diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f9affbad506..da35a695e4dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,5 @@
 NOTE: FreeBSD builds have not been available since v0.6.0 due to a
-cross-compilation issue. The issue for tracking adding support back 
+cross-compilation issue. The issue for tracking adding support back
 can be found at [#317](https://github.com/grafana/agent/issues/317).
 
 # Master (unreleased)
@@ -11,6 +11,9 @@ can be found at [#317](https://github.com/grafana/agent/issues/317).
 
 - [ENHANCEMENT] A sigv4 install script for Prometheus has been added. (@rfratto)
 
+- [ENHANCEMENT] NAMESPACE may be passed as an environment variable to the
+  Kubernetes install scripts to specify an installation namespace. (@rfratto)
+
 - [BUGFIX] The K8s API server scrape job will use the API server Service name
   when resolving IP addresses for Prometheus service discovery using the
   "Endpoints" role. (@hjet)
@@ -20,10 +23,10 @@ can be found at [#317](https://github.com/grafana/agent/issues/317).
 
 # v0.10.0 (2021-01-13)
 
-- [FEATURE] Prometheus `remote_write` now supports SigV4 authentication using 
+- [FEATURE] Prometheus `remote_write` now supports SigV4 authentication using
   the [AWS default credentials
   chain](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html).
-  This enables the Agent to send metrics to Amazon Managed Prometheus without 
+  This enables the Agent to send metrics to Amazon Managed Prometheus without
   needing the [SigV4 Proxy](https://github.com/awslabs/aws-sigv4-proxy).
   (@rfratto)
 
@@ -44,7 +47,7 @@ can be found at [#317](https://github.com/grafana/agent/issues/317).
   work on journals that use +ZSTD compression. (@rfratto)
 
 - [BUGFIX] Integrations will now function if the HTTP listen address was set to
-  a value other than the default. ([#206](https://github.com/grafana/agent/issues/206)) (@mattdurham) 
+  a value other than the default. ([#206](https://github.com/grafana/agent/issues/206)) (@mattdurham)
 
 - [BUGFIX] The default Loki installation will now be able to write its positions
   file. This was prevented by accidentally writing to a readonly volume mount.
@@ -52,7 +55,7 @@ can be found at [#317](https://github.com/grafana/agent/issues/317).
 
 # v0.9.1 (2021-01-04)
 
-- [ENHANCEMENT] agentctl will now be installed by the rpm and deb packages as 
+- [ENHANCEMENT] agentctl will now be installed by the rpm and deb packages as
   `grafana-agentctl`. (@rfratto)
 
 # v0.9.0 (2020-12-10)
diff --git a/README.md b/README.md
index 241c59c4e4bf..dc74d09cbb81 100644
--- a/README.md
+++ b/README.md
@@ -66,9 +66,9 @@ Simply copy and paste the following lines in your terminal (requires `envsubst`
 (GNU gettext)):
 
 ```
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl apply -f -
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl apply -f -
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-tempo.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-tempo.sh)" | kubectl apply -f -
 ```
 
 Other installation methods can be found in our
@@ -93,9 +93,9 @@ quickly within the Agent. We aim to always base our vendor off of a recent offic
 Prometheus release and to keep the experimental changes not available in the upstream
 repository to a minimum.
 
-Please refer to the pinned 
-[Prometheus Vendor Update Tracking](https://github.com/grafana/agent/issues/112) issue 
-for our current vendored Prometheus release. 
+Please refer to the pinned
+[Prometheus Vendor Update Tracking](https://github.com/grafana/agent/issues/112) issue
+for our current vendored Prometheus release.
 
 For more context on our vendoring strategy, read our
 [repo maintenance guide](./docs/maintaining.md#grafanaprometheus-maintenance).
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 1d85a22fc30f..111aefd9340b 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -60,8 +60,9 @@ applied.
 > **Warning**: Always verify scripts from the internet before running them.
 
 ```
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl -ndefault apply -f -
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl -ndefault apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-tempo.sh)" | kubectl apply -f -
 ```
 
 ### Kubernetes Manifest
diff --git a/production/README.md b/production/README.md
index a147da0dfc94..27907222935d 100644
--- a/production/README.md
+++ b/production/README.md
@@ -12,12 +12,14 @@ easiest to hardest:
 
 ## Install Script for Kubernetes
 
-The Grafana Cloud Agent repository comes with an installation script to
-configure remote write and return a Kubernetes manifest that uses our preferred
-defaults. To run the script, copy and paste this line in your terminal:
+The Grafana Cloud Agent repository comes with installation scripts to
+configure components and return a Kubernetes manifest that uses our preferred
+defaults. To run the script, copy and paste this in your terminal:
 
 ```
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl -ndefault apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-tempo.sh)" | kubectl apply -f -
 ```
 
 See the [Kubernetes README](./kubernetes/README.md) for more information.
diff --git a/production/kubernetes/README.md b/production/kubernetes/README.md
index 9fc7ec5961d6..be1b63fbdeb5 100644
--- a/production/kubernetes/README.md
+++ b/production/kubernetes/README.md
@@ -26,12 +26,13 @@ install script does the following:
    step 1.
 4. Prints out the final manifest to stdout without applying it.
 
-Here's a two-line script to copy and paste to install the Agent on
-Kubernetes for collecting metrics and logs (requires `envsubst` (GNU gettext)):
+Here's a script to copy and paste to install the Agent on Kubernetes for
+collecting metrics, logs, and traces (requires `envsubst` (GNU gettext)):
 
 ```
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl -ndefault apply -f -
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl -ndefault apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-loki.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/release/production/kubernetes/install-tempo.sh)" | kubectl apply -f -
 ```
 
 ## Manually Applying
diff --git a/production/kubernetes/agent-bare.yaml b/production/kubernetes/agent-bare.yaml
index 774fe1a9b0a2..6184ec54654c 100644
--- a/production/kubernetes/agent-bare.yaml
+++ b/production/kubernetes/agent-bare.yaml
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -36,12 +37,13 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: grafana-agent
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   selector:
diff --git a/production/kubernetes/agent-loki.yaml b/production/kubernetes/agent-loki.yaml
index 42223c840961..d8763a12a0e8 100644
--- a/production/kubernetes/agent-loki.yaml
+++ b/production/kubernetes/agent-loki.yaml
@@ -262,7 +262,7 @@ data:
 kind: ConfigMap
 metadata:
   name: grafana-agent-logs
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -297,13 +297,13 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: grafana-agent-logs
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: grafana-agent-logs
-  namespace: default
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   selector:
diff --git a/production/kubernetes/agent-sigv4.yaml b/production/kubernetes/agent-sigv4.yaml
index 86fe49f31811..85f571524847 100644
--- a/production/kubernetes/agent-sigv4.yaml
+++ b/production/kubernetes/agent-sigv4.yaml
@@ -1,7 +1,10 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations:
+    eks.amazonaws.com/role-arn: ${ROLE_ARN}
   name: grafana-agent
+  namespace: ${NAMESPACE}
 ---
 apiVersion: v1
 data:
@@ -13,6 +16,7 @@ data:
             remote_write:
               - sigv4:
                     enabled: true
+                    region: ${REGION}
                 url: ${REMOTE_WRITE_URL}
             scrape_configs:
               - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
@@ -88,11 +92,11 @@ data:
                     ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                     insecure_skip_verify: false
               - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-                job_name: default/kube-state-metrics
+                job_name: ${NAMESPACE}/kube-state-metrics
                 kubernetes_sd_configs:
                   - namespaces:
                         names:
-                          - default
+                          - ${NAMESPACE}
                     role: pod
                 relabel_configs:
                   - action: keep
@@ -110,11 +114,11 @@ data:
                     ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                     insecure_skip_verify: false
               - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-                job_name: default/node-exporter
+                job_name: ${NAMESPACE}/node-exporter
                 kubernetes_sd_configs:
                   - namespaces:
                         names:
-                          - default
+                          - ${NAMESPACE}
                     role: pod
                 relabel_configs:
                   - action: keep
@@ -183,6 +187,7 @@ data:
 kind: ConfigMap
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 ---
 apiVersion: v1
 data:
@@ -194,6 +199,7 @@ data:
             remote_write:
               - sigv4:
                     enabled: true
+                    region: ${REGION}
                 url: ${REMOTE_WRITE_URL}
             scrape_configs:
               - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
@@ -227,6 +233,7 @@ data:
 kind: ConfigMap
 metadata:
   name: grafana-agent-deployment
+  namespace: ${NAMESPACE}
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -261,12 +268,13 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: grafana-agent
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   selector:
@@ -315,6 +323,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: grafana-agent-deployment
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   replicas: 1
diff --git a/production/kubernetes/agent-tempo.yaml b/production/kubernetes/agent-tempo.yaml
index e3f52d044a49..1eb55cc93965 100644
--- a/production/kubernetes/agent-tempo.yaml
+++ b/production/kubernetes/agent-tempo.yaml
@@ -61,7 +61,7 @@ data:
 kind: ConfigMap
 metadata:
   name: grafana-agent-traces
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -96,7 +96,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: grafana-agent-traces
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: v1
 kind: Service
@@ -104,6 +104,7 @@ metadata:
   labels:
     name: grafana-agent-traces
   name: grafana-agent-traces
+  namespace: ${NAMESPACE}
 spec:
   ports:
   - name: agent-http-metrics
@@ -144,7 +145,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: grafana-agent-traces
-  namespace: default
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   selector:
diff --git a/production/kubernetes/agent.yaml b/production/kubernetes/agent.yaml
index 53007006cf5b..6b251d7cb9e8 100644
--- a/production/kubernetes/agent.yaml
+++ b/production/kubernetes/agent.yaml
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 ---
 apiVersion: v1
 data:
@@ -89,11 +90,11 @@ data:
                     ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                     insecure_skip_verify: false
               - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-                job_name: default/kube-state-metrics
+                job_name: ${NAMESPACE}/kube-state-metrics
                 kubernetes_sd_configs:
                   - namespaces:
                         names:
-                          - default
+                          - ${NAMESPACE}
                     role: pod
                 relabel_configs:
                   - action: keep
@@ -111,11 +112,11 @@ data:
                     ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                     insecure_skip_verify: false
               - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-                job_name: default/node-exporter
+                job_name: ${NAMESPACE}/node-exporter
                 kubernetes_sd_configs:
                   - namespaces:
                         names:
-                          - default
+                          - ${NAMESPACE}
                     role: pod
                 relabel_configs:
                   - action: keep
@@ -184,6 +185,7 @@ data:
 kind: ConfigMap
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 ---
 apiVersion: v1
 data:
@@ -229,6 +231,7 @@ data:
 kind: ConfigMap
 metadata:
   name: grafana-agent-deployment
+  namespace: ${NAMESPACE}
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -263,12 +266,13 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: grafana-agent
-  namespace: default
+  namespace: ${NAMESPACE}
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: grafana-agent
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   selector:
@@ -317,6 +321,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: grafana-agent-deployment
+  namespace: ${NAMESPACE}
 spec:
   minReadySeconds: 10
   replicas: 1
diff --git a/production/kubernetes/build/templates/bare/main.jsonnet b/production/kubernetes/build/templates/bare/main.jsonnet
index 08db52c86f4a..d8b4fd16e256 100644
--- a/production/kubernetes/build/templates/bare/main.jsonnet
+++ b/production/kubernetes/build/templates/bare/main.jsonnet
@@ -6,7 +6,7 @@ agent {
   },
 
   _config+:: {
-    namespace: 'default',
+    namespace: '${NAMESPACE}',
 
     // Since the config map isn't managed by Tanka, we don't want to
     // add the configmap's hash as an annotation for the Kubernetes
diff --git a/production/kubernetes/build/templates/base-sigv4/main.jsonnet b/production/kubernetes/build/templates/base-sigv4/main.jsonnet
index fa5e494ddbb5..7ed4d75e2ee4 100644
--- a/production/kubernetes/build/templates/base-sigv4/main.jsonnet
+++ b/production/kubernetes/build/templates/base-sigv4/main.jsonnet
@@ -1,16 +1,20 @@
 local agent = import 'grafana-agent/grafana-agent.libsonnet';
 
+local k = import 'ksonnet-util/kausal.libsonnet';
+local serviceAccount = k.core.v1.serviceAccount;
+
 agent {
   _images+:: {
     agent: (import 'version.libsonnet'),
   },
 
   _config+:: {
-    namespace: 'default',
+    namespace: '${NAMESPACE}',
     agent_remote_write: [{
       url: '${REMOTE_WRITE_URL}',
       sigv4: {
         enabled: true,
+        region: '${REGION}',
       },
     }],
 
@@ -19,4 +23,10 @@ agent {
     // YAML manifest.
     agent_config_hash_annotation: false,
   },
+
+  agent_rbac+: {
+    service_account+: serviceAccount.mixin.metadata.withAnnotationsMixin({
+      'eks.amazonaws.com/role-arn': '${ROLE_ARN}',
+    }),
+  },
 }
diff --git a/production/kubernetes/build/templates/base/main.jsonnet b/production/kubernetes/build/templates/base/main.jsonnet
index 8726bb129ac1..687b6ad74ddd 100644
--- a/production/kubernetes/build/templates/base/main.jsonnet
+++ b/production/kubernetes/build/templates/base/main.jsonnet
@@ -6,7 +6,7 @@ agent {
   },
 
   _config+:: {
-    namespace: 'default',
+    namespace: '${NAMESPACE}',
     agent_remote_write: [{
       url: '${REMOTE_WRITE_URL}',
       basic_auth: {
diff --git a/production/kubernetes/build/templates/loki/main.jsonnet b/production/kubernetes/build/templates/loki/main.jsonnet
index 59e2d1be513e..3fef96484863 100644
--- a/production/kubernetes/build/templates/loki/main.jsonnet
+++ b/production/kubernetes/build/templates/loki/main.jsonnet
@@ -2,7 +2,7 @@ local agent = import 'grafana-agent/v1/main.libsonnet';
 
 {
   agent:
-    agent.new('grafana-agent-logs', 'default') +
+    agent.new('grafana-agent-logs', '${NAMESPACE}') +
     agent.withConfigHash(false) +
     agent.withImages({
       agent: (import 'version.libsonnet'),
diff --git a/production/kubernetes/build/templates/tempo/main.jsonnet b/production/kubernetes/build/templates/tempo/main.jsonnet
index 9b0ab1a9bb13..c96dc3d4bca1 100644
--- a/production/kubernetes/build/templates/tempo/main.jsonnet
+++ b/production/kubernetes/build/templates/tempo/main.jsonnet
@@ -11,7 +11,7 @@ local newPort(name, portNumber, protocol='TCP') =
 
 {
   agent:
-    agent.new('grafana-agent-traces', 'default') +
+    agent.new('grafana-agent-traces', '${NAMESPACE}') +
     agent.withConfigHash(false) +
     agent.withImages({
       agent: (import 'version.libsonnet'),
diff --git a/production/kubernetes/install-bare.sh b/production/kubernetes/install-bare.sh
index 057de91cd698..84e4e8253489 100644
--- a/production/kubernetes/install-bare.sh
+++ b/production/kubernetes/install-bare.sh
@@ -18,5 +18,8 @@ check_installed envsubst
 
 MANIFEST_BRANCH=v0.10.0
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-bare.yaml}
+NAMESPACE=${NAMESPACE:-default}
+
+export NAMESPACE
 
 curl -fsSL $MANIFEST_URL | envsubst
diff --git a/production/kubernetes/install-loki.sh b/production/kubernetes/install-loki.sh
index 3401368ee59c..88cc9b2b90d9 100644
--- a/production/kubernetes/install-loki.sh
+++ b/production/kubernetes/install-loki.sh
@@ -7,9 +7,10 @@
 #
 # There are three ways to provide the inputs for installation:
 #
-# 1. Environment variables (LOKI_HOSTNAME, LOKI_USERNAME, LOKI_PASSWORD)
+# 1. Environment variables (LOKI_HOSTNAME, LOKI_USERNAME, LOKI_PASSWORD,
+#    NAMESPACE)
 #
-# 2. Flags (-h for hostname, -u for username, -p for password)
+# 2. Flags (-h for hostname, -u for username, -p for password, -n namespace)
 #
 # 3. stdin from prompts
 #
@@ -31,6 +32,7 @@ check_installed envsubst
 
 MANIFEST_BRANCH=v0.10.0
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-loki.yaml}
+NAMESPACE=${NAMESPACE:-default}
 
 LOKI_USERNAME_SET=0
 LOKI_PASSWORD_SET=0
@@ -48,8 +50,11 @@ while getopts "h:u:p:" opt; do
       LOKI_PASSWORD=$OPTARG
       LOKI_PASSWORD_SET=1
       ;;
+    n)
+      NAMESPACE=$OPTARG
+      ;;
     ?)
-      echo "usage: $(basename $0) [-h Loki hostname] [-u Loki username] [-p Loki password]" >&2
+      echo "usage: $(basename $0) [-h Loki hostname] [-u Loki username] [-p Loki password] [-n namespace]" >&2
       exit 1
       ;;
   esac
@@ -78,6 +83,7 @@ if [ -z "${LOKI_PASSWORD}" ] && [ "${LOKI_PASSWORD_SET}" -eq 0 ]; then
   printf $'\n' >&2
 fi
 
+export NAMESPACE
 export LOKI_HOSTNAME
 export LOKI_USERNAME
 export LOKI_PASSWORD
diff --git a/production/kubernetes/install-sigv4.sh b/production/kubernetes/install-sigv4.sh
index 7f2f248370d9..6430d8b5461d 100644
--- a/production/kubernetes/install-sigv4.sh
+++ b/production/kubernetes/install-sigv4.sh
@@ -7,9 +7,9 @@
 #
 # There are three ways to provide the inputs for installation:
 #
-# 1. Environment variables (REMOTE_WRITE_URL)
+# 1. Environment variables (REMOTE_WRITE_URL, REGION, ROLE_ARN, NAMESPACE)
 #
-# 2. Flags (-l for remote write URL)
+# 2. Flags (-l for remote write URL, -n for namespace, -a for ARN, -r for region)
 #
 # 3. stdin from prompts
 #
@@ -31,14 +31,25 @@ check_installed envsubst
 
 MANIFEST_BRANCH=v0.10.0
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-sigv4.yaml}
+NAMESPACE=${NAMESPACE:-default}
+ROLE_ARN=${ROLE_ARN:-}
 
 while getopts "l:u:p:" opt; do
   case "$opt" in
     l)
       REMOTE_WRITE_URL=$OPTARG
       ;;
+    n)
+      NAMESPACE=$OPTARG
+      ;;
+    a)
+      ROLE_ARN=$OPTARG
+      ;;
+    r)
+      REGION=$OPTARG
+      ;;
     ?)
-      echo "usage: $(basename $0) [-l remote write url] [-u remote write username] [-p remote write password]" >&2
+      echo "usage: $(basename $0) [-l remote write url] [-n namespace]" >&2
       exit 1
       ;;
   esac
@@ -48,14 +59,26 @@ if [ -z "${REMOTE_WRITE_URL}" ]; then
   read -sp 'Enter your remote write URL: ' REMOTE_WRITE_URL
   printf $'\n' >&2
 
-  # We require a remote write URL for the agent; we don't do this same check for
-  # the username and password as the remote write system may not have basic
-  # auth enabled.
   if [ -z "${REMOTE_WRITE_URL}" ]; then
     echo "error: REMOTE_WRITE_URL must be provided by flag, env, or stdin" >&2
     exit 1
   fi
 fi
 
+if [ -z "${REGION}" ]; then
+  read -sp 'Enter the remote write region: ' REGION
+  printf $'\n' >&2
+
+  if [ -z "${REGION}" ]; then
+    echo "error: REGION must be provided by flag, env, or stdin" >&2
+    exit 1
+  fi
+fi
+
+
+export NAMESPACE
 export REMOTE_WRITE_URL
+export ROLE_ARN
+export REGION
+
 curl -fsSL $MANIFEST_URL | envsubst
diff --git a/production/kubernetes/install-tempo.sh b/production/kubernetes/install-tempo.sh
index b64ce60f03aa..67a715c396f1 100644
--- a/production/kubernetes/install-tempo.sh
+++ b/production/kubernetes/install-tempo.sh
@@ -7,9 +7,10 @@
 #
 # There are three ways to provide the inputs for installation:
 #
-# 1. Environment variables (TEMPO_ENDPOINT, TEMPO_USERNAME, TEMPO_PASSWORD)
+# 1. Environment variables (TEMPO_ENDPOINT, TEMPO_USERNAME, TEMPO_PASSWORD,
+#    NAMESPACE)
 #
-# 2. Flags (-e for endpoint, -u for username, -p for password)
+# 2. Flags (-e for endpoint, -u for username, -p for password, -n for namespace)
 #
 # 3. stdin from prompts
 #
@@ -31,6 +32,7 @@ check_installed envsubst
 
 MANIFEST_BRANCH=v0.10.0
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-tempo.yaml}
+NAMESPACE=${NAMESPACE:-default}
 
 TEMPO_USERNAME_SET=0
 TEMPO_PASSWORD_SET=0
@@ -48,8 +50,11 @@ while getopts "e:u:p:" opt; do
       TEMPO_PASSWORD=$OPTARG
       TEMPO_PASSWORD_SET=1
       ;;
+    n)
+      NAMESPACE=$OPTARG
+      ;;
     ?)
-      echo "usage: $(basename $0) [-e Tempo endpoint] [-u Tempo username] [-p Tempo password]" >&2
+      echo "usage: $(basename $0) [-e Tempo endpoint] [-u Tempo username] [-p Tempo password] [-n namespace]" >&2
       exit 1
       ;;
   esac
@@ -78,6 +83,7 @@ if [ -z "${TEMPO_PASSWORD}" ] && [ "${TEMPO_PASSWORD_SET}" -eq 0 ]; then
   printf $'\n' >&2
 fi
 
+export NAMESPACE
 export TEMPO_ENDPOINT
 export TEMPO_USERNAME
 export TEMPO_PASSWORD
diff --git a/production/kubernetes/install.sh b/production/kubernetes/install.sh
index 0d74d02a699d..c5bb1f59bb1a 100644
--- a/production/kubernetes/install.sh
+++ b/production/kubernetes/install.sh
@@ -7,11 +7,11 @@
 #
 # There are three ways to provide the inputs for installation:
 #
-# 1. Environment variables (REMOTE_WRITE_URL, REMOTE_WRITE_USERNAME,
+# 1. Environment variables (NAMESPACE, REMOTE_WRITE_URL, REMOTE_WRITE_USERNAME,
 #    REMOTE_WRITE_PASSWORD)
 #
 # 2. Flags (-l for remote write URL, -u for remote write username, -p for remote
-#    write password)
+#    write password, -n for namespace)
 #
 # 3. stdin from prompts
 #
@@ -33,6 +33,7 @@ check_installed envsubst
 
 MANIFEST_BRANCH=v0.10.0
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent.yaml}
+NAMESPACE=${NAMESPACE:-default}
 
 REMOTE_WRITE_USERNAME_SET=0
 REMOTE_WRITE_PASSWORD_SET=0
@@ -50,8 +51,11 @@ while getopts "l:u:p:" opt; do
       REMOTE_WRITE_PASSWORD=$OPTARG
       REMOTE_WRITE_PASSWORD_SET=1
       ;;
+    n)
+      NAMESPACE=$OPTARG
+      ;;
     ?)
-      echo "usage: $(basename $0) [-l remote write url] [-u remote write username] [-p remote write password]" >&2
+      echo "usage: $(basename $0) [-l remote write url] [-u remote write username] [-p remote write password] [-n namespace]" >&2
       exit 1
       ;;
   esac
@@ -80,6 +84,7 @@ if [ -z "${REMOTE_WRITE_PASSWORD}" ] && [ "${REMOTE_WRITE_PASSWORD_SET}" -eq 0 ]
   printf $'\n' >&2
 fi
 
+export NAMESPACE
 export REMOTE_WRITE_URL
 export REMOTE_WRITE_USERNAME
 export REMOTE_WRITE_PASSWORD
diff --git a/production/tanka/grafana-agent/grafana-agent.libsonnet b/production/tanka/grafana-agent/grafana-agent.libsonnet
index 0059ff885c6a..106542e4cd61 100644
--- a/production/tanka/grafana-agent/grafana-agent.libsonnet
+++ b/production/tanka/grafana-agent/grafana-agent.libsonnet
@@ -7,6 +7,7 @@ k + config {
   local daemonSet = $.apps.v1.daemonSet,
   local deployment = $.apps.v1.deployment,
   local policyRule = $.rbac.v1.policyRule,
+  local serviceAccount = $.core.v1.serviceAccount,
 
   agent_rbac:
     $.util.rbac($._config.agent_cluster_role_name, [
@@ -16,10 +17,14 @@ k + config {
 
       policyRule.withNonResourceUrls('/metrics') +
       policyRule.withVerbs(['get']),
-    ]),
+    ]) {
+      service_account+: 
+        serviceAccount.mixin.metadata.withNamespace($._config.namespace),
+    },
 
   agent_config_map:
     configMap.new($._config.agent_configmap_name) +
+    configMap.mixin.metadata.withNamespace($._config.namespace) +
     configMap.withData({
       'agent.yml': $.util.manifestYaml($._config.agent_config),
     }),
@@ -55,6 +60,7 @@ k + config {
   // TODO(rfratto): persistent storage for the WAL here is missing. hostVolume?
   agent_daemonset:
     daemonSet.new($._config.agent_pod_name, [$.agent_container]) +
+    daemonSet.mixin.metadata.withNamespace($._config.namespace) +
     daemonSet.mixin.spec.template.spec.withServiceAccount($._config.agent_cluster_role_name) +
     self.config_hash_mixin.daemonSet +
     $.util.configVolumeMount($._config.agent_configmap_name, '/etc/agent'),
@@ -62,6 +68,7 @@ k + config {
   agent_deployment_config_map:
     if $._config.agent_host_filter then
       configMap.new($._config.agent_deployment_configmap_name) +
+      configMap.mixin.metadata.withNamespace($._config.namespace) +
       configMap.withData({
         'agent.yml': $.util.manifestYaml($._config.deployment_agent_config),
       })
@@ -70,6 +77,7 @@ k + config {
   agent_deployment:
     if $._config.agent_host_filter then
       deployment.new($._config.agent_deployment_pod_name, 1, [$.agent_container]) +
+      deployment.mixin.metadata.withNamespace($._config.namespace) +
       deployment.mixin.spec.template.spec.withServiceAccount($._config.agent_cluster_role_name) +
       deployment.mixin.spec.withReplicas(1) +
       self.config_hash_mixin.deployment +
diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet
index 43166a9014f6..f099e4702f6d 100644
--- a/production/tanka/grafana-agent/v1/main.libsonnet
+++ b/production/tanka/grafana-agent/v1/main.libsonnet
@@ -4,6 +4,7 @@ local k = import 'ksonnet-util/kausal.libsonnet';
 
 local container = k.core.v1.container;
 local configMap = k.core.v1.configMap;
+local service = k.core.v1.service;
 
 // Merge all of our libraries to create the final exposed library.
 (import './lib/deployment.libsonnet') +
@@ -104,7 +105,9 @@ local configMap = k.core.v1.configMap;
         // If we're deploying for tracing, applications will want to write to
         // a service for load balancing span delivery.
         service:
-          if has_tempo_config then k.util.serviceFor(self.agent) else {},
+          if has_tempo_config 
+          then k.util.serviceFor(self.agent) + service.mixin.metadata.withNamespace(namespace)
+          else {},
       } + (
         if has_loki_config then $.lokiPermissionsMixin else {}
       ),
diff --git a/tools/release-note.md b/tools/release-note.md
index 27600b2311a7..041847262340 100644
--- a/tools/release-note.md
+++ b/tools/release-note.md
@@ -17,9 +17,9 @@ final collects traces. You will be prompted for input for each manifest. The
 script requires curl and envsubst (GNU gettext).
 
 ```
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/${RELEASE_TAG}/production/kubernetes/install.sh)" | kubectl -ndefault apply -f -
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/${RELEASE_TAG}/production/kubernetes/install-loki.sh)" | kubectl -ndefault apply -f -
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/${RELEASE_TAG}/production/kubernetes/install-tempo.sh)" | kubectl -ndefault apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/${RELEASE_TAG}/production/kubernetes/install.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/${RELEASE_TAG}/production/kubernetes/install-loki.sh)" | kubectl apply -f -
+NAMESPACE="default" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/grafana/agent/${RELEASE_TAG}/production/kubernetes/install-tempo.sh)" | kubectl apply -f -
 ```
 
 #### Docker container: