diff --git a/api/v1alpha1/capoperator_types.go b/api/v1alpha1/capoperator_types.go
index ed5eccf..369a980 100644
--- a/api/v1alpha1/capoperator_types.go
+++ b/api/v1alpha1/capoperator_types.go
@@ -20,6 +20,7 @@ import (
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="State",type=string,JSONPath=".status.state"
+// +kubebuilder:metadata:labels="app.kubernetes.io/component=customresourcedefinition";"app.kubernetes.io/instance=capoperators.operator.sme.sap.com";"app.kubernetes.io/name=capoperators.operator.sme.sap.com"
 
 // CAPOperator is the Schema for the CAPOperators API
 type CAPOperator struct {
@@ -35,6 +36,7 @@ type CAPOperatorStatus struct {
 	component.Status `json:",inline"`
 }
 
+// +kubebuilder:validation:ExactlyOneOf=dnsTarget;ingressGatewayLabels
 // CAPOperatorSpec defines the desired state of CAPOperator
 type CAPOperatorSpec struct {
 	// SubscriptionServer specification
@@ -126,6 +128,7 @@ type GrafanaDashboard struct {
 	ConfigMapLabels map[string]string `json:"configMapLabels,omitempty"`
 }
 
+// +kubebuilder:validation:AtMostOneOf=gardener;certManager
 type CertificateConfig struct {
 	// Gardener configuration
 	Gardener Gardener `json:"gardener,omitempty"`
diff --git a/config/crd/operator.sme.sap.com_capoperators.yaml b/config/crd/operator.sme.sap.com_capoperators.yaml
index e970361..1aa5947 100644
--- a/config/crd/operator.sme.sap.com_capoperators.yaml
+++ b/config/crd/operator.sme.sap.com_capoperators.yaml
@@ -5,9 +5,9 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.20.1
   labels:
-    app.kubernetes.io/name: capoperators.operator.sme.sap.com
-    app.kubernetes.io/instance: capoperators.operator.sme.sap.com
     app.kubernetes.io/component: customresourcedefinition
+    app.kubernetes.io/instance: capoperators.operator.sme.sap.com
+    app.kubernetes.io/name: capoperators.operator.sme.sap.com
   name: capoperators.operator.sme.sap.com
 spec:
   group: operator.sme.sap.com
@@ -46,11 +46,6 @@ spec:
             type: object
           spec:
             description: CAPOperatorSpec defines the desired state of CAPOperator
-            oneOf:
-            - required:
-              - ingressGatewayLabels
-            - required:
-              - dnsTarget
             properties:
               controller:
                 description: Controller specification
@@ -2137,16 +2132,6 @@ spec:
                 properties:
                   certificateConfig:
                     description: Certificate configuration
-                    anyOf:
-                    - oneOf:
-                      - required:
-                        - certManager
-                      - required:
-                        - gardener
-                    - not:
-                        required:
-                        - certManager
-                        - gardener
                     properties:
                       certManager:
                         description: CertManager configuration
@@ -2172,6 +2157,11 @@ spec:
                             type: string
                         type: object
                     type: object
+                    x-kubernetes-validations:
+                    - message: at most one of the fields in [gardener certManager]
+                        may be set
+                      rule: '[has(self.gardener),has(self.certManager)].filter(x,x==true).size()
+                        <= 1'
                   certificateManager:
                     description: Certificate manager which can be either `Gardener`
                       or `CertManager`
@@ -2189,16 +2179,6 @@ spec:
                 properties:
                   certificateConfig:
                     description: Certificate configuration
-                    anyOf:
-                    - oneOf:
-                      - required:
-                        - certManager
-                      - required:
-                        - gardener
-                    - not:
-                        required:
-                        - certManager
-                        - gardener
                     properties:
                       certManager:
                         description: CertManager configuration
@@ -2224,6 +2204,11 @@ spec:
                             type: string
                         type: object
                     type: object
+                    x-kubernetes-validations:
+                    - message: at most one of the fields in [gardener certManager]
+                        may be set
+                      rule: '[has(self.gardener),has(self.certManager)].filter(x,x==true).size()
+                        <= 1'
                   certificateManager:
                     description: Certificate manager which can be either `Default`
                       or `CertManager`
@@ -2235,6 +2220,11 @@ spec:
             required:
             - subscriptionServer
             type: object
+            x-kubernetes-validations:
+            - message: exactly one of the fields in [dnsTarget ingressGatewayLabels]
+                must be set
+              rule: '[has(self.dnsTarget),has(self.ingressGatewayLabels)].filter(x,x==true).size()
+                == 1'
           status:
             properties:
               appliedGeneration: