diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 2f4298a..c622163 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -4,6 +4,18 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - irsa.kkb0318.github.io
   resources:
diff --git a/internal/client/aws.go b/internal/client/aws.go
index f15d7a8..8d708d7 100644
--- a/internal/client/aws.go
+++ b/internal/client/aws.go
@@ -138,9 +138,9 @@ func (a *AwsS3Client) DeleteBucket(ctx context.Context) error {
 
 // DeleteObjects removes a list of objects from a specified bucket.
 func (a *AwsS3Client) DeleteObjects(ctx context.Context, objectKeys []string) error {
-	var objectIds []types.ObjectIdentifier
-	for _, key := range objectKeys {
-		objectIds = append(objectIds, types.ObjectIdentifier{Key: aws.String(key)})
+	objectIds := make([]types.ObjectIdentifier, len(objectKeys))
+	for i, key := range objectKeys {
+		objectIds[i] = types.ObjectIdentifier{Key: aws.String(key)}
 	}
 	_, err := a.Client.DeleteObjects(ctx, &s3.DeleteObjectsInput{
 		Bucket: aws.String(a.bucketName),
diff --git a/internal/controller/irsasetup_controller.go b/internal/controller/irsasetup_controller.go
index 08b4ab5..43914b9 100644
--- a/internal/controller/irsasetup_controller.go
+++ b/internal/controller/irsasetup_controller.go
@@ -46,6 +46,7 @@ type IRSASetupReconciler struct {
 //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups/finalizers,verbs=update
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
@@ -102,7 +103,7 @@ func (r *IRSASetupReconciler) reconcileDelete(ctx context.Context, obj *irsav1al
 	if err != nil {
 		return err
 	}
-	secret, err := manifests.NewSecretBuilder().Build("name", "default") // TODO:
+	secret, err := manifests.NewSecretBuilder().Build(manifests.SshKeyNamespacedName())
 	if err != nil {
 		return err
 	}
@@ -132,7 +133,7 @@ func reconcileSelfhosted(ctx context.Context, obj *irsav1alpha1.IRSASetup, awsCl
 	if err != nil {
 		return err
 	}
-	secret, err := manifests.NewSecretBuilder().WithSSHKey(*keyPair).Build("name", "default") // TODO:
+	secret, err := manifests.NewSecretBuilder().WithSSHKey(*keyPair).Build(manifests.SshKeyNamespacedName())
 	if err != nil {
 		return err
 	}
diff --git a/internal/controller/irsasetup_controller_test.go b/internal/controller/irsasetup_controller_test.go
index fbd7521..203ffa4 100644
--- a/internal/controller/irsasetup_controller_test.go
+++ b/internal/controller/irsasetup_controller_test.go
@@ -76,7 +76,7 @@ var _ = Describe("IRSASetup Controller", func() {
 			awsClient := newMockAwsClient()
 			expected := []types.NamespacedName{
 				// TODO:
-				{Name: "name", Namespace: "default"},
+				{Name: "irsa-manager-key", Namespace: "kube-system"},
 			}
 
 			By("Reconciling the created resource")
diff --git a/internal/kubernetes/client.go b/internal/kubernetes/client.go
index c7579dc..efd5403 100644
--- a/internal/kubernetes/client.go
+++ b/internal/kubernetes/client.go
@@ -5,7 +5,6 @@ import (
 )
 
 type KubernetesClient struct {
-	client  client.Client
-	owner   Owner
-	cleanup bool
+	client client.Client
+	owner  Owner
 }
diff --git a/internal/manifests/keys_secret.go b/internal/manifests/keys_secret.go
index 14f06ba..5ce7985 100644
--- a/internal/manifests/keys_secret.go
+++ b/internal/manifests/keys_secret.go
@@ -4,8 +4,16 @@ import (
 	"github.com/kkb0318/irsa-manager/internal/selfhosted"
 	corev1 "k8s.io/api/core/v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 )
 
+func SshKeyNamespacedName() types.NamespacedName {
+	return types.NamespacedName{
+		Namespace: "kube-system",
+		Name:      "irsa-manager-key",
+	}
+}
+
 type SecretBuilder struct {
 	data       map[string][]byte
 	secretType corev1.SecretType
@@ -26,11 +34,11 @@ func (b *SecretBuilder) WithSSHKey(keyPair selfhosted.KeyPair) *SecretBuilder {
 	return b
 }
 
-func (b *SecretBuilder) Build(name, ns string) (*corev1.Secret, error) {
+func (b *SecretBuilder) Build(namespacedName types.NamespacedName) (*corev1.Secret, error) {
 	secret := &corev1.Secret{
 		ObjectMeta: v1.ObjectMeta{
-			Name:      name,
-			Namespace: ns,
+			Name:      namespacedName.Name,
+			Namespace: namespacedName.Namespace,
 		},
 		TypeMeta: v1.TypeMeta{
 			APIVersion: corev1.SchemeGroupVersion.String(),