diff --git a/bnk/bnk-gatewayclass/module.json b/bnk/bnk-gatewayclass/module.json
index da09779..08569eb 100644
--- a/bnk/bnk-gatewayclass/module.json
+++ b/bnk/bnk-gatewayclass/module.json
@@ -38,7 +38,7 @@
         "source": "module",
         "from_module": "bnk/flo",
         "from_output": "flo_namespace",
-        "default": "f5-operator"
+        "default": "f5-cne-core"
       },
       {
         "name": "instance_ready",
diff --git a/bnk/bnk-vlans/module.json b/bnk/bnk-vlans/module.json
index d17f8ef..5afd833 100644
--- a/bnk/bnk-vlans/module.json
+++ b/bnk/bnk-vlans/module.json
@@ -35,11 +35,11 @@
       {
         "name": "namespace",
         "type": "string",
-        "description": "Namespace where BNK components are deployed",
-        "default": "f5-operator",
+        "description": "Namespace where BNK instance components are deployed",
+        "default": "f5-bnk",
         "source": "module",
         "from_module": "k8s/bnk-prerequisites",
-        "from_output": "operator_namespace"
+        "from_output": "cne_instance_namespace"
       },
       {
         "name": "external_subnet_cidrs",
diff --git a/bnk/bnk-vlans/variables.tf b/bnk/bnk-vlans/variables.tf
index e3d91ad..3a6e55f 100644
--- a/bnk/bnk-vlans/variables.tf
+++ b/bnk/bnk-vlans/variables.tf
@@ -25,7 +25,7 @@ variable "cluster_name" {
 variable "namespace" {
   description = "Namespace for VLAN CRs (must match CNEInstance namespace)"
   type        = string
-  default     = "f5-operator"
+  default     = "f5-bnk"
 }
 
 # =============================================================================
diff --git a/bnk/cneinstance/main.tf b/bnk/cneinstance/main.tf
index 84523d0..d0e3b60 100644
--- a/bnk/cneinstance/main.tf
+++ b/bnk/cneinstance/main.tf
@@ -68,12 +68,12 @@ locals {
   multus_networks_annotation = local.is_kernel_mode ? jsonencode([
     {
       name      = var.external_nad_name
-      namespace = var.instance_namespace
+      namespace = var.namespace
       interface = "eth1"
     },
     {
       name      = var.internal_nad_name
-      namespace = var.instance_namespace
+      namespace = var.namespace
       interface = "eth2"
     }
   ]) : ""
@@ -135,7 +135,7 @@ locals {
     kind       = "CNEInstance"
     metadata = {
       name      = var.instance_name
-      namespace = var.instance_namespace
+      namespace = var.namespace
       labels = {
         "app.kubernetes.io/name"       = var.instance_name
         "app.kubernetes.io/component"  = "cne-instance"
@@ -263,7 +263,7 @@ locals {
     kind       = "ConfigMap"
     metadata = {
       name      = "tmm-init"
-      namespace = var.instance_namespace
+      namespace = var.namespace
       labels = {
         "app.kubernetes.io/name"       = "tmm-init"
         "app.kubernetes.io/component"  = "tmm-config"
@@ -297,7 +297,7 @@ resource "null_resource" "tmm_init_apply" {
 
   triggers = {
     cm_hash    = sha256(yamlencode(local.tmm_init_configmap))
-    namespace  = var.instance_namespace
+    namespace  = var.namespace
     kubeconfig = local_file.kubeconfig.filename
     name       = "tmm-init"
   }
@@ -336,7 +336,7 @@ resource "null_resource" "cloud_network_mapping" {
 
   triggers = {
     mappings_hash = sha256(jsonencode(var.cloud_az_subnet_mappings))
-    namespace     = var.instance_namespace
+    namespace     = var.namespace
     kubeconfig    = local_file.kubeconfig.filename
   }
 
@@ -348,7 +348,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: cloud-network-mapping
-  namespace: ${var.instance_namespace}
+  namespace: ${var.namespace}
 data:
   config.yaml: |
     availability_zones:
@@ -393,7 +393,7 @@ resource "null_resource" "cneinstance" {
   triggers = {
     manifest_hash = sha256(yamlencode(local.cneinstance_manifest))
     name          = var.instance_name
-    namespace     = var.instance_namespace
+    namespace     = var.namespace
     kubeconfig    = local_file.kubeconfig.filename
     # Run every apply — if the CNEInstance CR is deleted out-of-band (cluster
     # disruption, manual cleanup, bnk_cleanup destroy), manifest_hash won't
@@ -465,11 +465,11 @@ resource "null_resource" "wait_for_available" {
       while [ $ELAPSED -lt $TIMEOUT ]; do
         # Get the Available condition
         STATUS=$(${local.kubectl} get cneinstance ${var.instance_name} \
-          -n ${var.instance_namespace} \
+          -n ${var.namespace} \
           -o jsonpath='{.status.conditions[?(@.type=="Available")].status}' 2>/dev/null)
 
         REASON=$(${local.kubectl} get cneinstance ${var.instance_name} \
-          -n ${var.instance_namespace} \
+          -n ${var.namespace} \
           -o jsonpath='{.status.conditions[?(@.type=="Available")].reason}' 2>/dev/null)
 
         if [ "$STATUS" = "True" ]; then
@@ -486,10 +486,10 @@ resource "null_resource" "wait_for_available" {
         echo ""
         echo "WARNING: CNEInstance not yet Available after $${TIMEOUT}s"
         echo "This may be normal for first deployment. Check FLO logs:"
-        echo "  kubectl logs -n ${var.instance_namespace} -l app=flo --tail=50"
+        echo "  kubectl logs -n ${var.namespace} -l app=flo --tail=50"
         echo ""
         echo "Current CNEInstance status:"
-        ${local.kubectl} get cneinstance ${var.instance_name} -n ${var.instance_namespace} -o yaml 2>/dev/null | grep -A5 "conditions:" || true
+        ${local.kubectl} get cneinstance ${var.instance_name} -n ${var.namespace} -o yaml 2>/dev/null | grep -A5 "conditions:" || true
         # Don't fail — the instance may still be deploying
       fi
     EOT
@@ -510,19 +510,19 @@ resource "null_resource" "verify_pods" {
       KUBECTL="${local.kubectl}"
 
       echo ""
-      echo "--- Pods in ${var.instance_namespace} ---"
-      $KUBECTL get pods -n ${var.instance_namespace} -o wide 2>/dev/null
+      echo "--- Pods in ${var.namespace} ---"
+      $KUBECTL get pods -n ${var.namespace} -o wide 2>/dev/null
 
       echo ""
       echo "--- CNEInstance Status ---"
-      $KUBECTL get cneinstance ${var.instance_name} -n ${var.instance_namespace} 2>/dev/null
+      $KUBECTL get cneinstance ${var.instance_name} -n ${var.namespace} 2>/dev/null
 
       echo ""
       echo "--- Component Summary ---"
       # Count running pods
-      TOTAL=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | wc -l)
-      RUNNING=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | grep -c "Running" || true)
-      COMPLETED=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | grep -c "Completed" || true)
+      TOTAL=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | wc -l)
+      RUNNING=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | grep -c "Running" || true)
+      COMPLETED=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | grep -c "Completed" || true)
 
       echo "Total pods: $TOTAL"
       echo "Running: $RUNNING"
@@ -532,7 +532,7 @@ resource "null_resource" "verify_pods" {
       echo ""
       echo "--- Key Components ---"
       for component in flo cne-controller tmm cwc dssm observer otel rabbit fluentd; do
-        COUNT=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | grep -c "$component" || true)
+        COUNT=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | grep -c "$component" || true)
         if [ "$COUNT" -gt 0 ]; then
           echo "  OK: $component ($COUNT pods)"
         else
diff --git a/bnk/cneinstance/module.json b/bnk/cneinstance/module.json
index e2a44a6..77470db 100644
--- a/bnk/cneinstance/module.json
+++ b/bnk/cneinstance/module.json
@@ -40,13 +40,13 @@
   "inputs": {
     "required": [
       {
-        "name": "instance_namespace",
+        "name": "namespace",
         "type": "string",
-        "description": "Namespace for CNEInstance",
+        "description": "Namespace for CNEInstance and workloads",
         "source": "module",
-        "from_module": "bnk/flo",
-        "from_output": "flo_namespace",
-        "default": "f5-operator"
+        "from_module": "k8s/bnk-prerequisites",
+        "from_output": "cne_instance_namespace",
+        "default": "f5-bnk"
       },
       {
         "name": "manifest_version",
@@ -161,7 +161,7 @@
         "sensitive": false
       },
       {
-        "name": "instance_namespace",
+        "name": "namespace",
         "type": "string",
         "description": "Namespace of the CNEInstance",
         "used_by": ["bnk/bnk-gatewayclass"],
diff --git a/bnk/cneinstance/outputs.tf b/bnk/cneinstance/outputs.tf
index c1338a4..ffb27f8 100644
--- a/bnk/cneinstance/outputs.tf
+++ b/bnk/cneinstance/outputs.tf
@@ -5,9 +5,9 @@ output "instance_name" {
   value       = var.instance_name
 }
 
-output "instance_namespace" {
+output "namespace" {
   description = "Namespace of the CNEInstance"
-  value       = var.instance_namespace
+  value       = var.namespace
 }
 
 output "instance_ready" {
diff --git a/bnk/cneinstance/variables.tf b/bnk/cneinstance/variables.tf
index 22e07f9..40fd886 100644
--- a/bnk/cneinstance/variables.tf
+++ b/bnk/cneinstance/variables.tf
@@ -33,10 +33,10 @@ variable "instance_name" {
   }
 }
 
-variable "instance_namespace" {
-  description = "Namespace for CNEInstance (wired from flo.flo_namespace)"
+variable "namespace" {
+  description = "Namespace for CNEInstance and workloads (wired from bnk-prerequisites.cne_instance_namespace)"
   type        = string
-  default     = "f5-operator"
+  default     = "f5-bnk"
 }
 
 # =============================================================================
diff --git a/bnk/flo/module.json b/bnk/flo/module.json
index f2af2fa..72d6b39 100644
--- a/bnk/flo/module.json
+++ b/bnk/flo/module.json
@@ -41,8 +41,8 @@
         "description": "Namespace for FLO deployment",
         "source": "module",
         "from_module": "k8s/bnk-prerequisites",
-        "from_output": "operator_namespace",
-        "default": "f5-operator"
+        "from_output": "cne_core_namespace",
+        "default": "f5-cne-core"
       },
       {
         "name": "flo_version",
diff --git a/k8s/bnk-prerequisites/README.md b/k8s/bnk-prerequisites/README.md
index d6f631b..d722ba2 100644
--- a/k8s/bnk-prerequisites/README.md
+++ b/k8s/bnk-prerequisites/README.md
@@ -6,15 +6,22 @@ The first module in the BNK stack. Creates required namespaces, distributes FAR
 
 ## What It Does
 
-1. **Creates namespaces**: `f5-operator` (BNK components), `f5-utils` (IPAM), `gateway-ns` (Gateway resources)
-2. **Creates FAR secrets**: Image pull secrets in all namespaces for `repo.f5.com` access
+1. **Creates namespaces**: `f5-cne-core` (FLO, CWC, IPAM, Observer, OTEL) and `f5-bnk` (CNEInstance workloads — TMM, controller, VLANs, NADs)
+2. **Creates FAR secrets**: Image pull secrets in both namespaces for `repo.f5.com` access
 3. **Downloads BNK manifest**: From F5 Artifact Registry using the service account key
 4. **Parses versions**: Extracts FLO Helm chart version and component versions from manifest
 5. **Destroy cleanup**: Strips F5 finalizers and webhooks to prevent stuck resources
 
+### Namespace Model (F5 BNK 2.2)
+
+Per F5 BNK 2.2 documentation, the two-namespace model is:
+
+- **`f5-cne-core`**: FLO operator and CNE core components (CWC, IPAM, RabbitMQ, Observer, OTEL)
+- **`f5-bnk`** (configurable): CNEInstance workloads (TMM, CNE controller, VLANs, NADs)
+
 ## Dependencies
 
-- **EKS Cluster**: Running Kubernetes cluster with valid credentials
+- **Kubernetes Cluster**: Running cluster with valid credentials
 - No other BNK modules — this is the entry point
 
 ## Usage
@@ -27,12 +34,11 @@ module "bnk_prerequisites" {
   cne_pull_secret = var.cne_pull_secret  # base64-encoded JSON
 
   # BNK manifest version
-  bnk_manifest_version = "2.2.0-3.2226.0-0.0.385"
+  bnk_manifest_version = "2.2.1-3.2226.0-0.0.511"
 
-  # Namespace configuration (defaults are standard)
-  operator_namespace = "f5-operator"
-  utils_namespace    = "f5-utils"
-  gateway_namespace  = "gateway-ns"
+  # Namespace configuration (defaults match F5 BNK 2.2 docs)
+  cne_core_namespace     = "f5-cne-core"
+  cne_instance_namespace = "f5-bnk"
 
   # Cluster (auto-wired)
   cluster_name = module.eks.cluster_name
@@ -44,19 +50,17 @@ module "bnk_prerequisites" {
 | Name | Description | Type | Required | Default |
 |------|-------------|------|----------|---------|
 | cne_pull_secret | Base64-encoded F5 FAR service account key | string (sensitive) | yes | - |
-| bnk_manifest_version | BNK manifest version to download | string | no | "2.2.0-3.2226.0-0.0.385" |
-| operator_namespace | Namespace for FLO + BNK components | string | no | "f5-operator" |
-| utils_namespace | Namespace for utility components | string | no | "f5-utils" |
-| gateway_namespace | Namespace for Gateway API resources | string | no | "gateway-ns" |
+| bnk_manifest_version | BNK manifest version to download | string | no | "2.2.1-3.2226.0-0.0.511" |
+| cne_core_namespace | Namespace for FLO + CNE core components | string | no | "f5-cne-core" |
+| cne_instance_namespace | Namespace for CNEInstance workloads | string | no | "f5-bnk" |
 | cluster_name | Kubernetes cluster name | string | no | "" |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| operator_namespace | Operator namespace name |
-| utils_namespace | Utils namespace name |
-| gateway_namespace | Gateway namespace name |
+| cne_core_namespace | CNE core namespace name |
+| cne_instance_namespace | CNE instance namespace name |
 | far_secret_name | FAR image pull secret name (always "far-secret") |
 | flo_version | FLO Helm chart version (parsed from manifest) |
 | manifest_version | BNK manifest version used |
@@ -68,12 +72,11 @@ module "bnk_prerequisites" {
 
 ```bash
 # Check namespaces
-kubectl get ns | grep -E "f5-operator|f5-utils|gateway-ns"
+kubectl get ns | grep -E "f5-cne-core|f5-bnk"
 
-# Check FAR secrets exist in all namespaces
-kubectl get secret far-secret -n f5-operator
-kubectl get secret far-secret -n f5-utils
-kubectl get secret far-secret -n gateway-ns
+# Check FAR secrets exist in both namespaces
+kubectl get secret far-secret -n f5-cne-core
+kubectl get secret far-secret -n f5-bnk
 ```
 
 ## References
@@ -85,4 +88,4 @@ kubectl get secret far-secret -n gateway-ns
 - **Category**: k8s
 - **Workflow Compatibility**: Greenfield, Partial
 - **Version**: 2.2.0
-- **Last Updated**: 2026-03-04
+- **Last Updated**: 2026-04-29
diff --git a/k8s/bnk-prerequisites/main.tf b/k8s/bnk-prerequisites/main.tf
index c1d77dd..32c7ceb 100644
--- a/k8s/bnk-prerequisites/main.tf
+++ b/k8s/bnk-prerequisites/main.tf
@@ -2,7 +2,7 @@
 # BNK Prerequisites — Namespaces + FAR Secrets + Manifest Download
 #
 # This module is the FIRST module in the BNK stack. It:
-# 1. Creates required namespaces (f5-operator, f5-utils, gateway-ns)
+# 1. Creates required namespaces (f5-cne-core, f5-bnk) per F5 BNK 2.2 two-namespace model
 # 2. Creates FAR image pull secrets from cne_pull_secret (project secret)
 # 3. Downloads BNK manifest from repo.f5.com
 # 4. Parses component versions (FLO version, cert-manager version, etc.)
@@ -120,9 +120,9 @@ locals {
 
 resource "null_resource" "bnk_cleanup" {
   triggers = {
-    operator_namespace = var.operator_namespace
-    utils_namespace    = var.utils_namespace
-    kubeconfig         = local_file.kubeconfig.filename
+    cne_core_namespace     = var.cne_core_namespace
+    cne_instance_namespace = var.cne_instance_namespace
+    kubeconfig             = local_file.kubeconfig.filename
   }
 
   # Create: no-op
@@ -135,7 +135,8 @@ resource "null_resource" "bnk_cleanup" {
     when    = destroy
     command = <<-EOT
       KUBECONFIG="${self.triggers.kubeconfig}"
-      NS="${self.triggers.operator_namespace}"
+      CORE_NS="${self.triggers.cne_core_namespace}"
+      INST_NS="${self.triggers.cne_instance_namespace}"
       KC="kubectl --kubeconfig $KUBECONFIG"
 
       echo "=== BNK Pre-Destroy Cleanup ==="
@@ -151,24 +152,24 @@ resource "null_resource" "bnk_cleanup" {
         $KC delete $wh --timeout=10s 2>/dev/null || true
       done
 
-      # Step 2: Strip finalizers from all F5 CRD instances in namespace
-      echo "Step 2: Stripping finalizers from F5 CRD instances..."
+      # Step 2: Strip finalizers from all F5 CRD instances in core namespace
+      echo "Step 2: Stripping finalizers from F5 CRD instances (core namespace)..."
       F5_CRDS=$($KC get crd -o name 2>/dev/null | grep -E 'k8s\.f5\.(com|net\.com)' | sed 's|customresourcedefinition.apiextensions.k8s.io/||')
       for crd in $F5_CRDS; do
-        RESOURCES=$($KC get $crd -n $NS -o name 2>/dev/null)
+        RESOURCES=$($KC get $crd -n $CORE_NS -o name 2>/dev/null)
         for res in $RESOURCES; do
-          echo "  Patching $res"
-          $KC patch $res -n $NS --type=merge -p '{"metadata":{"finalizers":null}}' 2>/dev/null || true
+          echo "  Patching $res (in $CORE_NS)"
+          $KC patch $res -n $CORE_NS --type=merge -p '{"metadata":{"finalizers":null}}' 2>/dev/null || true
         done
       done
 
-      # Step 3: Also check utils namespace
-      F5_UTILS_NS="${self.triggers.utils_namespace}"
+      # Step 3: Also check instance namespace
+      echo "Step 3: Stripping finalizers from F5 CRD instances (instance namespace)..."
       for crd in $F5_CRDS; do
-        RESOURCES=$($KC get $crd -n $F5_UTILS_NS -o name 2>/dev/null)
+        RESOURCES=$($KC get $crd -n $INST_NS -o name 2>/dev/null)
         for res in $RESOURCES; do
-          echo "  Patching $res (in $F5_UTILS_NS)"
-          $KC patch $res -n $F5_UTILS_NS --type=merge -p '{"metadata":{"finalizers":null}}' 2>/dev/null || true
+          echo "  Patching $res (in $INST_NS)"
+          $KC patch $res -n $INST_NS --type=merge -p '{"metadata":{"finalizers":null}}' 2>/dev/null || true
         done
       done
 
@@ -191,9 +192,8 @@ resource "null_resource" "bnk_cleanup" {
   }
 
   depends_on = [
-    kubernetes_namespace_v1.operator,
-    kubernetes_namespace_v1.utils,
-    kubernetes_namespace_v1.gateway
+    kubernetes_namespace_v1.cne_core,
+    kubernetes_namespace_v1.cne_instance,
   ]
 }
 
@@ -201,47 +201,32 @@ resource "null_resource" "bnk_cleanup" {
 # NAMESPACES
 # =============================================================================
 
-resource "kubernetes_namespace_v1" "operator" {
+resource "kubernetes_namespace_v1" "cne_core" {
   metadata {
-    name = var.operator_namespace
+    name = var.cne_core_namespace
     labels = {
-      "app.kubernetes.io/name"       = "f5-operator"
-      "app.kubernetes.io/component"  = "bnk-operators"
+      "app.kubernetes.io/name"       = "f5-cne-core"
+      "app.kubernetes.io/component"  = "bnk-core"
       "app.kubernetes.io/managed-by" = "terraform"
       "f5.com/product"               = "bnk"
     }
     annotations = {
-      "description" = "F5 BNK control plane + all components deployed by FLO via CNEInstance"
+      "description" = "F5 BNK CNE core — FLO operator, CWC, IPAM, RabbitMQ, Observer, OTEL"
     }
   }
 }
 
-resource "kubernetes_namespace_v1" "utils" {
+resource "kubernetes_namespace_v1" "cne_instance" {
   metadata {
-    name = var.utils_namespace
+    name = var.cne_instance_namespace
     labels = {
-      "app.kubernetes.io/name"       = "f5-utils"
-      "app.kubernetes.io/component"  = "bnk-utilities"
+      "app.kubernetes.io/name"       = var.cne_instance_namespace
+      "app.kubernetes.io/component"  = "bnk-instance"
       "app.kubernetes.io/managed-by" = "terraform"
       "f5.com/product"               = "bnk"
     }
     annotations = {
-      "description" = "F5 BNK utility components (IPAM if deployed separately)"
-    }
-  }
-}
-
-resource "kubernetes_namespace_v1" "gateway" {
-  metadata {
-    name = var.gateway_namespace
-    labels = {
-      "app.kubernetes.io/name"       = var.gateway_namespace
-      "app.kubernetes.io/component"  = "gateway-api"
-      "app.kubernetes.io/managed-by" = "terraform"
-      "f5.com/product"               = "bnk"
-    }
-    annotations = {
-      "description" = "Namespace for Gateway API resources (Gateway, HTTPRoute, etc.)"
+      "description" = "F5 BNK instance — CNEInstance workloads (TMM, CNE controller, VLANs, NADs)"
     }
   }
 }
@@ -252,28 +237,10 @@ resource "kubernetes_namespace_v1" "gateway" {
 # Create far-secret in every namespace. FLO + CNEInstance + CRD installer all
 # need to pull images from repo.f5.com.
 
-resource "kubernetes_secret_v1" "far_secret_operator" {
-  metadata {
-    name      = "far-secret"
-    namespace = kubernetes_namespace_v1.operator.metadata[0].name
-    labels = {
-      "app.kubernetes.io/name"       = "far-auth"
-      "app.kubernetes.io/managed-by" = "terraform"
-      "f5.com/product"               = "bnk"
-    }
-  }
-
-  type = "kubernetes.io/dockerconfigjson"
-
-  data = {
-    ".dockerconfigjson" = local.docker_config_json
-  }
-}
-
-resource "kubernetes_secret_v1" "far_secret_utils" {
+resource "kubernetes_secret_v1" "far_secret_cne_core" {
   metadata {
     name      = "far-secret"
-    namespace = kubernetes_namespace_v1.utils.metadata[0].name
+    namespace = kubernetes_namespace_v1.cne_core.metadata[0].name
     labels = {
       "app.kubernetes.io/name"       = "far-auth"
       "app.kubernetes.io/managed-by" = "terraform"
@@ -288,10 +255,10 @@ resource "kubernetes_secret_v1" "far_secret_utils" {
   }
 }
 
-resource "kubernetes_secret_v1" "far_secret_gateway" {
+resource "kubernetes_secret_v1" "far_secret_cne_instance" {
   metadata {
     name      = "far-secret"
-    namespace = kubernetes_namespace_v1.gateway.metadata[0].name
+    namespace = kubernetes_namespace_v1.cne_instance.metadata[0].name
     labels = {
       "app.kubernetes.io/name"       = "far-auth"
       "app.kubernetes.io/managed-by" = "terraform"
diff --git a/k8s/bnk-prerequisites/module.json b/k8s/bnk-prerequisites/module.json
index 478ecfa..abd7912 100644
--- a/k8s/bnk-prerequisites/module.json
+++ b/k8s/bnk-prerequisites/module.json
@@ -36,31 +36,24 @@
     ],
     "optional": [
       {
-        "name": "operator_namespace",
+        "name": "cne_core_namespace",
         "type": "string",
-        "description": "Namespace for FLO and all BNK components",
-        "default": "f5-operator",
+        "description": "Namespace for FLO operator and CNE core components (CWC, IPAM, RabbitMQ, Observer, OTEL)",
+        "default": "f5-cne-core",
         "source": "user"
       },
       {
-        "name": "utils_namespace",
+        "name": "cne_instance_namespace",
         "type": "string",
-        "description": "Namespace for utility components",
-        "default": "f5-utils",
-        "source": "user"
-      },
-      {
-        "name": "gateway_namespace",
-        "type": "string",
-        "description": "Namespace for Gateway API resources",
-        "default": "gateway-ns",
+        "description": "Namespace for CNEInstance workloads (TMM, CNE controller, VLANs, NADs)",
+        "default": "f5-bnk",
         "source": "user"
       },
       {
         "name": "bnk_manifest_version",
         "type": "string",
         "description": "BNK manifest version to download from FAR",
-        "default": "2.2.0-3.2226.0-0.0.385",
+        "default": "2.2.1-3.2226.0-0.0.511",
         "source": "user"
       },
       {
@@ -75,24 +68,17 @@
   "outputs": {
     "key_outputs": [
       {
-        "name": "operator_namespace",
+        "name": "cne_core_namespace",
         "type": "string",
-        "description": "Operator namespace name (FLO + all BNK components)",
-        "used_by": ["k8s/network-setup", "k8s/cert-manager", "bnk/flo", "bnk/cneinstance"],
-        "sensitive": false
-      },
-      {
-        "name": "utils_namespace",
-        "type": "string",
-        "description": "Utilities namespace name",
-        "used_by": [],
+        "description": "CNE core namespace (FLO, CWC, IPAM, Observer)",
+        "used_by": ["bnk/flo", "k8s/cert-manager"],
         "sensitive": false
       },
       {
-        "name": "gateway_namespace",
+        "name": "cne_instance_namespace",
         "type": "string",
-        "description": "Gateway namespace name",
-        "used_by": ["bnk/gateway", "bnk/routes"],
+        "description": "CNE instance namespace (TMM, VLANs, NADs, controller)",
+        "used_by": ["k8s/network-setup", "bnk/cneinstance", "bnk/bnk-vlans"],
         "sensitive": false
       },
       {
diff --git a/k8s/bnk-prerequisites/outputs.tf b/k8s/bnk-prerequisites/outputs.tf
index 7d650e9..0217e35 100644
--- a/k8s/bnk-prerequisites/outputs.tf
+++ b/k8s/bnk-prerequisites/outputs.tf
@@ -5,19 +5,14 @@
 # NAMESPACE OUTPUTS
 # =============================================================================
 
-output "operator_namespace" {
-  description = "Name of the operator namespace (FLO + all BNK components)"
-  value       = kubernetes_namespace_v1.operator.metadata[0].name
+output "cne_core_namespace" {
+  description = "CNE core namespace (FLO, CWC, IPAM, Observer)"
+  value       = kubernetes_namespace_v1.cne_core.metadata[0].name
 }
 
-output "utils_namespace" {
-  description = "Name of the utilities namespace"
-  value       = kubernetes_namespace_v1.utils.metadata[0].name
-}
-
-output "gateway_namespace" {
-  description = "Name of the gateway namespace"
-  value       = kubernetes_namespace_v1.gateway.metadata[0].name
+output "cne_instance_namespace" {
+  description = "CNE instance namespace (TMM, VLANs, NADs, controller)"
+  value       = kubernetes_namespace_v1.cne_instance.metadata[0].name
 }
 
 # =============================================================================
@@ -62,12 +57,10 @@ output "prerequisites_ready" {
   value       = true
 
   depends_on = [
-    kubernetes_namespace_v1.operator,
-    kubernetes_namespace_v1.utils,
-    kubernetes_namespace_v1.gateway,
-    kubernetes_secret_v1.far_secret_operator,
-    kubernetes_secret_v1.far_secret_utils,
-    kubernetes_secret_v1.far_secret_gateway,
+    kubernetes_namespace_v1.cne_core,
+    kubernetes_namespace_v1.cne_instance,
+    kubernetes_secret_v1.far_secret_cne_core,
+    kubernetes_secret_v1.far_secret_cne_instance,
     data.external.component_versions,
   ]
 }
diff --git a/k8s/bnk-prerequisites/variables.tf b/k8s/bnk-prerequisites/variables.tf
index c53cf8f..7a5c25c 100644
--- a/k8s/bnk-prerequisites/variables.tf
+++ b/k8s/bnk-prerequisites/variables.tf
@@ -36,22 +36,16 @@ variable "cne_pull_secret" {
 # NAMESPACE CONFIGURATION
 # =============================================================================
 
-variable "operator_namespace" {
-  description = "Namespace for FLO and ALL BNK components (CNEInstance deploys everything here)"
+variable "cne_core_namespace" {
+  description = "Namespace for FLO operator and CNE core components (CWC, IPAM, RabbitMQ, Observer, OTEL). Per F5 BNK 2.2 docs: f5-cne-core."
   type        = string
-  default     = "f5-operator"
+  default     = "f5-cne-core"
 }
 
-variable "utils_namespace" {
-  description = "Namespace for utility components (IPAM if deployed separately)"
+variable "cne_instance_namespace" {
+  description = "Namespace for CNEInstance workloads (TMM, CNE controller, VLANs, NADs). Configurable per deployment."
   type        = string
-  default     = "f5-utils"
-}
-
-variable "gateway_namespace" {
-  description = "Namespace for Gateway API resources (Gateway, HTTPRoute, etc.)"
-  type        = string
-  default     = "bnk-gw"
+  default     = "f5-bnk"
 }
 
 # =============================================================================
diff --git a/k8s/network-setup/module.json b/k8s/network-setup/module.json
index 36a53cc..f726066 100644
--- a/k8s/network-setup/module.json
+++ b/k8s/network-setup/module.json
@@ -24,7 +24,7 @@
     "required": [
       {
         "module": "k8s/bnk-prerequisites",
-        "reason": "NADs deployed to operator namespace created by prerequisites"
+        "reason": "NADs deployed to instance namespace created by prerequisites"
       }
     ],
     "optional": []
@@ -37,8 +37,8 @@
         "description": "Namespace for NADs (must match CNEInstance namespace)",
         "source": "module",
         "from_module": "k8s/bnk-prerequisites",
-        "from_output": "operator_namespace",
-        "default": "f5-operator"
+        "from_output": "cne_instance_namespace",
+        "default": "f5-bnk"
       },
       {
         "name": "external_subnet_cidrs",
diff --git a/k8s/network-setup/variables.tf b/k8s/network-setup/variables.tf
index c5676eb..3e0ea87 100644
--- a/k8s/network-setup/variables.tf
+++ b/k8s/network-setup/variables.tf
@@ -12,9 +12,9 @@ variable "cluster_name" {
 }
 
 variable "namespace" {
-  description = "Namespace for NADs — must match CNEInstance namespace (f5-operator)"
+  description = "Namespace for NADs — must match CNEInstance namespace"
   type        = string
-  default     = "f5-operator"
+  default     = "f5-bnk"
 }
 
 # =============================================================================