin")
+func extractContainers(def []byte, id flux.ResourceID, scoper cluster.Scoper) ([]resource.Container, error) {
+	resources, err := kresource.ParseMultidoc(def, "stdin", scoper)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cluster/kubernetes/resource/fluxhelmrelease_test.go b/cluster/kubernetes/resource/fluxhelmrelease_test.go
index 8cd037e6ee..c2ab5afa1d 100644
--- a/cluster/kubernetes/resource/fluxhelmrelease_test.go
+++ b/cluster/kubernetes/resource/fluxhelmrelease_test.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/weaveworks/flux/cluster"
 	"github.com/weaveworks/flux/resource"
 )
 
@@ -26,7 +27,7 @@ spec:
       enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -72,7 +73,7 @@ spec:
       enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -116,7 +117,7 @@ spec:
         enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -186,7 +187,7 @@ spec:
         enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -253,7 +254,7 @@ spec:
       enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -304,7 +305,7 @@ spec:
         enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -391,7 +392,7 @@ spec:
         enabled: false
 `
 
-	resources, err := ParseMultidoc([]byte(doc), "test")
+	resources, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cluster/kubernetes/resource/load.go b/cluster/kubernetes/resource/load.go
index 8803f2a3b1..b74d5cfe84 100644
--- a/cluster/kubernetes/resource/load.go
+++ b/cluster/kubernetes/resource/load.go
@@ -9,13 +9,15 @@ import (
 	"path/filepath"
 
 	"github.com/pkg/errors"
+
+	"github.com/weaveworks/flux/cluster"
 	"github.com/weaveworks/flux/resource"
 )
 
 // Load takes paths to directories or files, and creates an object set
 // based on the file(s) therein. Resources are named according to the
 // file content, rather than the file name of directory structure.
-func Load(base string, paths []string) (map[string]resource.Resource, error) {
+func Load(base string, paths []string, scoper cluster.Scoper) (map[string]resource.Resource, error) {
 	if _, err := os.Stat(base); os.IsNotExist(err) {
 		return nil, fmt.Errorf("git path %q not found", base)
 	}
@@ -47,7 +49,7 @@ func Load(base string, paths []string) (map[string]resource.Resource, error) {
 				if err != nil {
 					return errors.Wrapf(err, "path to scan %q is not under base %q", path, base)
 				}
-				docsInFile, err := ParseMultidoc(bytes, source)
+				docsInFile, err := ParseMultidoc(bytes, source, scoper)
 				if err != nil {
 					return err
 				}
@@ -127,7 +129,7 @@ func looksLikeChart(dir string) bool {
 
 // ParseMultidoc takes a dump of config (a multidoc YAML) and
 // constructs an object set from the resources represented therein.
-func ParseMultidoc(multidoc []byte, source string) (map[string]resource.Resource, error) {
+func ParseMultidoc(multidoc []byte, source string, scoper cluster.Scoper) (map[string]resource.Resource, error) {
 	objs := map[string]resource.Resource{}
 	chunks := bufio.NewScanner(bytes.NewReader(multidoc))
 	initialBuffer := make([]byte, 4096)     // Matches startBufSize in bufio/scan.go
@@ -143,7 +145,7 @@ func ParseMultidoc(multidoc []byte, source string) (map[string]resource.Resource
 		bytes := chunks.Bytes()
 		bytes2 := make([]byte, len(bytes), cap(bytes))
 		copy(bytes2, bytes)
-		if obj, err = unmarshalObject(source, bytes2); err != nil {
+		if obj, err = unmarshalObject(source, bytes2, scoper); err != nil {
 			return nil, errors.Wrapf(err, "parsing YAML doc from %q", source)
 		}
 		if obj == nil {
@@ -163,6 +165,7 @@ func ParseMultidoc(multidoc []byte, source string) (map[string]resource.Resource
 	if err := chunks.Err(); err != nil {
 		return objs, errors.Wrapf(err, "scanning multidoc from %q", source)
 	}
+
 	return objs, nil
 }
 
diff --git a/cluster/kubernetes/resource/load_test.go b/cluster/kubernetes/resource/load_test.go
index 15b102c112..f7ded592e6 100644
--- a/cluster/kubernetes/resource/load_test.go
+++ b/cluster/kubernetes/resource/load_test.go
@@ -9,13 +9,14 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/weaveworks/flux"
+	"github.com/weaveworks/flux/cluster"
 	"github.com/weaveworks/flux/cluster/kubernetes/testfiles"
 	"github.com/weaveworks/flux/resource"
 )
 
 // for convenience
-func base(source, kind, namespace, name string) baseObject {
-	b := baseObject{source: source, Kind: kind}
+func base(source, apiVersion, kind, namespace, name string) baseObject {
+	b := baseObject{source: source, scope: cluster.NamespaceScope, APIVersion: apiVersion, Kind: kind}
 	b.Meta.Namespace = namespace
 	b.Meta.Name = name
 	return b
@@ -24,7 +25,7 @@ func base(source, kind, namespace, name string) baseObject {
 func TestParseEmpty(t *testing.T) {
 	doc := ``
 
-	objs, err := ParseMultidoc([]byte(doc), "test")
+	objs, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	if err != nil {
 		t.Error(err)
 	}
@@ -35,22 +36,24 @@ func TestParseEmpty(t *testing.T) {
 
 func TestParseSome(t *testing.T) {
 	docs := `---
+apiVersion: apps/v1beta1
 kind: Deployment
 metadata:
   name: b-deployment
   namespace: b-namespace
 ---
+apiVersion: apps/v1beta1
 kind: Deployment
 metadata:
   name: a-deployment
 `
-	objs, err := ParseMultidoc([]byte(docs), "test")
+	objs, err := ParseMultidoc([]byte(docs), "test", cluster.MockScoper)
 	if err != nil {
 		t.Error(err)
 	}
 
-	objA := base("test", "Deployment", "", "a-deployment")
-	objB := base("test", "Deployment", "b-namespace", "b-deployment")
+	objA := base("test", "apps/v1beta1", "Deployment", "", "a-deployment")
+	objB := base("test", "apps/v1beta1", "Deployment", "b-namespace", "b-deployment")
 	expected := map[string]resource.Resource{
 		objA.ResourceID().String(): &Deployment{baseObject: objA},
 		objB.ResourceID().String(): &Deployment{baseObject: objB},
@@ -67,22 +70,24 @@ metadata:
 func TestParseSomeWithComment(t *testing.T) {
 	docs := `# some random comment
 ---
+apiVersion: apps/v1beta1
 kind: Deployment
 metadata:
   name: b-deployment
   namespace: b-namespace
 ---
+apiVersion: apps/v1beta1
 kind: Deployment
 metadata:
   name: a-deployment
 `
-	objs, err := ParseMultidoc([]byte(docs), "test")
+	objs, err := ParseMultidoc([]byte(docs), "test", cluster.MockScoper)
 	if err != nil {
 		t.Error(err)
 	}
 
-	objA := base("test", "Deployment", "", "a-deployment")
-	objB := base("test", "Deployment", "b-namespace", "b-deployment")
+	objA := base("test", "apps/v1beta1", "Deployment", "", "a-deployment")
+	objB := base("test", "apps/v1beta1", "Deployment", "b-namespace", "b-deployment")
 	expected := map[string]resource.Resource{
 		objA.ResourceID().String(): &Deployment{baseObject: objA},
 		objB.ResourceID().String(): &Deployment{baseObject: objB},
@@ -103,6 +108,7 @@ metadata:
 
 func TestParseSomeLong(t *testing.T) {
 	doc := `---
+apiVersion: v1
 kind: ConfigMap
 metadata:
   name: bigmap
@@ -115,7 +121,7 @@ data:
 		buffer.WriteString(line)
 	}
 
-	_, err := ParseMultidoc(buffer.Bytes(), "test")
+	_, err := ParseMultidoc(buffer.Bytes(), "test", cluster.MockScoper)
 	if err != nil {
 		t.Error(err)
 	}
@@ -137,7 +143,7 @@ spec:
           - name: weekly-curl-homepage
             image: centos:7 # Has curl installed by default
 `
-	objs, err := ParseMultidoc([]byte(doc), "test")
+	objs, err := ParseMultidoc([]byte(doc), "test", cluster.MockScoper)
 	assert.NoError(t, err)
 
 	obj, ok := objs["default:cronjob/weekly-curl-homepage"]
@@ -154,6 +160,7 @@ spec:
 
 func TestUnmarshalList(t *testing.T) {
 	doc := `---
+apiVersion: v1
 kind: List
 metadata:
   name: list
@@ -165,7 +172,7 @@ items:
   metadata:
     name: bar
 `
-	res, err := unmarshalObject("", []byte(doc))
+	res, err := unmarshalObject("", []byte(doc), cluster.MockScoper)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -200,7 +207,7 @@ func TestLoadSome(t *testing.T) {
 	if err := testfiles.WriteTestFiles(dir); err != nil {
 		t.Fatal(err)
 	}
-	objs, err := Load(dir, []string{dir})
+	objs, err := Load(dir, []string{dir}, cluster.MockScoper)
 	if err != nil {
 		t.Error(err)
 	}
@@ -231,7 +238,7 @@ func TestChartTracker(t *testing.T) {
 		if f == "garbage" {
 			continue
 		}
-		if m, err := Load(dir, []string{fq}); err != nil || len(m) == 0 {
+		if m, err := Load(dir, []string{fq}, cluster.MockScoper); err != nil || len(m) == 0 {
 			t.Errorf("Load returned 0 objs, err=%v", err)
 		}
 	}
@@ -250,7 +257,7 @@ func TestChartTracker(t *testing.T) {
 	}
 	for _, f := range chartfiles {
 		fq := filepath.Join(dir, f)
-		if m, err := Load(dir, []string{fq}); err != nil || len(m) != 0 {
+		if m, err := Load(dir, []string{fq}, cluster.MockScoper); err != nil || len(m) != 0 {
 			t.Errorf("%q not ignored as a chart should be", f)
 		}
 	}
diff --git a/cluster/kubernetes/resource/resource.go b/cluster/kubernetes/resource/resource.go
index f73d90b670..7bc04b8470 100644
--- a/cluster/kubernetes/resource/resource.go
+++ b/cluster/kubernetes/resource/resource.go
@@ -6,6 +6,7 @@ import (
 	yaml "gopkg.in/yaml.v2"
 
 	"github.com/weaveworks/flux"
+	"github.com/weaveworks/flux/cluster"
 	fluxerr "github.com/weaveworks/flux/errors"
 	"github.com/weaveworks/flux/policy"
 	"github.com/weaveworks/flux/resource"
@@ -19,10 +20,12 @@ const (
 
 // struct to embed in objects, to provide default implementation
 type baseObject struct {
-	source string
-	bytes  []byte
-	Kind   string `yaml:"kind"`
-	Meta   struct {
+	source     string
+	bytes      []byte
+	scope      int
+	APIVersion string `yaml:"apiVersion"`
+	Kind       string `yaml:"kind"`
+	Meta       struct {
 		Namespace   string            `yaml:"namespace"`
 		Name        string            `yaml:"name"`
 		Annotations map[string]string `yaml:"annotations,omitempty"`
@@ -31,7 +34,9 @@ type baseObject struct {
 
 func (o baseObject) ResourceID() flux.ResourceID {
 	ns := o.Meta.Namespace
-	if ns == "" {
+	if o.scope == cluster.NamespaceScope && ns == "" {
+		// namespace-scoped resources with an omitted namespace
+		// implicitly map to the default namespace in the cluster
 		ns = "default"
 	}
 	return flux.MakeResourceID(ns, o.Kind, o.Meta.Name)
@@ -66,19 +71,29 @@ func (o baseObject) Bytes() []byte {
 	return o.bytes
 }
 
-func unmarshalObject(source string, bytes []byte) (resource.Resource, error) {
+func unmarshalObject(source string, bytes []byte, scoper cluster.Scoper) (resource.Resource, error) {
 	var base = baseObject{source: source, bytes: bytes}
 	if err := yaml.Unmarshal(bytes, &base); err != nil {
 		return nil, err
 	}
-	r, err := unmarshalKind(base, bytes)
+	// Assume namespaced if there is no `kind` or `apiVersion`
+	// We are not, at least at the moment, reporting an error for invalid non-resource yamls
+	base.scope = cluster.NamespaceScope
+	if base.APIVersion != "" && base.Kind != "" {
+		scope, err := scoper.Scope(base.APIVersion, base.Kind)
+		if err != nil {
+			return nil, err
+		}
+		base.scope = scope
+	}
+	r, err := unmarshalKind(base, bytes, scoper)
 	if err != nil {
 		return nil, makeUnmarshalObjectErr(source, err)
 	}
 	return r, nil
 }
 
-func unmarshalKind(base baseObject, bytes []byte) (resource.Resource, error) {
+func unmarshalKind(base baseObject, bytes []byte, scoper cluster.Scoper) (resource.Resource, error) {
 	switch base.Kind {
 	case "CronJob":
 		var cj = CronJob{baseObject: base}
@@ -116,7 +131,7 @@ func unmarshalKind(base baseObject, bytes []byte) (resource.Resource, error) {
 			return nil, err
 		}
 		var list List
-		unmarshalList(base, &raw, &list)
+		unmarshalList(base, &raw, &list, scoper)
 		return &list, nil
 	case "FluxHelmRelease", "HelmRelease":
 		var fhr = FluxHelmRelease{baseObject: base}
@@ -142,7 +157,7 @@ type rawList struct {
 	Items []map[string]interface{}
 }
 
-func unmarshalList(base baseObject, raw *rawList, list *List) error {
+func unmarshalList(base baseObject, raw *rawList, list *List, scoper cluster.Scoper) error {
 	list.baseObject = base
 	list.Items = make([]resource.Resource, len(raw.Items), len(raw.Items))
 	for i, item := range raw.Items {
@@ -150,7 +165,7 @@ func unmarshalList(base baseObject, raw *rawList, list *List) error {
 		if err != nil {
 			return err
 		}
-		res, err := unmarshalObject(base.source, bytes)
+		res, err := unmarshalObject(base.source, bytes, scoper)
 		if err != nil {
 			return err
 		}
diff --git a/cluster/kubernetes/scoper.go b/cluster/kubernetes/scoper.go
new file mode 100644
index 0000000000..c2c16ec71a
--- /dev/null
+++ b/cluster/kubernetes/scoper.go
@@ -0,0 +1,33 @@
+package kubernetes
+
+import (
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/discovery"
+
+	"github.com/weaveworks/flux/cluster"
+)
+
+type Scoper struct {
+	Client *discovery.DiscoveryClient
+}
+
+func (s *Scoper) Scope(groupVersion string, kind string) (int, error) {
+	// TODO: add caching
+	resourceList, err := s.Client.ServerResourcesForGroupVersion(groupVersion)
+	if err != nil || resourceList == nil {
+		if errors.IsNotFound(err) {
+			cluster.ErrGroupVersionKindNotFound(groupVersion, kind)
+		}
+		return 0, err
+	}
+	for _, resource := range resourceList.APIResources {
+		if resource.Kind == kind {
+			if resource.Namespaced {
+				return cluster.NamespaceScope, nil
+			} else {
+				return cluster.ClusterScope, nil
+			}
+		}
+	}
+	return 0, cluster.ErrGroupVersionKindNotFound(groupVersion, kind)
+}
diff --git a/cluster/mock.go b/cluster/mock.go
index 4943bce447..a101f052c6 100644
--- a/cluster/mock.go
+++ b/cluster/mock.go
@@ -1,6 +1,8 @@
 package cluster
 
 import (
+	"path"
+
 	"github.com/weaveworks/flux"
 	"github.com/weaveworks/flux/image"
 	"github.com/weaveworks/flux/policy"
@@ -10,6 +12,7 @@ import (
 
 // Doubles as a cluster.Cluster and cluster.Manifests implementation
 type Mock struct {
+	Scoper             Scoper
 	AllServicesFunc    func(maybeNamespace string) ([]Controller, error)
 	SomeServicesFunc   func([]flux.ResourceID) ([]Controller, error)
 	PingFunc           func() error
@@ -17,8 +20,8 @@ type Mock struct {
 	SyncFunc           func(SyncDef) error
 	PublicSSHKeyFunc   func(regenerate bool) (ssh.PublicKey, error)
 	UpdateImageFunc    func(def []byte, id flux.ResourceID, container string, newImageID image.Ref) ([]byte, error)
-	LoadManifestsFunc  func(base string, paths []string) (map[string]resource.Resource, error)
-	ParseManifestsFunc func([]byte) (map[string]resource.Resource, error)
+	LoadManifestsFunc  func(base string, paths []string, scoper Scoper) (map[string]resource.Resource, error)
+	ParseManifestsFunc func([]byte, Scoper) (map[string]resource.Resource, error)
 	UpdateManifestFunc func(path, resourceID string, f func(def []byte) ([]byte, error)) error
 	UpdatePoliciesFunc func([]byte, flux.ResourceID, policy.Update) ([]byte, error)
 }
@@ -52,11 +55,11 @@ func (m *Mock) UpdateImage(def []byte, id flux.ResourceID, container string, new
 }
 
 func (m *Mock) LoadManifests(base string, paths []string) (map[string]resource.Resource, error) {
-	return m.LoadManifestsFunc(base, paths)
+	return m.LoadManifestsFunc(base, paths, m.Scoper)
 }
 
 func (m *Mock) ParseManifests(def []byte) (map[string]resource.Resource, error) {
-	return m.ParseManifestsFunc(def)
+	return m.ParseManifestsFunc(def, m.Scoper)
 }
 
 func (m *Mock) UpdateManifest(path string, resourceID string, f func(def []byte) ([]byte, error)) error {
@@ -66,3 +69,28 @@ func (m *Mock) UpdateManifest(path string, resourceID string, f func(def []byte)
 func (m *Mock) UpdatePolicies(def []byte, id flux.ResourceID, p policy.Update) ([]byte, error) {
 	return m.UpdatePoliciesFunc(def, id, p)
 }
+
+type mockScoper struct {
+	groupVersionKindToScope map[string]int
+}
+
+func (ms *mockScoper) Scope(groupVersion string, kind string) (int, error) {
+	scope, found := ms.groupVersionKindToScope[path.Join(groupVersion, kind)]
+	if !found {
+		return 0, ErrGroupVersionKindNotFound(groupVersion, kind)
+	}
+	return scope, nil
+}
+
+var MockScoper = &mockScoper{
+	groupVersionKindToScope: map[string]int{
+		"apps/v1/DaemonSet":             NamespaceScope,
+		"apps/v1beta1/Deployment":       NamespaceScope,
+		"batch/v1beta1/CronJob":         NamespaceScope,
+		"extensions/v1beta1/Deployment": NamespaceScope,
+		"helm.integrations.flux.weave.works/v1alpha2/FluxHelmRelease": NamespaceScope,
+		"v1/List":      NamespaceScope,
+		"v1/ConfigMap": NamespaceScope,
+		"v1/Service":   NamespaceScope,
+	},
+}
diff --git a/cluster/scoper.go b/cluster/scoper.go
new file mode 100644
index 0000000000..1a78c1afd9
--- /dev/null
+++ b/cluster/scoper.go
@@ -0,0 +1,25 @@
+package cluster
+
+import (
+	"fmt"
+)
+
+const (
+	ClusterScope = iota
+	NamespaceScope
+)
+
+type ScoperError struct {
+	error
+}
+
+func ErrGroupVersionKindNotFound(groupVersion string, kind string) error {
+	return ScoperError{fmt.Errorf("apiVersion (%q) Kind (%q) combination not found", groupVersion, kind)}
+}
+
+// Scoper obtains the scope (ClusterScope or NamespaceScope) of a kubernetes resource
+// given its group version (e.g. "rbac.authorization.k8s.io/v1beta1") and its kind (e.g.
+// "ClusterRoleBinding")
+type Scoper interface {
+	Scope(groupVersion string, kind string) (int, error)
+}
diff --git a/cmd/fluxd/main.go b/cmd/fluxd/main.go
index 073dbbfcb1..a3d68f680b 100644
--- a/cmd/fluxd/main.go
+++ b/cmd/fluxd/main.go
@@ -18,6 +18,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/spf13/pflag"
 	k8sifclient "github.com/weaveworks/flux/integrations/client/clientset/versioned"
+	"k8s.io/client-go/discovery"
 	k8sclient "k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 
@@ -272,9 +273,17 @@ func main() {
 
 		k8s = k8sInst
 		imageCreds = k8sInst.ImagesToFetch
+		k8sDiscoveryClient, err := discovery.NewDiscoveryClientForConfig(restClientConfig)
+		if err != nil {
+			logger.Log("err", err)
+			os.Exit(1)
+		}
 		// There is only one way we currently interpret a repo of
 		// files as manifests, and that's as Kubernetes yamels.
-		k8sManifests = &kubernetes.Manifests{AllowedNamespaces: allowedNamespaces}
+		k8sManifests = &kubernetes.Manifests{
+			AllowedNamespaces: allowedNamespaces,
+			Scoper:            &kubernetes.Scoper{Client: k8sDiscoveryClient},
+		}
 	}
 
 	// Wrap the procedure for collecting images to scan
diff --git a/daemon/daemon_test.go b/daemon/daemon_test.go
index 6cdaca4b6f..d5a2c28615 100644
--- a/daemon/daemon_test.go
+++ b/daemon/daemon_test.go
@@ -651,8 +651,8 @@ func mockDaemon(t *testing.T) (*Daemon, func(), func(), *cluster.Mock, *mockEven
 		}
 		k8s.ExportFunc = func() ([]byte, error) { return testBytes, nil }
 		k8s.LoadManifestsFunc = kresource.Load
-		k8s.ParseManifestsFunc = func(allDefs []byte) (map[string]resource.Resource, error) {
-			return kresource.ParseMultidoc(allDefs, "test")
+		k8s.ParseManifestsFunc = func(allDefs []byte, scoper cluster.Scoper) (map[string]resource.Resource, error) {
+			return kresource.ParseMultidoc(allDefs, "test", scoper)
 		}
 		k8s.PingFunc = func() error { return nil }
 		k8s.SomeServicesFunc = func([]flux.ResourceID) ([]cluster.Controller, error) {
@@ -661,8 +661,9 @@ func mockDaemon(t *testing.T) (*Daemon, func(), func(), *cluster.Mock, *mockEven
 			}, nil
 		}
 		k8s.SyncFunc = func(def cluster.SyncDef) error { return nil }
-		k8s.UpdatePoliciesFunc = (&kubernetes.Manifests{}).UpdatePolicies
-		k8s.UpdateImageFunc = (&kubernetes.Manifests{}).UpdateImage
+		manifests := &kubernetes.Manifests{Scoper: cluster.MockScoper}
+		k8s.UpdatePoliciesFunc = manifests.UpdatePolicies
+		k8s.UpdateImageFunc = manifests.UpdateImage
 	}
 
 	var imageRegistry registry.Registry
@@ -697,7 +698,7 @@ func mockDaemon(t *testing.T) (*Daemon, func(), func(), *cluster.Mock, *mockEven
 		Repo:           repo,
 		GitConfig:      params,
 		Cluster:        k8s,
-		Manifests:      &kubernetes.Manifests{},
+		Manifests:      &kubernetes.Manifests{Scoper: cluster.MockScoper},
 		Registry:       imageRegistry,
 		V:              testVersion,
 		Jobs:           jobs,
diff --git a/daemon/loop_test.go b/daemon/loop_test.go
index 58db170785..2ae616cc56 100644
--- a/daemon/loop_test.go
+++ b/daemon/loop_test.go
@@ -41,10 +41,10 @@ var (
 func daemon(t *testing.T) (*Daemon, func()) {
 	repo, repoCleanup := gittest.Repo(t)
 
-	k8s = &cluster.Mock{}
+	k8s = &cluster.Mock{Scoper: cluster.MockScoper}
 	k8s.LoadManifestsFunc = kresource.Load
-	k8s.ParseManifestsFunc = func(allDefs []byte) (map[string]resource.Resource, error) {
-		return kresource.ParseMultidoc(allDefs, "exported")
+	k8s.ParseManifestsFunc = func(allDefs []byte, scoper cluster.Scoper) (map[string]resource.Resource, error) {
+		return kresource.ParseMultidoc(allDefs, "exported", scoper)
 	}
 	k8s.ExportFunc = func() ([]byte, error) { return nil, nil }
 
diff --git a/http/client/client.go b/http/client/client.go
index c6dac72bb4..7259279bbd 100644
--- a/http/client/client.go
+++ b/http/client/client.go
@@ -31,7 +31,7 @@ type Token string
 
 func (t Token) Set(req *http.Request) {
 	if string(t) != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("Scope-Probe token=%s", t))
+		req.Header.Set("Authorization", fmt.Sprintf("Scoper-Probe token=%s", t))
 	}
 }
 
diff --git a/http/websocket/websocket_test.go b/http/websocket/websocket_test.go
index ea95f5c44d..4644996ce1 100644
--- a/http/websocket/websocket_test.go
+++ b/http/websocket/websocket_test.go
@@ -16,7 +16,7 @@ func TestToken(t *testing.T) {
 	token := "toooookkkkkeeeeennnnnn"
 	upgrade := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		tok := r.Header.Get("Authorization")
-		if tok != "Scope-Probe token="+token {
+		if tok != "Scoper-Probe token="+token {
 			t.Fatal("Did not get authorisation header, got: " + tok)
 		}
 		_, err := Upgrade(w, r, nil)
diff --git a/integrations/client/clientset/versioned/clientset.go b/integrations/client/clientset/versioned/clientset.go
index 261b1b108e..f181bd622f 100644
--- a/integrations/client/clientset/versioned/clientset.go
+++ b/integrations/client/clientset/versioned/clientset.go
@@ -63,7 +63,7 @@ func (c *Clientset) Helm() helmv1alpha2.HelmV1alpha2Interface {
 	return c.helmV1alpha2
 }
 
-// Discovery retrieves the DiscoveryClient
+// Discovery retrieves the Scoper
 func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 	if c == nil {
 		return nil
diff --git a/release/releaser_test.go b/release/releaser_test.go
index faa9e75200..c13143038a 100644
--- a/release/releaser_test.go
+++ b/release/releaser_test.go
@@ -135,7 +135,7 @@ var (
 			},
 		},
 	}
-	mockManifests = &kubernetes.Manifests{}
+	mockManifests = &kubernetes.Manifests{Scoper: cluster.MockScoper}
 )
 
 func mockCluster(running ...cluster.Controller) *cluster.Mock {
@@ -1058,7 +1058,7 @@ func (m *badManifests) UpdateImage(def []byte, resourceID flux.ResourceID, conta
 }
 
 func Test_BadRelease(t *testing.T) {
-	cluster := mockCluster(hwSvc)
+	k8sCluster := mockCluster(hwSvc)
 	spec := update.ReleaseImageSpec{
 		ServiceSpecs: []update.ResourceSpec{update.ResourceSpecAll},
 		ImageSpec:    update.ImageSpecFromRef(newHwRef),
@@ -1069,8 +1069,8 @@ func Test_BadRelease(t *testing.T) {
 	defer cleanup1()
 
 	ctx := &ReleaseContext{
-		cluster:   cluster,
-		manifests: &kubernetes.Manifests{},
+		cluster:   k8sCluster,
+		manifests: &kubernetes.Manifests{Scoper: cluster.MockScoper},
 		repo:      checkout1,
 		registry:  mockRegistry,
 	}
@@ -1083,8 +1083,8 @@ func Test_BadRelease(t *testing.T) {
 	defer cleanup2()
 
 	ctx = &ReleaseContext{
-		cluster:   cluster,
-		manifests: &badManifests{Manifests: kubernetes.Manifests{}},
+		cluster:   k8sCluster,
+		manifests: &badManifests{Manifests: kubernetes.Manifests{Scoper: cluster.MockScoper}},
 		repo:      checkout2,
 		registry:  mockRegistry,
 	}
diff --git a/sync/sync_test.go b/sync/sync_test.go
index e9d62dcf9e..b7c0c23b9b 100644
--- a/sync/sync_test.go
+++ b/sync/sync_test.go
@@ -31,7 +31,7 @@ func TestSync(t *testing.T) {
 
 	// Start with nothing running. We should be told to apply all the things.
 	mockCluster := &cluster.Mock{}
-	manifests := &kubernetes.Manifests{}
+	manifests := &kubernetes.Manifests{Scoper: cluster.MockScoper}
 	var clus cluster.Cluster = &syncCluster{mockCluster, map[string][]byte{}}
 
 	dirs := checkout.ManifestDirs()